How does terreActive conduct an IT security audit?
IT-Security Audit
Focus of the Examination
First we determine the scope of the organisational and infrastructural examination.
We look at the following areas:
Organisational aspects:
- Policies
- Procedures
- Other documents (inventories, layouts, concepts etc.)
Technological aspects:
- Physical security
- Network security
- System security
- Application security
Perspective
An organisation's IT looks entirely different from the outside than from the inside. For example, while internally file servers should be available or accounting data should be kept confidential, externally it is crucial that the website be invulnerable or the interfaces between the internet and intranet be impenetrable.
When determining the focus of the audit, it is important to realise that the worst damage to companies is done by insiders.
Extent of the Examination
The tools and methods we use in the examination depend on how extensive you want the examination to be. Two terms often heard in the context of IT security audits are black-box testing and white-box testing. In the black-box approach, the auditor has no access to the customer's internal data and therefore assumes the role of an (internal or external) cracker. By contrast, in the white-box approach, the auditor may have talks with the (security) manager or have access to internal documentation during the audit.
We principally employ the white-box testing method. A black-box audit always holds the danger of a false positive and will therefore be less beneficial to the customer.
The expenses of an IT security audit are roughly calculated using the formula "breadth * depth". If the subject of examination is not narrowed down, the customer will often benefit most by starting with a broad assessment. Based on the results of this assessment, we may then perform a more in-depth analysis of specific areas of the IT infrastructure. This may consist of an audit of the internal network or a penetration test of the website.
Our services vary according to the extent of the examination requested by the customer:
Assessment
This is a wide-ranging inspection of all security-relevant IT components and provides insights into the areas where deeper investigation is most needed.
Examination
A selected subsection of your IT components is inspected more thoroughly and documented. This test goes deeper than the assessment, but not as deep as a penetration test.
Penetration-Test
The object under investigation is localised to the greatest degree in this type of audit and is subjected to the most intensive analysis. In other words, the degree of depth is greatest under this test.
2nd Opinion
On request we can additionally provide you with an audit in the form of an independent second opinion on your IT security.
Vulnerability Assessment
Benefit from a continuous appraisal of your current vulnerability. We assess current risk-exposure levels for your systems based on their known security gaps.
