Educause Security Discussion mailing list archives
Re: checklists/auditing within the IT department
From: Brad Judy <win-hied () BRADJUDY COM>
Date: Thu, 11 Dec 2008 16:25:43 -0500
When I was working on a questionnaire for IT risk assessment, I created one based largely on NIST 800 series docs (800-26 and 800-53). I recommend looking at the NIST 800 series special publications - http://csrc.nist.gov/publications/PubsSPs.html It looks like they pulled the self assessment questionnaire document I referenced from their website, which is unfortunate because I found it to be a good starting point (I have a copy if you'd like one). I liked the approach of asking not only if something was being done, but also if it was documented and if someone was verifying that it was being done. These aspects are often weaknesses, particularly in an IT shop that is stretched thin on human resources. In the end, we changed a lot of the questions and cut down the length quite a bit, so the end product is a bit different. Naturally, there's CERT OCTAVE stuff too, but it's a LOT to sift through if you're just looking for a simple questionnaire. http://www.cert.org/octave/ U Virginia has a good website on their IT risk management process that includes their questionnaires: http://www.itc.virginia.edu/security/riskmanagement/ I'll keep Rodney happy and plug the Educause Security Risk Assessment and Analysis section too :-) http://connect.educause.edu/term_view/Security%2BRisk%2BAssessment%2Band%2BAnalysis Brad Judy ----- Original Message ----- From: "Youngquist, Jason R." <jryoungquist () CCIS EDU> To: <SECURITY () LISTSERV EDUCAUSE EDU> Sent: Wednesday, December 10, 2008 3:41 PM Subject: [SECURITY] checklists/auditing within the IT department I'm looking for any recommendations on books or documents for auditing/best practices within one's IT department. Our department is broken up into 5 sections: Data Services - support the student information system - by programming and system support Web Services - program web applications & work on databases Network Services - physical security, networking gear (routers, firewalls, switches, etc.) servers (Windows, Linux, and a number of different applications), and VOIP services End User Support - purchase, deploy, and fix desktop computer-related issues Helpdesk/Computer Lab - provide support to customers and student computer lab(s). I'm looking for a number of questions/checklists/best practices to ask individuals in each section of the department. The goal is to come up with a list of questions/checklists so each week I'll talk to an individual from each section of the department and ask them a few questions (from a long list of questions from their particular area) in order make sure things are working properly, security is being followed, and determine if there are any issues that need to be addressed. Here are some example questions: Generator XYZ - does a self-check happen? If so, when? Has the self-check been successful? Servers - Which servers are being backed up? Are there new servers which haven't been added to the tape backup schedule yet? Servers - When was the last time a file restore was done? Was it successful? Inventory - When was the last time a computer inventory was done? Where is it located? VOIP - What steps are being taken to reduce/eliminate toll fraud, eavesdropping, caller-id spoofing, denial of service, etc. Web - Is there an inventory of web applications? If so, where is it located? Web - Is there a document of coding best practices? If so, where is it located? I've been doing some googling and brainstorming, but appreciate any additional information. Thanks. Jason Youngquist Information Technology Security Engineer Technology Services Columbia College 1001 Rogers Street, Columbia, MO 65216 (573) 875-7334 jryoungquist () ccis edu http://www.ccis.edu
Current thread:
- checklists/auditing within the IT department Youngquist, Jason R. (Dec 10)
- <Possible follow-ups>
- Re: checklists/auditing within the IT department Basgen, Brian (Dec 10)
- Re: checklists/auditing within the IT department Aaron Kirby (Dec 10)
- Re: checklists/auditing within the IT department Doug Markiewicz (Dec 11)
- Re: checklists/auditing within the IT department Scott O. Bradner (Dec 11)
- Re: checklists/auditing within the IT department John Ladwig (Dec 11)
- Re: checklists/auditing within the IT department Brad Judy (Dec 11)
- Re: checklists/auditing within the IT department Kathy Bergsma (Dec 12)
- Re: checklists/auditing within the IT department Harris, Michael C. (Dec 12)