Five steps to audit-proof your IT infrastructure

The word audit usually makes security and IT staffs either groan or quake with fear. Failing an audit is everyone's worst nightmare because of the potential damage to the organization's reputation and its ability to transact business.

Yet with the increasing importance of regulations and standards such as Sarbanes-Oxley, ISO 17799 and Visa's Cardholder Information Security Program (CISP), the number of audits is increasing. Also increasing is the time it takes to perform the audit and the cost to the organization. Companies are being told by regulators to control key IT information processes and to clearly demonstrate such control through rigorous systems and audits.

A critical element in passing audits is demonstrating control over network and security staffs. However, this requirement remains largely ignored. A Yankee Group survey showed that 70% of companies use shared password access control techniques somewhere in their infrastructure, an inherently insecure situation given that there's no direct accountability and little way to prevent passwords from falling into the wrong hands. Further, the survey found that 58% of large retailers used access control techniques that wouldn't pass Visa's CISP standards. Several organizations are known to have failed industry-mandated audits recently because they lacked operator access controls over device and server settings.

When auditors ask IT staffs, "Who's guarding the guards?" the answer "The guards themselves" clearly isn't good enough.

Manual approach has limits

Beyond the issue of simple access control, there's the question of the basic correctness of the security systems deployed, including router access control lists, firewall rules and server privilege settings. For most organizations, demonstrating that these settings are correct usually involves tedious configuration audits performed manually every few months. One major retailer recently estimated that its quarterly audit of device access control settings required the work of two operators for three days each, or a total of six days of their time.

Manual audit reporting also raises a question of ongoing governance. If an event occurs between audits, will it be detected or will it leave the organization exposed until the next audit cycle? If operators leave the organization or a personnel matter arises, are there facilities in place to demonstrate an audit trail as required? Does each new audit request mean yet another one-time expenditure?

Five key steps in audit-proofing your infrastructure

Of the many steps required to comply with an audit, the following five in particular are often overlooked. They represent great ways to help audit-proof the infrastructure as well as increase overall IT quality.

  1. Enforce operator access control standards with a flexible and granular permissions model for role-based access control to all network devices and servers. If there is an unauthorized attempt to gain access to the network infrastructure, security and IT staff should be able to detect it and alert the appropriate personnel. The same access controls may be required for technology service providers or outsourcers. Watch out for weak areas where you may have administrative passwords that are shared by multiple operators. These commonly arise in securing Unix servers and network devices, particularly legacy gear that doesn't easily support a central authentication server.

  2. Keep an activity trail with real-time auditing, including a who, what, where and when of all operator activity and infrastructure changes, especially those that could be inappropriate or malicious. Making IT staff responsible for reporting their own activity won't cut it.

  3. Demonstrate a strong change management process by being able to confirm that infrastructure changes go as planned with a real-time, live-network change review.

  4. Automatically verify compliance with both external best practices and internal standards. When IT staff members change critical server or network device settings, managers must be able to ensure that they comply with industry best practices and organizational standards. Instead of yearly manual audits, IT staffs should be able to perform daily checks across their infrastructure so they can show they are looking for configuration settings that violate security policy.

  5. Make available on-demand historical reports that security and IT staff members, as well as auditors, can view upon request to demonstrate that controls and standards have been continuously enforced. The more easily IT can generate these reports, and the less that human input is required to collect the data, the more reliable the results typically will be in the eyes of an auditor.

Who benefits the most"

These steps are a tall order with the traditional manual approach of tracking activity and handling audits. Packaged solutions are available and although they aren't suitable for every enterprise, they can be pivotal in:

  • High-transaction volume networks, such as in retail and financial services industries and outsourced service providers;

  • Highly regulated industries such as financial services, health care, pharmaceuticals and governmental organizations;

  • Medium to large enterprises sized by either the number of network operators or the number of devices. For example, organizations with only two security administrators covering 2,000 devices face the same imperative for automated operator access control as organizations with 500 operators and 100 devices;

  • Publicly held entities whose results are subject to Sarbanes-Oxley and who are looking to Cobit as a model for IT compliance.

With a rigorous, well-documented approach to operator access control and audit response, organizations will be in a good position to survive their next audit and assure their customers, executives and business partners of the integrity of the infrastructure that runs the enterprise.

Copyright © 2004 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon