I am working on an auditing process for my company's email system (Exchange 2010). From this process, we're hoping to expand it out to other systems and start to clean up the rampant security issues we have (my place of employment neglected security for years and it's catching up to them). Some of the issues we're experiencing are lack of baseline, privilege creep, poor/non-existent configuration, unnecessary ports, protocols, services, lack of timely patching... It goes on.
Anyhow, we are mostly concerned with the technical aspects. Below is what I've covered already:
- Reviewed installed software for necessity, contract support if necessary, EOL/outdated/unpatched software.
- CIS, DISA, and Microsoft SCM baseline audits for OS and other installed software (part of our work here is to establish a hierarchy of what industry best practices we'll use)
- Reviewed PPS for each machine to determine if PPS "makes sense" (one machine just happens to have firewall rules for all the Quake Arena ports).
- I'm in the process of determining the breadth of users (internal, external, 3rd party vendor, contractors, etc).
- Related policies like email retention/backup/storage and account management (SPOILERS: Slim to none).
I am reviewing NIST 800-53 and 800-137, Assess and Monitor documents, and just recently found NIST 800-45 that looks promising.
The ultimate goal is to assign a risk value to the system and the vulnerabilities, then use the process to branch out to other systems. Do you see any major holes in my approach?