Conducting a Security Audit: IT Audit Methodology

Today, to ensure a sufficient level of protection across your entire infrastructure, it is essential to conduct audits. This course aims to illustrate all methods for testing systems with known attacks. Conducting an audit involves rules and limitations that need to be understood. This training describes the different audit methodologies and their specific characteristics. It also presents the essential tools and practical exercises to understand and know how to use them.

Specific Objectives:

• Clearly define an audit and know the existing methods
• Understand the rules and commitments of an audit and its limitations
• Learn about recognized methodologies

• HSF/HSA course level
• Knowledge of Linux and Windows systems

• Code: AUDSI
• Duration: 3 days
• Schedule: 8:30 AM - 5:30 PM
• Location: 4-star hotel, Tunis

• Security consultants
• Developers
• Engineers / Technicians

• Course materials
• 40% demonstration
• 40% theory
• 20% practical exercises

• Day 1
  • Introduction to penetration testing
  • Definition of penetration testing
  • The importance of penetration testing
  • The phases of a penetration test
  • Reconnaissance
  • Vulnerability analysis
  • Exploitation
  • Gaining and maintaining access
  • Reporting and test completion
  • Rules and commitments
  • Technical scope of the audit
  • Auditor's responsibilities
  • Common constraints
  • Legislation: Legal articles
  • Usual precautions
  • Types of penetration tests
  • External
  • Internal
  • Methodology
  • Utility of methodology
  • Audit methods
  • Recognized methodologies
  • Particularities of the audit
  • of classic infrastructure
  • of SCADA infrastructure
  • web
  • code review
• Day 2
  • Configuration audit tools (SCAP, checklists, etc.)
  • Code audit tools
  • Code analysis tools
  • Static analysis tools
  • Dynamic analysis tools
  • Information gathering tools
  • Information gathering
  • Open sources
  • Active
  • Scanning
  • Port scanning
  • Vulnerability scanning
  • Attack tools
  • Network tools
  • System analysis tools
  • Web analysis tools
  • Exploitation frameworks
  • Access maintenance tools
• Day 3
  • Case study
  • Applying methodology and tools to a real-world case
  • Deliverables
  • Risk assessment
  • Impact, likelihood, and criticality of a vulnerability
  • Organizing the report
  • Additional services to propose