5: Auditing Network security controls

Question 1

Auditing architecture

Answer 1

• Architecture diagrams - The IS auditor should obtain and become familiar with high-level and detailed architecture diagrams that show the logical relationships between key network and system features.
• Architecture documents - Visual diagrams are usually accompanied by written documents that describe the purpose of various architectural features.
• Support of business objectives - The IS auditor should determine if the network’s architecture supports key business objectives.
• Compliance with security policy The IS auditor should determine if the network’s architecture is compliant with the organization’s security policy.
• Comparisons of documented versus actual The IS auditor should examine several key points in the documented network architecture to see if the network’s configuration actually reflects its documented design. The IS auditor should seek to understand any discrepancies found.
• Change and review process The IS auditor should determine if the organization has any processes used to identify, review, and approve any network architecture changes, as well as updates to diagrams and documentation.

Question 2

Auditing Firewalls - Countermeasures

Answer 2

IS auditor should examine network architecture (described earlier in this section) and understand the role of firewalls in the network. With this understanding, the auditor should carefully examine network security policies, firewall access control lists, and configurations to determine if firewalls support security policy. The auditor should also examine change control records and firewall change records to determine if all firewall changes are approved and applied properly.

Question 3

Auditing Remote Access

Answer 3

The IS auditor should examine remote access policy to determine acceptable remote access scenarios. The auditor should then examine remote access servers and some workstations to determine if remote access infrastructure supports and enforces policy.

Question 4

Auditing Wi-Fi Access Points

Answer 4

The IS auditor should determine whether Wi-Fi access points are used and, if so, how they are controlled. The IS auditor should determine whether there are any rogue (unapproved) access points in use and whether the organization routinely scans for them and takes action.