Auditing the network environment at a technical level: Why's, how's and aha!'s

Abstract

One of the pervasive concerns in dealing with cyber-security is the dreaded information systems (IS) audit. Most companies of a goodly size have an IS audit staff and if you work for a financial organization like a bank, you can count on regular visits by the populus thereof. We have all been indoctrinated to the necessity of IS audits and if you have ever worked for a larger company, you have been through them more than once — usually with mixed results, some good, some bad, some you are not terribly sure about. I have seen the entire gamut of IS audit results in my career and, unfortunately, when it comes to network security audits, most are on the “we're not sure how to really find the right data and therefore did a lame job and the networking geeks know it and are laughing at us” end of the spectrum.