1. Security Audit

2. What is a security audit? Policy based Assessment of risk Examines site methodologies and practices Dynamic Communication

3. Audit versus Logging What are the differences?

4. Audit Components Logger Analyzer Notifier

5. What kinds of Security Audits are there? Host Firewall Networks Large networks

6. Security Policies & Documentation What is a security policy? Components Who should write it? How long should it be? Dissemination It walks, it talks, it is alive.. RFC 1244 What if a written policy doesn't exist? Other documentation

7. Components of a Security Policy Who can use resources Proper use of the resources Granting access & use System Administrator privileges User rights & responsibilities What to do with sensitive information Desired security configurations of systems

8. RFC 1244 ­ ``Site Security Handbook'' Defines security policies & procedures Policy violations Interpretation Publicizing Identifying problems Incident response Updating

9. Other Documentation Hardware/software inventory Network topology Key personnel Emergency numbers Incident logs

10. Why do a Security Audit? Information is power Expectations Measure policy compliance Assessing risk & security level Assessing potential damage Change management Security incident response

11. When to audit? Emergency! Before prime time Scheduled/maintenance

12. Audit Schedules Individual Host 12­-24 months Large Networks 12­-24 months Network 12 months Firewall 6 months

13. Design Audit How to log? What to log? What will be the syntax? How to sanitize the logs?

14. How to do a Security Audit Pre­audit: verify your tools and environment Audit/review security policy Gather audit information Generate an audit report Take actions based on the report's findings Safeguard data & report

15. Verify your tools and environment The golden rule of auditing Bootstrapping problem Audit tools The Audit platform

16. The Golden Rule of Auditing Verify ALL tools used for the audit are untampered with. If the results of the auditing tools cannot be trusted, the audit is useless

17. The Bootstrapping Problem If the only way to verify that your auditing tools are ok is by using auditing tools, then..

18. Audit Tools ­ Trust? Write them yourself Find a trusted source (person, place) Verify them with a digital signature (MD5)

19. Audit Tools ­ the Hall of Fame SAINT/SATAN/ISS Nessus lsof /pff Nmap, tcpdump, ipsend MD5/DES/PGP COPS/Tiger Crack

20. Audit/review security policy Utilize existing or use ``standard'' policy Treat the policy as a potential threat Does it have all the basic components? Are the security configs comprehensive? Examine dissemination procedures

21. Security policy Treat the policy as a potential threat Bad policies are worse than none at all Good policies are very rare Look for clarity & completeness Poor grammar and spelling are not tolerated

22. Gather audit information Talk to/Interview people Review Documentation Technical Investigation