IT Security Audit: A Comprehensive Guide to Protecting Your Organization

SECURITY

TABLE OF CONTENTS
Introduction......................................................................................................................................1
LO1..................................................................................................................................................2
P1 Identify types of security risks to organizations.....................................................................2
P2 Describe organizational security procedures..........................................................................4
M1 Propose a method to assess and treat IT security risks.........................................................6
LO2..................................................................................................................................................7
P3 Identify the potential impact to IT security of incorrect configuration of firewall policies
and third-party VPNs...................................................................................................................7
P4 Show, using an example for each, how implementing a DMZ, static IP and NAT in a
network can improve Network Security......................................................................................9
M2 Discuss three benefits to implement network monitoring systems with supporting reasons.
...................................................................................................................................................11
LO3................................................................................................................................................13
P5 Discuss risk assessment procedures.....................................................................................13
P6 Explain data protection processes and regulations as applicable to an organization...........15
M3 Summaries the ISO 31000 risk management methodology and its application in IT
security.......................................................................................................................................17
LO4................................................................................................................................................18
P7 Design and implement a security policy for an organisation...............................................18
P8 List the main components of an organizational disaster recovery plan, justifying the reasons
for inclusion...............................................................................................................................20
M4 Discuss possible impacts to organization security resulting from an IT security audit......22
M5 Discuss the roles of stakeholder in the organization to implement security audit
recommendations.......................................................................................................................23
Conclusion.....................................................................................................................................24

References......................................................................................................................................25
LIST OF TABLES
Table 1: Potential benefits of network monitoring tools..............................................................11
Table 2: Types of risks..................................................................................................................21

LIST OF FIGURES
Figure 1: Different types of security test.........................................................................................5
Figure 2: NAT interfaces.................................................................................................................9
Figure 3: DMZ in network.............................................................................................................10
Figure 5: Components of security policies....................................................................................18

Introduction
Organization applies IT solution in the network for improving it functionality and performance
which also introduce various challenges in the network. Therefore, the organization must
maintain network security which consist of various policies, standards and methods which are
used for monitoring and preventing the organization from unwanted and unauthorized access of
data and resources. In these report fundamentals of network security will be studied along with
understanding various risk associated with the organizational network. Any kind of network gaps
will result in loss and unavailability of data and resources to the users. Various policies and
strategies used in an organization for minimizing and protecting the network against the risk will
be studied. The report discusses about procedure that is required for risk assessment in the
network. Lastly the current report will illustrate a design for upholding network security that is
implemented along with implementation of several security policies. The report will also discuss
about a plan for disaster recovery if the organization faces damages.
1

LO1
P1 Identify types of security risks to organizations
Some of the common risk faced by organization are discussed below:
Unauthorized use of a system:
Access is said to be unauthorized when somebody has the admission to a system, website, server,
programs. Unauthorized access is when a user tries to enter a system are where they are not
permitted. Common types of unauthorized access are Tailgating, Door Propping, Levering
Doors, Keys, Access Cards. Accessing the system Illegally will result in generation of dangerous
situations for the organizational business hence for combating this type access control
technologies must be applied. System administrators must set up alerts if any attempts of
unauthorized access attempt, along with application of user ID and passwords for securing the
systems.
Unauthorized removal or copying of data:
Unauthorized removal or copying of data is commonly called as Data thefts. Here a person or
hacker intestinally tries to steal or copy confidential organizational information to cause harm.
Common mode of data theft includes using memory cards, hard drives, emails, remote access.
These tools are used for stealing data of the organization which has some value for example,
customer details, algorithm or source code used in the system and network, network credentials,
personal information etc.
Damage of physical system assets and environment:
The hardware theft or damage occur even if the network is under the controls of administration
and technical support. Safeguarding the physical and environment are generally ignored.
However, it is most important technique to protect data and information of the organization. The
rooms and buildings that are used for storing the information and the system should be protected
appropriately so that physical damage is avoided.
Naturally occurring risks:
2