Computerized applications are the lifeblood of modern businesses, being both an enabler and a significant risk. Effective IT security and audit programs must ensure that these business enablers operate on a solid software infrastructure foundation to minimize risks and to improve compliance with many challenging regulatory requirements. In this highly practical, hands-on seminar, we identify the major software infrastructure building block control points used to design, operate, and secure modern distributed business applications. We also pinpoint major threats, risks and industry best practice controls associated with different distributed application configuration scenarios. Special emphasis is placed on software security best practices and IT audit procedures for important technical and administrative controls including: security baselines, separation of duties, least privilege, identity management, logical access control, configuration management, change control, and software integrity.
To reinforce the concepts presented in the class, we guide attendees through a series of practical, repeatable hands-on IT audit and security assessment exercises targeted at each of the major software infrastructure building blocks including: operating systems (Windows Server, Unix/Linux) and associated system software, web servers (Apache, Microsoft IIS), and database management systems (Microsoft SQL Server, Oracle).
We will provide the opportunity to use a wide array of built-in/bundled, open source, and low-cost commercial software tools to ensure widespread applicability and affordability when the student goes back to the office to apply the lessons learned in real life. We will also expose the attendees to relevant network security and IT audit tools in the commercial marketplace that their organization may already own or may consider purchasing in the near future. All exercises are documented, highlighting the security and IT audit objective(s) and evidence gathering and analysis procedures and can be easily incorporated into work programs to meet different IT audit and security assessment project requirements. Attendees will also receive valuable checklists/work programs along with copious references for supportive information and audit tools.
This course is available on-site at your location, or offered through open enrollment 6/15/20 - 6/19/20.
Learning Objectives
- 1 Software Infrastructure Essentials, logical access control objectives and audit targets for distributed applications, defining and documenting distributed application software architectures: computing models, middleware concepts, software building blocks and infrastructures, risks to distributed applications, auditing TCP/IP application security, auditing file sharing protocols.
- 2 Securing and Auditing Operating Systems, and Other System Software, defining types and roles of different types of system software, software and user privileged authority risk, safeguards, and audit procedures, fundamental security controls for operating systems and other system software components, collecting audit data from server operating systems, virtualization (hypervisor) security and audit.
- 3 Securing and Auditing Windows Server Active Directory, windows server architecture, windows user accounts and groups, windows security policies, windows access authorization and privileged authority, windows system software security, windows security audit (event) log management, windows server best practice security checklist.
- 4 Securing and Auditing Unix Linux Systems, surveying the Unix Linux landscape, Unix system policies and configuration, Unix user identification and authentication, Unix file system data protection, Unix system software security, Unix security audit (event) log management, Unix Linux server best practice security checklist.
- 5 Securing and Auditing Database Management Systems, Database Management Systems (DBMS) terminology, Structured Query Language (SQL) concepts and targets, security risks associated with DBMS systems, DBMS security safeguards, DBMS audit data collection and analysis, DBMS best practice security checklists.
- 6 Testing the Security of Your Web Storefront, web application architectures building blocks and control points, web application technology security risks, discovering, enumerating and vulnerability testing for web applications.