Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

Security audit

A measurable review of how your systems, configurations and processes actually hold up.

  • Configuration review
  • Architecture review
  • Access control review
  • Policy and process review
  • Physical security

What it is

A security audit is a systematic, measurable assessment of a system or application. Manual work includes interviewing staff, running vulnerability scans, reviewing application and operating system access controls, and checking physical access to systems.

Computer-assisted audit techniques add system-generated reports and tools that monitor changes to files and settings. Audits cover servers, endpoints, network devices such as routers and switches, and the policies that govern them.

Our approach

  1. 01

    Plan

    Agree scope, criteria and the evidence to be reviewed.

  2. 02

    Interview

    Talk to the people who run systems and processes.

  3. 03

    Review

    Check configurations, access rights, logs and documentation.

  4. 04

    Test

    Sample controls to see whether they operate as described.

  5. 05

    Report

    Findings against criteria, with prioritised recommendations.

What you receive

  • Audit report against agreed criteria
  • Configuration and hardening gaps
  • Access control findings
  • Policy-versus-practice observations
  • Prioritised recommendations

Standards referenced

ISO/IEC 27001:2022CIS BenchmarksPCI DSS v4.0.1CERT-In guidelines

security-audit-report.pdf

Redacted example
  1. 01Audit scope and criteria
  2. 02Summary of observations
  3. 03Configuration findings
  4. 04Access control findings
  5. 05Policy and process gaps
  6. 06Recommendations
FINDING 04HIGH
Asset
.
Issue
Default credentials on admin console
Evidence
CVSS
8.8
Fix
Change and vault the password; restrict console to the admin network
Status
Re-tested: closed
Illustrative example of a report outline and a finding. Not from a real client.

Talk to us about security audit.

Send an enquiry