Skip to content

04. Auditing

What is Auditing?

Auditing is the process of evaluating systems, policies, and controls to ensure they meet security standards, compliance requirements, and organizational objectives.

Explanation

Auditing helps organizations verify whether their security controls are properly implemented and functioning as expected. It identifies gaps, risks, and areas for improvement.

Example

  • Checking if password policies are enforced across all systems

  • Verifying whether firewall rules are properly configured

Compliance vs Due Diligence

Compliance

Following laws, regulations, and standards.

Due Diligence

Taking proactive steps to identify and reduce risks beyond just compliance.

Explanation

Compliance is mandatory, while due diligence is a best practice. A secure organization should focus on both.

Example

  • Compliance: Implementing GDPR-required controls

  • Due Diligence: Performing additional penetration testing beyond requirements

Interviews

Explanation

Auditors conduct interviews with employees to understand:

  • Processes

  • Security practices

  • Awareness levels

This helps verify whether policies are actually followed.

Example Questions

  • How do you handle sensitive data?

  • What do you do if you detect a phishing email?

Example Scenario

An employee claims they follow password policies, but uses weak passwords. This reveals a security gap.

Review Paperwork

Explanation

Auditors review documents such as:

  • Security policies

  • Procedures

  • Logs and records

  • Compliance reports

This helps ensure that proper controls are documented and implemented.

Example

  • Reviewing access control policies

  • Checking incident response documentation

Assessments

Explanation

Assessments involve technical evaluation of systems using tools and techniques.

Types

  • Vulnerability scanning

  • Configuration review

  • Penetration testing

Example Tools

  • Nessus for vulnerability scanning

  • SolarWinds for network monitoring

Example

  • Running a scan to identify open ports and vulnerabilities

  • Detecting outdated software versions

Take Good Notes

Explanation

Proper documentation during audits is critical for:

  • Evidence collection

  • Reporting

  • Accountability

Best Practices

  • Record observations clearly

  • Capture screenshots/logs

  • Maintain timestamps

Example

  • Documenting that a server has weak encryption enabled

  • Recording evidence of missing patches

Mind Mapping

Explanation

Mind maps help auditors:

  • Organize findings

  • Understand relationships between risks

  • Plan audit scope

Example

  • Mapping network components and vulnerabilities

  • Connecting risks to business impact

Reports

Explanation

Audit reports communicate findings to stakeholders. A good report includes:

  • Identified issues

  • Risk levels

  • Recommendations

  • Evidence

Structure

  1. Executive Summary

  2. Findings

  3. Risk Analysis

  4. Recommendations

Example

  • Finding: Weak password policy

  • Risk: High

  • Recommendation: Enforce strong password rules and MFA

Audit Process Summary

Steps

  1. Planning

  2. Data Collection (Interviews, documents)

  3. Technical Assessment

  4. Analysis

  5. Reporting

Example Workflow

  • Identify scope (e.g., web application)

  • Interview developers

  • Scan application for vulnerabilities

  • Analyze results

  • Generate audit report

Practical Scenario

Scenario

A company wants to audit its internal network security.

Audit Actions

  • Interview IT staff

  • Review security policies

  • Run vulnerability scans

  • Document findings

  • Create report

Outcome

  • Identified outdated software

  • Weak access controls

  • Provided recommendations for improvement

Key Takeaways

  • Auditing ensures systems meet security and compliance standards

  • It involves both manual and technical evaluation

  • Documentation and reporting are critical

  • Due diligence goes beyond compliance