1. IT Audit and Penetration Testing What’s the difference and why should I care?

2. Overview of IT Auditing Audit FocusReasons to AuditWorking with Auditors Maximizing Results Pre-Planning and Self Audits

3. What’s the goal? 1.Test control effectiveness – Is my control designed well? 2.Test control efficiency – Is my control working as designed? 3.Identify areas of risk

4. Audit Focus Business Process – Focus on how the business is run – May or may not involve IT systems IT Systems and Process – Focus on how IT manages the applications and infrastructure www.iconfinder.com

5. Reasons to Audit ComplianceSystem Discrepancy Process Assessment and Improvement

6. Compliance Audit Regulatory Industry Voluntary or Required

7. System Discrepancy Audit Financial accounting mismatch Missing or break in system logs Business Intelligence Reports don’t match financials

8. Process Audit Adherence to body of standards – National Institute of Standards and Technology (NIST) – International Organization for Standardization (ISO 27000, 9000) – Information Technology Infrastructure Library (ITIL) – Control Objectives for Information and Related Technology (CoBIT) Adherence to internal process or procedures

9. Typical audit phases Reporting Fieldwork Audit Scoping and Reporting of Self Identified Gaps Engagement Letter Announcement

10. Notification 1-6 months prior to engagement No details other than “We’re Coming” We will be there soon!

11. Engagement Letter Identify and meet with audit manager, lead and staff auditors Auditors present proposed audit scope for management review

12. Scoping Negotiate any proposed changes in audit scope Report Self Identified Gaps

13. Fieldwork Identify documented and undocumented controls Review control for effectiveness Test control for efficiency

14. Reporting Provide opinions on control effectiveness and efficiency Provide recommend changes or improvements

15. Benefits of IT Audits 1.Identify areas of risk that were previously unknown 2.Prioritize security expenditures 3.Safeguard shareholder value 4.Helps limit liability

16. Penetration Testing and Vulnerability Scanning

17. What’s the goal? 1.See if your people or systems can be “hacked” 2.See Goal #1

18. Types of Testing and Evaluation Passive vs. ActiveVulnerability Scans vs. Penetration TestingInternal vs. ExternalSocial Engineering

19. Passive Testing Passive – Report Only – Limited in depth of scan – Easy to automate – Considered safe scan

20. Active Testing – Attempts to exploit vulnerabilities – Uses context to build reports – Can be automated – Higher risk of system failures

21. Vulnerability Scanning Scan networks or host for vulnerabilities – Software Bugs – Missing Patches – Configuration Errors High False Positive Rates – Typically not context sensitive Typically Passive Scanning Needs Validation – Penetration testing – Manual configuration checks

22. Penetration Testing Validates reports of vulnerabilities Typically intrusive process Eliminates false positives Requires awareness and intelligence Dangerous to automate

23. Social Engineering Reconnaissance (Data mining, dumpster diving) Pre-texting Phone Calls Phishing Emails Unauthorized Facility Access Media Drops

24. Internal Testing ApplicationApplication ServerDatabaseOperating System

25. External Testing PenetrationInjectionData miningPrivilege elevationRedirection

26. Benefits of Testing Identify areas where hackers can gain a foothold Prioritize security projects and expenditures Prove due diligence for insurance and legal purposes Provide assurance for shareholders and executive management

27. Summary Audits are used to test control effectiveness and efficiency You must have existing policy and procedures for an audit to be effective. A gap analysis or risk assessment may be better for your first audit Penetration testing helps discover where controls are insufficient IT audits and penetration testing work together to validate security

28. Questions & Answers