Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of tools and checklists should I use when transferring institutional knowledge from colleagues who have decided to leave the company?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

You'll want at a minimum:

1.) logical infrastructure diagrams

2.) physical infrastructure diagrams

3.) usernames/passwords at the admin (enabled) level

4.) peer router lists

5.) trusted user lists

From this point you can audit configuration settings and start baselining the current network activity. Where you go from there is up to you.

share|improve this answer
    
You should also ask for details of any known risks that have been accepted by the teams / organisation. There may be activities that go against company policy that have been "accepted" but will become your issue. So being aware would be a positive. –  David Stubley Dec 18 '10 at 13:47
    
great, very valuble –  Alexander Pavluchenko Dec 19 '10 at 19:22
add comment

Some great information already provided, I would also add:

  1. In addition to @iivel's answer you will also want documentation on management of the environments, especially PKI. There should be ceremony documents, practice statements, support plan info, etc.

  2. Any documentation detailing patch cycles and management plans would be useful.

  3. Depending on the maturity of your organisation and predecessors (they are being replaced after all ;)), the concept of 'risks' may not be common. Instead it may be worthwhile asking your predecessor for any known problems, with or without an existing remediation plan.

  4. Handover of any auditing requirements, their renewal timeframes, and compliance objectives. Included would be any past audits and their findings.

  5. Credentials for relevant management tools, such as network/firewall monitoring and auditing.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.