There are 6 basic entry points into any network:

1. Through a firewall / DMZ
   1. Usually a single IP address or perhaps a couple but it is not too difficult to launch an audit against these targets.
   2. Most audits reveal issues related to the OS, Services running, and Web Servers (IIS5 – 7 or Apache) and Applications such as SQL, Oracle 9 – 12x etc…

2. Partner networks / Wireless networks
   1. A big problem here is most organizations don’t know how many partner networks they have some you almost need a broad audit just to discover the different networks. Then prioritize with networks to audit first. This takes awhile

3. Dialup / vpn networks
   1. There are tools called war dialers that look for carrier and then attempts look for some type of login request, these numbers discovered require research to identify they are within a corporate PBX or phone system. This requires sometimes calling the phone company for inquiries.

4. Virus backdoor can be common
   1. These are not to hard to find, the scanning tools looks for services listening on known back door tools ports. Sometimes you have to scan a little further sine some tools can change the ports they use.

5. The internal employees (most common)
   1. Social engineering this requires someone talking their way into secure areas or stealing items such as laptops/badges or passwords to see how far they can get. These audits are tough to do not with difficulty but it takes courage. This can also include a sweep for bugs and hidden cameras, you would be surprised how many people are being watched these day’s.

6. Someone taps into a line outside the building to your network pipe or they use a tempest device to pick up emissions from your terminals (only the government does stuff like this)
   1. Only a metal shielded building can protect you, some one wants the data real bad and they are going to get it in most cases.

6. 2. If you did all 5 of these there still a %30 probability that you will be compromised. What you want to do is frustrate the attacker or perpetrator to go somewhere else to play.

Audits don’t guarantee security, it does go along way to prevent an incident bases on negligence. It does show due diligence, it stands well with insurance agency against intellectual loss, it looks good for corporate/shareholder confidence and it does assist organizations with compliance with local, state, federal security and regulatory compliance issues.

Backlink:

www.bestitdocuments.com