Information security audit

Information security audit is the main tool for monitoring the state of information systems security of a company. The service can be performed both in conjunction with a general IT audit and as an independent project.

Security audit is carried out to address the challenges:

• Increasing the information system level of protection to an acceptable level;
• Optimization and planning of costs for ensuring information security and getting the maximum result from invested funds;
• Confirmation that the internal controls used are appropriate for the organization's objectives and that they can ensure efficiency and business continuity;
• After information security incidents (worst case).

Information security audit is a service that can and should be ordered periodically. Performing such an audit, for example, once a year, allows you to make sure that the level of the information security system remains at the same level.

Information security audit allows you to get the most complete and objective assessment of the security of the information system, to localize existing problems. Develop recommendations for changing the organization's information security system to the best.

Information security audit can be carried out both by staff (internal audit) and by engaging independent specialists (external audit). Benefits of external audit of information security from Qwerty Networks for clients:

• An audit is an independent study that allows you to achieve objective results.
• Our experts conducting the audit are more qualified and more experienced in such work than the regular employees of the organization.
• It is cheaper to entrust audit work to a specialized organization because organizing their high-quality performance on your own is much more expensive.

Information security audit types:

Comprehensive systems security audit - a testing of information systems security, which includes an inventory of resources, manual and automated search for vulnerabilities at all levels (network, OS, DBMS, application), attempts to exploit vulnerabilities, check the possibility of implementing various cyberattacks and so on… The purpose of such testing is to identify and document the maximum number of exploited vulnerabilities for their subsequent elimination.

Information security system management audit - audit of information security management processes for compliance with the requirements of the international standard ISO 27001: 2005 or Russian GOST R 27001: 2006.

We also conduct audits for compliance with the requirements of Russian legislation (Federal Laws N 152-FZ "On Personal Data", N 161-FZ "On the National Payment System", etc.)

Penetration testing is a test in which an expert is tasked with gaining access to certain data and he is practically unlimited in the choice of hacker tools to achieve this goal. The result of the audit is a report describing a successful penetration scenario with a description of the vulnerabilities used. As part of testing, social engineering methods can be used, with the help of which the ability of company employees to resist deceptive and manipulative techniques aimed at obtaining confidential information is assessed.

Program code security audit - analysis of software source codes in order to identify vulnerabilities associated with coding errors, deliberate insertion of software bookmarks, the presence of undocumented features, etc.

Web security audit - search and elimination of vulnerabilities in the code of websites, as well as the introduction of preventive measures to protect against hacker attacks.

Network security testing is taking place for all types of information security audits.

The essence of network security testing is that using special software and methods (including security analysis systems) an information about the state of the network security system is collected. The state of the network protection system refers only to those parameters and settings, the use of which helps a hacker to penetrate the network and cause damage to the company.

When performing this type of audit on the information protection system, as many network attacks as possible are simulated that a hacker can perform. At the same time, the auditor is artificially placed precisely in the conditions in which the hacker works - he is provided with a minimum of information, only that which can be obtained from open sources. Of course attacks are only simulated and do not have any destructive effect on the information system. Their variety depends on the security analysis systems used and the qualifications of the auditor. The result of network security testing is information about all network vulnerabilities, their degree of severity and methods of elimination, information about widely available data (information available to any potential intruder) of the customer's network.

When testing network security always conducted:

• Determination of the customer's IP addresses available from external networks;
• Scanning of IP addresses in order to determine the running services and services, determining the purpose of the scanned hosts;
• Definition of versions of services and services of scanned hosts;
• Studying the routes of traffic to the customer's hosts;
• Collection of information about the customer's IP from open sources;
• Analyses of the received data in order to identify vulnerabilities.

At the end of the network security testing are issued recommendations for upgrading the information protection system. That can eliminate dangerous vulnerabilities and thereby increase the level of protection of the information system from the actions of an "external" attacker with minimal costs for information security.

The service is provided within the framework of the direction of Information Security.

Cooperation options