Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ?
Let's say you're a software developer. And you need to create a web app for managing information in a database. The process you'll follow to deliver the sofware here will go like this
- database modeling (with tools such as ER diagram)
- software architecture modeling (with UML )
- Database implementation with a DBMS (ex : MySQL) and SQL
- Software programming with design pattern like MVC and programming language like Java
An IT security framework is a series of documented processes used to define policies and procedures around the implementation and ongoing management of information security controls in an enterprise environment.
Such frameworks are COBIT, ISO 27001, NIST SP 800 53, CIS controls, HITRUST CSF, etc.... Those are more like guide like for managers to help them make sure their system is compliant with a standard
My question is : for an IT security analyst/auditor, are there standards that combine the two situations above i.e. a process of conducting technical analysis/audits of a system maintaining a standard ?
I'm asking that because when reading materials like CEH or Cyber Kill Chain, they do not look "professional". It's just a bunch of black hat techniques (not really methodologies) that are combined and offered to so called white hats.
But on a day-to-day basis, how would a technical team of analysts/auditors would organised itself to be professional (possibly by following a framework) without spending their time doing reconnaissance, scanning, exploitation etc... non sense acting like black hackers instead of being productive security professional