Security audits could be technical such as penetration testing, configuration review and network architecture review. or non technical such as Organisational audits (based on iso 2700X, physical security, etc.

In what order should those audits be done, and how prioritizing one over an other can impact exhaustivity and accuracy of results ?

To be more specific, if an organization performs a technical assessment first and correct the vulnerabilities detected , then performs an organizational audit, which detects organizational vulnerabilities related to technical ones which will be corrected too. Will this be the same as beginning with the organizational audit followed by the technical one ?

closed as too broad by Iszi, Neil Smithline, schroeder Nov 3 '15 at 23:43

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is not something that has an easy 1, 2, 3 answer. It will depend on the threats that you are worried about and how confident you are in the current state of security for the different aspects of your system. – Neil Smithline Nov 3 '15 at 21:23
  • 2
    It also depends on your goal. Auditing does not "Secure your organization" - it evaluates the controls in place. Those controls may/may not secure the organization. – schroeder Nov 3 '15 at 23:42

A lot of this answer really depends on what type(s) of systems and data you are protecting and also what you are trying to achieve via your assessment. You would also want to consider the history of the organization being assessed too. For example if the assets are more likely to be stolen or damaged physically then you'd definitely want to prioritize a physical security review first.

That said from the standpoint of protecting information assets which most likely are connected to the Internet I would recommend taking at two pronged approach of recommending an external penetration test to provide the client with quick feedback about potentially critical issues that are Internet-facing and combining that with a general purpose security assessment which would really get a lot deeper into how the organization works and doesn't work security-wise. It's important to note that there are lots of different types of penetration tests too.

As far as prioritization I usually find that this is more an issue of time/money budgeting and that the client is always trying to balance what achieves the "most bang for the buck". I'm assuming that since you asked this question unlimited funds and/or unlimited time is clearly not an option.

My suggestion would be to determine what goals an organization would like to achieve via this assessment/audit first. Once you have a clear set of goals it would be much easier to recommend/prioritize the best assessment approach.

I'll go out on a limb and say that if you are starting a security program at a company that's never done any of this the results are likely to be bad in each particular area. If that's the case you don't want to spend a huge amount of your assessment budget in any single area (like a deep penetration test of a single application or just a physical security assessment) because if it's obviously going to be bad a lot of that effort will be wasted. In this particular case I would suggest a general purpose security assessment with a goal of analyzing the security of the organization as a whole and explicitly having an end-goal of the project being that the assessor creates a "road-map" of next-steps for every area that needs additional security (this can also be done within the context of PCI-DSS, NIST sp800-53, or ISO-27000) but the most important thing being that the report is not limited to those standards.

In this particular situation I think choosing the individual/company to do this is equally critical to the success of the assessment. If you can find someone who genuinely wants to help you secure your organization, is extremely talented in security, and can clearly communicate what needs to be done to executives in a manner they will be receptive to you will have a very valuable and eye-opening experience which can have a huge impact on the long-term health of your organization. Likewise if you are doing this internally for your organization definitely do think about how you can best utilize this opportunity to help your organization long-term.

Back to your question, for most companies the choice of different types of assessments are more frequently driven by regulatory requirements, customer/vendor agreements, or internal policy. For those organizations not driven by one of these variables the scope is generally driven by what provides the most "bang for the buck" and ultimately that usually is something is more a hybrid of methodologies rather than a specific ordering of 1, then 2, then 3. Finally in regard to impacting the accuracy of the results I believe there should be no conflict in that area so much as varying levels of technical depth. The conflict is generally one of budgeting (time and/or money) so making trade-offs to get all areas covered at the maximum level of depth for a given budget and time-line is more how things tend to work out.

As a related piece of advice: Do dig very deeply into learning all of the auditing, security, and penetration testing standards but do NOT be attached to them either. They all have their own weaknesses and problems. Until you have a deep understanding of each of their strengths and weaknesses you won't really be able to conduct or correctly request high-quality assessments. Mind you I don't think this stuff is technically hard to learn but it may take more time than you have before you get started. If you, or whoever else reads this, happens to be in this situation and in a rush (I'm making assumptions here) it may be wise to hire someone who doesn't have any conflicting interests to simply spend an hour or two to help you figure out the best way to move forward in your particular situation before you get started.

In any case, this may not be as simple of an answer as you may have been hoping for but hopefully you find it useful.

  • Thank you I really appreciate your detailed answer, it is very useful – aboujanane Nov 4 '15 at 6:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.