Five steps to audit-proof your IT infrastructure

Computerworld - The word audit usually makes security and IT staffs either groan or quake with fear. Failing an audit is everyone's worst nightmare because of the potential damage to the organization's reputation and its ability to transact business.
Yet with the increasing importance of regulations and standards such as Sarbanes-Oxley, ISO 17799 and Visa's Cardholder Information Security Program (CISP), the number of audits is increasing. Also increasing is the time it takes to perform the audit and the cost to the organization. Companies are being told by regulators to control key IT information processes and to clearly demonstrate such control through rigorous systems and audits.
A critical element in passing audits is demonstrating control over network and security staffs. However, this requirement remains largely ignored. A Yankee Group survey showed that 70% of companies use shared password access control techniques somewhere in their infrastructure, an inherently insecure situation given that there's no direct accountability and little way to prevent passwords from falling into the wrong hands. Further, the survey found that 58% of large retailers used access control techniques that wouldn't pass Visa's CISP standards. Several organizations are known to have failed industry-mandated audits recently because they lacked operator access controls over device and server settings.
When auditors ask IT staffs, "Who's guarding the guards?" the answer "The guards themselves" clearly isn't good enough.
Manual approach has limits
Beyond the issue of simple access control, there's the question of the basic correctness of the security systems deployed, including router access control lists, firewall rules and server privilege settings. For most organizations, demonstrating that these settings are correct usually involves tedious configuration audits performed manually every few months. One major retailer recently estimated that its quarterly audit of device access control settings required the work of two operators for three days each, or a total of six days of their time.
Manual audit reporting also raises a question of ongoing governance. If an event occurs between audits, will it be detected or will it leave the organization exposed until the next audit cycle? If operators leave the organization or a personnel matter arises, are there facilities in place to demonstrate an audit trail as required? Does each new audit request mean yet another one-time expenditure?
Five key steps in audit-proofing your infrastructure
Of the many steps required to comply with an audit, the following five in particular are often overlooked. They represent great ways to help audit-proof the infrastructure as well as increase overall IT quality.

1. Enforce operator access control standards with a flexible and granular permissions model for role-based access control to all network devices and servers. If there is an unauthorized attempt to gain access to the network infrastructure, security and IT staff should be able to detect it and alert the appropriate personnel. The same access controls may be required for technology service providers or outsourcers. Watch out for weak areas where you may have administrative passwords that are shared by multiple operators. These commonly arise in securing Unix servers and network devices, particularly legacy gear that doesn't easily support a central authentication server.
   
2. Keep an activity trail with real-time auditing, including a who, what, where and when of all operator activity and infrastructure changes, especially those that could be inappropriate or malicious. Making IT staff responsible for reporting their own activity won't cut it.
   
3. Demonstrate a strong change management process by being able to confirm that infrastructure changes go as planned with a real-time, live-network change review.
   
4. Automatically verify compliance with both external best practices and internal standards. When IT staff members change critical server or network device settings, managers must be able to ensure that they comply with industry best practices and organizational standards. Instead of yearly manual audits, IT staffs should be able to perform daily checks across their infrastructure so they can show they are looking for configuration settings that violate security policy.
   
5. Make available on-demand historical reports that security and IT staff members, as well as auditors, can view upon request to demonstrate that controls and standards have been continuously enforced. The more easily IT can generate these reports, and the less that human input is required to collect the data, the more reliable the results typically will be in the eyes of an auditor.