In this section of the course, we're going
to talk about audits and assessments.
Audits and assessments play an important role in ensuring
the robustness and reliability of organization's security
and infrastructure, and these processes are the key
to identifying vulnerabilities,
validating security measures,
and maintaining compliance with regulatory standards.
First, we have audits.
Audits are a systematic evaluation
of organizational information systems, applications,
and security controls
to ascertain their efficiency and effectiveness.
They are typically conducted by an independent entity
to provide an unbiased view
of the organization's security posture.
Now, audits can be an internal
or external, depending on the source of the audit.
Now, internal audits are conducted
by the organization's own audit team,
while external audits are performed by third party entities.
An example of an internal audit would be an organization's
internal audit team, conducting a review
of the company's data protection policy.
They will check whether the policies are up to date,
comprehensive, and in line
with the latest regulatory requirements.
They also verify if these policies are being followed
correctly by all employees.
An example of an external audit would be a third party
auditor being hired
to evaluate an e-commerce company's compliance
with PCI DSS
or Payment Card Industry Data Security Standard.
The auditor checks the company's network security,
data encryption methods, and access control mechanisms
to ensure that credit card information
is being handled securely.
Audits are crucial for identifying gaps in security
policies, procedures, and controls.
They also help in ensuring compliance
with various regulatory standards like the General Data
Protection or GDPR, Health Insurance Portability
and Accountability Act, or HIPAA
and the Payment Card Industry Data Security Standard,
or PCI DSS.
Second, we have assessments.
Assessments are about performing a detailed analysis
of a security organization's systems
to identify vulnerabilities and risks.
They're often performed before implementing any new system
or making significant changes to an existing ones.
The goal of assessment is to understand the potential risk
and threats to an organization's information system
and propose mitigation strategies
to address these vulnerabilities.
Assessments can be categorized into risk assessments,
vulnerability assessments, and threat assessments.
Each type of these assessments focus on a different aspect
of security and provides valuable insight
to help strengthen the organization's security posture.
So in this section of the course,
we'll be focusing solely on domain five,
specifically objective 5.5, which states
that you must be able to explain types
and purposes of audits and assessments.
First off, again,
we'll cover internal audits and assessments.
Internal audits and assessments are evaluations conducted
within an organization to review its processes, controls,
and compliance to ensure operational effectiveness
and adherent to internal policies.
Then we're going to jump right into the demo on how
to perform an internal assessment so that we can show you
how to review an organization's processes, controls,
and compliance within its internal policies.
After that, we're going to talk about
external audits and assessments.
External audits and assessments are independent evaluations
performed by external parties to verify organization's
financial statements, compliant
and operational practices against
established standards and regulations.
Then we're going to go back to another demo
and perform an external assessment so that you can see
how a third party or independent auditor
or assessor can review the organization's security posture.
Following that, we're going to discuss penetration testing.
Now, penetration testing often referred to as a pen test
or ethical hacking,
is a simulated cyber attack against a computer system,
network or web application to identify vulnerabilities
that could be exploited by attackers.
Then we'll take a look at reconnaissance and pen testing.
In this lesson, we're going to discuss the need
for reconnaissance based on the type of pen test
and the environment, including known environments,
partially known environments, unknown environments,
and we're also going to discuss different types
of reconnaissance, which are passive and active.
Next, we'll dive into a quick demo showing how
to perform a basic pen test by using tools like Nmap
and Metasploit to scan a network for a vulnerable machine,
and then how to exploit that vulnerability
to gain full administrative access over
the targeted machine.
After that, we'll cover attestation of findings.
Now, attestations of findings
is a formal written declaration
or confirmation of the results
or outcomes of an audit or assessment.
And finally, we're going to take a short quiz just to see
what you learned during this section of the course,
and review each of those quiz questions fully to ensure
that you can explain why the right answers were right.
So let's dive into our coverage of audits
and assessments in this section of the course.