Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.)

Which are appropiate tests to perform during an internal security audit?

For example:

  • Check shared resources
  • Check existing users in the authentication server (DC, LDAP, local...)
  • Check installed software against security policy
  • Check installed software if there are vulnerable software that should be updated
  • Check compliance with antivirus policy
  • Check for sensible data at rest
  • Check for OS and other software security updates

Which others tests do you suggest?

I know some tools that can help in this task:

  • Nessus
  • OpenVAS
  • Microsoft Baseline Security Analyzer

Which other tools do you suggest?

share|improve this question
This question is too broad. The tests that are appropriate to perform depend on the business you are trying to protect. What are your security goals? – GdD Feb 26 at 17:03
@GdD I think also that risk assessment is very important in order to manage security but in this case suppose that you have the global objective of protecting the confidentiality, integrity and availability of machines and data in the local network – kinunt Feb 26 at 17:06
@kinut, that's a very general statement. Every security group is charged with protecting CIA of information. What are your main security concerns? Unauthorized cloud services use? Data breaches due to spear phishing? What information or services is most valuable, and how could it be attacked. Answering those questions would make your post unnecessary. – GdD Feb 26 at 17:11
@GdD There exist standard methodologies or checklists for external pentests like Penetration Testing Framework, The Penetration Testing Execution Standard, OWASP Testing Guide (for web applications), etc. I just would like to know a similar methodology/checklist/guide for internal security audits. I recognize the need for a risk assessment (like you suggest) but for this case I don't think it is mandatory. – kinunt Feb 26 at 17:40
Is this really something you want to cover by asking on a website? Hire a some professionals that can assist you on this :) – Lucas Kauffman Feb 26 at 19:54
show 3 more comments

closed as not a real question by GdD, Rory Alsop♦ Feb 26 at 22:23

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.