I work in the petroleum industry and I am 'the young geek'. As such, I am often tasked with writing VBA macros, a bit of JS for data visualization and so on.
Lately, I have been assigned the task of 'conducting systems audits'.
A few words of context:
- The firm's information system (ie. 'office network') is under the responsibility of the IT division, which I am not a part of.
- However, the 'industrial' systems (ie. Control Systems, Manufacturing Execution Systems, etc.) are under the responsibility of the industrial teams. A firewall separates these two worlds, managed by corporate IT. It is considered that this firewall isolates the industrial network from the office network, and a fortiori, from the Internet. Those industrial networks are the scope of the audit.
- I am not by far a security expert. But it is clear for everyone (in particular my managers) that the 'security audits' are just a way to use buzzwords in newsletters, and that any serious audits would be handled by professionals.
This being said, I would like to use this as an opportunity to learn, and to have the plant's technicians learn as well.
What are the basic points I should check in a 'systems audit', that would be a good pretext to discuss about the basics of Information Security, and would allow me to catch the most obvious weaknesses?
I have on my list so far:
- Checking if inputs (USB ports, floppy drives [old plants...], etc.) are disabled
- Look out for admin passwords on a post-it on the screen
- Check out is OSs used are still supported (I expect to see some pre-Windows XP systems), and if they are up-to-date.