Scribd
Upload
74 views2 pages

Cyber Security Audit Best Practices

The advisory provides recommendations for organizations to improve cyber security audits and reduce vulnerabilities. It recommends conducting comprehensive audits of the entire cyber infrastructure regularly. It also recommends prioritizing preventive actions like maintaining an asset inventory, implementing secure configurations, the principle of least privilege, and adopting secure software development practices. The goal is to help organizations identify and remediate the most frequent vulnerabilities uncovered in audits to better secure their cyber infrastructure.

Uploaded by

zxcvbnm1230
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
74 views2 pages

Cyber Security Audit Best Practices

The advisory provides recommendations for organizations to improve cyber security audits and reduce vulnerabilities. It recommends conducting comprehensive audits of the entire cyber infrastructure regularly. It also recommends prioritizing preventive actions like maintaining an asset inventory, implementing secure configurations, the principle of least privilege, and adopting secure software development practices. The goal is to help organizations identify and remediate the most frequent vulnerabilities uncovered in audits to better secure their cyber infrastructure.

Uploaded by

zxcvbnm1230
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

6/10/22, 4:48 PM CERT-In Advisory Notes

CERT-In Advisory CIAD-2021-0045


Improving Outcome of Cyber Security Audits and Reducing Threat Exposure to Cyber Infrastructure - Advisory for Auditee Organizations

Original Issue Date: December 08, 2021



Description

The objective of this advisory is to sensitize and recommend best practices to organisations in order to improve outcome of cyber security audits; and
reduce the vulnerabilities in the cyber infrastructure. Key findings and recommendations in this advisory are mined from the field data analysis of
audits conducted across the country.

1. Recommendations to Ensure Effective Implementation of Cyber Security Audit Program


i. Scope of the audit: It is observed that in most of the cases only websites or web applications are being audited. The comprehensive
audits of entire cyber infrastructure including system, applications, software, network infrastructure, SCADA/ICS environment, cloud
architecture should also be included in the scope of audit.

ii. Audit Intent - Audit for securing the cyber infrastructure of the organization: The scope of security audit should be clearly defined
along with clear communication plan with auditing team. Audit should not be performed just for the sake of compliance, but to secure the
cyber infrastructure so as to protect the interest & goals of the organization.

iii.  Timely actions to patch the vulnerabilities: Vulnerabilities highlighted in audit reports should be patched by owners/developer
immediately. Workaround needs to be identify where patching is not possible. After remediation actions, follow-up audits should be
performed by auditor to verify closer of vulnerabilities & nonconformities highlighted in the previous audit.

iv. Audit Methodology: Standards/references for audit should not be limited to OWASP top 10, SANS Top 25 and other such limited
lists. Audit Should include discovery of all known vulnerabilities based on the comprehensive standards/frameworks like ISO/IEC, Cyber
Security Audit Baseline Requirements, Open Source Security Testing Methodology Manual (OSSTMM3), OWASP Web Security Testing
Guide along with applicable regulatory framework and directions & guidelines issued by agencies such as CERT-In.

v. Audit program oversight by top management: Top management should review & approve the audit program and remedial measures
taken by organization to plug the vulnerabilities highlighted in the audits in a time bound manner.

vi. Change Management: Audit should be performed after every change in infrastructure and application. Change Management policy
should be enforced in organization to avoid unnecessary changes in cyber infrastructure and applications.

vii. Periodic Audits: Audits should be performed even if there is no change in infrastructure at periodic interval of time to remediate and
eliminate the risk from new vulnerabilities. Periodicity of audits should be decided based on the criticality of cyber assets.

2. Prioritize preventive actions to avoid most frequent vulnerabilities and to reduce Threat Exposure to Cyber Infrastructure as observed
in the audit data analysis:

i. Asset Inventory and Patch Management: Organisations should maintain and monitor the inventory of all the authorized assets (both
software and hardware). For all the assets, proper patch management mechanism should be in-place to patch the vulnerable software,
applications and firmware used by the organisation.

ii. Secure Configuration: Organizations should have secure configuration of assets. Appropriate security configuration such as blocking
of unused ports, securing and changing default settings and credentials, removing unused pages should be done during deployment of
equipment and applications.

iii. Principle of Least Privilege: Organizations need to implement the principle of least privilege across the organization's assets.

iv.  Limit and Secure Remote Access: Ensure restricted remote access to the cyber infrastructure. Remote access traffic should be
tunneled, encrypted and logged to avoid any misuse. Multi Factor Authentication (MFA) is recommended for remote access of the cyber
infrastructure.

v.  Secure Software Development Life Cycle (SSDLC): It is observed that one of the main reason for vulnerabilities in cyber
infrastructure of organizations is insecure application development. It is recommended to consider security in all phase of the application
development by adopting SSDLC and DevSecOps.

vi.  Authentic Software and Secure Protocols: Organizations should only use genuine software in their infrastructure and ensure to

1/2
6/10/22, 4:48 PM CERT-In Advisory Notes
update software, application and firmware on regular basis to avoid software vulnerabilities. Organisations should also Ensure to use
secure protocols over weak vulnerable protocols to avoid vulnerabilities associated with weak protocols.

References

CERT-In Guidelines for Auditee/Customer Organisation


CERT-In Cyber Security Audit Baseline Requirements
CERT-In Advisory CIAD-2021-0004 - Preventing Data Breaches / Data leaks

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@[Link]
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)


Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
 

2/2

Common questions

Powered by AI

Patch management involves regularly updating and patching vulnerable software, applications, and firmware, thereby reducing the risk of exploitation by threats . Maintaining an accurate inventory and ensuring timely patching are crucial to closing security gaps identified in cyber security audits and preventing potential breaches . It ensures that known vulnerabilities are addressed swiftly, minimizing the organization's threat exposure .

Applying SSDLC ensures that security is integrated at every stage of the application development process, reducing vulnerabilities in the cyber infrastructure . It involves adopting security best practices from the initial stages of software design to deployment and maintenance, thus minimizing risks associated with insecure application development . This proactive approach helps organizations reduce potential security breaches and ensures a robust defense against cyber threats .

Organizations should ensure the scope of the audit includes a comprehensive review of the entire cyber infrastructure, not just web applications or websites . The security audit should aim to secure the cyber infrastructure, with clear communication and a well-defined scope . Vulnerabilities highlighted in audit reports must be patched immediately, with follow-up audits to verify closure . The audit methodology should incorporate comprehensive standards and frameworks beyond limited lists like OWASP Top 10 . Top management should oversee and approve the audit program and subsequent remedial measures . Audits should be conducted periodically, and after any infrastructure changes, to manage risk from new vulnerabilities .

Secure configurations involve steps such as blocking of unused ports, securing default settings and credentials, and removing unused pages, which reduce the attack surface available to potential threats . These measures prevent unauthorized access and mitigate risks associated with default configurations that are easily exploitable . By securing these aspects during deployment, organizations can maintain higher security levels and prevent common vulnerabilities associated with misconfigurations .

The oversight by top management ensures that the audit program's goals align with the organizational interests and that vulnerabilities are addressed timely . It provides accountability leading to higher commitment in implementing the audit results and necessary remedial actions . Management's involvement also ensures resources are allocated appropriately and helps in establishing a culture of continuous improvement in security practices .

Organizations need to maintain a monitored inventory of authorized software and hardware assets with an effective patch management mechanism in place . Secure configurations should involve blocking unused ports, changing default settings, and securing credentials . They must implement the principle of least privilege and ensure remote access is limited, encrypted, and logged . Utilizing Multi Factor Authentication (MFA) for remote access is advised . Additionally, adopting Secure Software Development Life Cycle (SSDLC) and DevSecOps, using authentic software, and secure protocols can mitigate vulnerabilities from insecure application development .

Secure protocols are vital for protecting data in transit from interception by unauthorized entities, which is a risk with weak protocols . They ensure data integrity and confidentiality, which are critical for maintaining trust and security in network communications . By replacing weak protocols with secure ones, organizations can prevent vulnerabilities and reduce the risk of data breaches significantly .

Cyber security audits should utilize comprehensive standards and frameworks such as ISO/IEC, Cyber Security Audit Baseline Requirements, and the Open Source Security Testing Methodology Manual (OSSTMM3). These provide a more thorough assessment compared to limited lists like OWASP Top 10, guiding auditors to discover a wider range of vulnerabilities and security nonconformities . Utilizing such standards ensures a rigorous audit process and highlights areas needing improvement .

Limiting and securing remote access is critical to preventing unauthorized access to cyber infrastructure, which can lead to breaches . Effective implementation requires restricting access to only those who need it, tunneling and encrypting remote traffic, and maintaining comprehensive logs of access attempts . Applying Multi Factor Authentication (MFA) further strengthens security by ensuring that even if credentials are compromised, unauthorized access is still prevented . These measures collectively help in guarding against external threats .

A robust change management policy mandates audits following changes in infrastructure and applications, ensuring these changes do not introduce new vulnerabilities . It helps prevent unauthorized or unnecessary changes that could weaken the cyber defense posture of the organization . By enforcing such policies, organizations can maintain control over their digital environment and ensure ongoing compliance with security standards .

You might also like