> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/auditing-fundamentals.md). # Auditing Fundamentals ### What is Cybersecurity ? Computer Security, Cybersecurity, or information technology security is the protection of computer systems and networks from information disclosure, theft, or damage to their hardware, software, or electronic data as well as from disruption or misdirection of the services they provide. What are we Securing? * Personally Identifiable Information * Healthcare Information * Financial Data * Intellectual Property * Business Secrets * Business Operations Securing from Whom? * Criminals * Competitors * Insider Threats * Malicious Actors How do we begin? CIA Triad * **Confidentiality**(For your eyes only) - Your information only gets shared with whoever you see if it needs it. * **Integrity**(Only Authorized Changes, Please) - it means that only authorized changes occur. The information that you put into the system is the same information you get out of the system. * If you save something, you want to come back and know that it is the same. * If you send something you want to know that what is received at the other end matches exactly what you sent. * **Availiability**(I have a job to do here) - You have information and even if it's kept secure you have it for a reason. Perhaps it's get your job done. * It must be made available to the proper people when they want it. *Note : You need to balance integrity, confidentiality, and availiablity to meet business needs.* ### *Defense in Depth* We build up many different layers of protections Risk Management - What they need to secure, How thye need to secure it, how they need to make it available, will really shape what they're going to do with cybersecurity * It's a business so money plays a big factor * How much will it cost to secure something VS what is the cost going to be if we poorly secure it? * It can come down to insurance * It can come down to possible lawsuits, in the case of a breach. * It could come down to loss of revenue if intellectual property is lost. All of these things go into risk management. And it's not just cybersecurity that's part of the risk management. All business decisions in an organization will be mixed into risk management #### Compliance Alot comes to risk management, and sometimes, a company might think, you know what? We're going to accept the risk. Regulation by some companies and government that says you must put these things into place. Otherwise you could be fined and lose the ability to operate in certain regions. * **Payment Card Industry Data Security Standard (PCI DSS )** * Mandated by card brands * Administered by the Payment Card Industry Security Standards Councils * Created to increase controls around cardholder data to reduce credit card fraud. * **Health Insurance Portability and Accountability Act of 1996 (HIPAA)** * US regulations for the use and disclosure of Protected Health Information (PHI) * The final rule on security standards was issued on February 20,2003 * Standards and Specifications * Administrative Safeguards * Physical Safeguards * Technical Safeguards * **General Data Protection Regulation (GDPR)** * Data protection and privacy law in the European Union (EU) and the European Economic Area (EEA) * Controllers and Processors of personal data must put in place appropriate technical and organizational measures to implement the data protection principles * **Carlifornia Consumer Privacy Act (CPPA)** * Intended to enhance privacy rights and consumer protection for residents of California, United States. * Companies that become victims of data theft or other data security breaches can be ordered in civil class action lawsuits to pay statutory damages. * Liability may also apply in respect of businesses in overseas countries who ship items into California. * **Sarbanes-Oxley Act of 2002 (SOX)** * US federal law mandates certain practices in financial record keeping and reporting for corporations. * Requires strong **internal control process** over the **IT infrastructure** and **applications** that house the financial information that flows into its **financial reports** in order to enable them to make **timely disclosures** to the public **if a breach were to occur**. #### Framework * **International Organization for Standardization and the International Electrotechnical Commision** (ISO/IEC 27000) * Deliberately broad in scope * Covering more than just privacy, confidentiality and IT/technical/cybersecurity issues. * Applicale to organization of all shapes and sizes. * ISO/IEC 27001 * Information technology -> Security Techniques -> information security management systems -> Requirements * ISO/IEC 27002 * Code of practice for information security controls * **Control Objectives for Information and Related Technologies (COBIT)** * Created by ISACA for information technology (IT) management and IT governance * Business focused and defines a set of generic processes for the management of IT * **National Institute of Standards and Technology (NIST)** * Catalog of security and privacy controls for all U.S federal information systems except those related to national security. * Agencies are expected to be compliant with NIST security standards and guidlines. * NIST Special Publicatio 800-53B provides a set of baseline security controls and privacy controls for information systems and organizations. * **Center for Internet Security (CIS)** * Set of 18 priortized safeguards to mitigate the most prevalent cyber-attacks * A defense-in-depth model to help prevent and detect malware. * Offers a free, hosted software product called CIS Controls Self Assessment Tool (CIS-CSAT). * **Cybersecurity Maturity Model Certification (CMMC)** * A training certification, and third party assessment program of cybersecurity in the United States government Defense Industrial Base. * Requires a third party assessor to verify the cybersecurity maturation level. * 5 levels * **Australian Cyber Security Centre Essential Eight Maturity Model (ASD) Australian Signals Directorate** * Help organisations protect themselves against various cyber threats. * Designed to protect Microsoft Windows-based internet-connected networks * 4 maturity levels Why we doing Auditing in pentesting course? * Because our pentest is going to all lead back to the company, to the organization, to your customers. We need to add value to them. * And they need to get something useful that they can then implement in their organizations themselves to mix into theri risk managemnt; to understand -> You definitely should do this. It's highly -- it's very sever -> It most probably lead to having a breach and losing information. -> You should probably also implement this. -> You could also implement that -> And i also recommend this other thing. #### Auditing The company maybe doing an audit for **compliance**. They want to take credit card information and so they have to be in compliance. Or maybe a company just wants to do their due diligence. Maybe they're not compelled by any regulation but they want to be secure because they have to * Auditing - It is the way that a company can check and see wheather they, themselves are in compliance or a third party can come in and run an audit to see if they're following the guidelines. * It start with interview, interviewing the CISO, the system admins, whoever is touching, creating, using information * They ask workers * if they were given any security awareness training this year ? * What practice you know about? * What practices are you forced into ? * Can you plug in USBs ? * Do you have access to the building via some sort of Multi-factor authentication? * Often there is a review of paper work Tools like a Nessus scan or SolarWinds auditing tools are used. As an auditor or a pentest you need to take good notes. NoteTaking Apps * **Joplin** has auto-archiving functionality. * **Sublime Test**, depending on you can put things in markdown. * **OneNote** is often a very useful tool as you can collabrate with other members of the team or into a useful format for your report. * Mindmaps > "You're not getting paid for your pentest, you're getting paid for your report that goes with your pentest." - Josh Mason