Master Checklists
Master Checklists
Application Best Practices
Checklist for Best Practices
-
q Apply defense-
in-depth . -
q Use a positive security model.
-
q Fail safely.
-
q Run with least privilege.
-
q Avoid security by obscurity.
-
q Keep security simple.
-
q Detect intrusions and keep logs.
-
q Never trust infrastructure and services.
-
q Establish secure defaults.
-
q Use
open standards.
Auditing Applications
Checklist for Auditing Applications
-
q Review and evaluate data input controls.
-
q Determine the need for error/exception
reports related to data integrity, and evaluate whether this need has been fulfilled. -
q Review and evaluate the controls in place over data feeds to and from interfacing systems.
-
q In cases where the same data are kept in multiple databases and/or systems, periodic ‘sync’ processes should be executed to detect any inconsistencies in the data.
-
q Review and evaluate the audit trails present in the system and the controls over those audit trails.
-
q The system should provide a means to trace a transaction or piece of data from the beginning to the end of the process enabled by the system.
-
{% if main.adsdop %}{% include 'adsenceinline.tpl' %}{% endif %}
q The application should provide a mechanism that authenticates users based, at a minimum, on a unique identifier for each
user and a confidential password. -
q Review and evaluate the application's authorization mechanism to ensure that users are not allowed to access any sensitive transactions or data without first being authorized by the system's security mechanism.
-
q Ensure that the system's security/authorization mechanism has an administrator function with appropriate controls and functionality.
-
q Determine whether the security mechanism enables any
applicable approval processes. -
q Ensure that a mechanism or process has been put in place that suspends user access on termination from the company or on a change of jobs within the company.
-
q Verify that the application has appropriate password controls.
-
q Review and evaluate processes for granting access to users. Ensure that access is granted only when there is a
legitimate business need. -
q Ensure that users are automatically logged off from the application after a certain period of inactivity.
-
q Evaluate the use of encryption techniques to protect application data.
-
q Evaluate application developer access to alter production data.
-
q Ensure that the application software cannot be changed without going through a standard checkout/staging/testing/approval process after it is placed into production.
-
q Evaluate controls around code checkout, modification, and versioning.
-
q Evaluate controls around the testing of application code before it is placed into a production environment.
-
q Ensure that appropriate backup controls are in place.
-
q Ensure that appropriate recovery controls are in place.
-
q Evaluate controls around the application's data retention.
-
q Evaluate controls around data classification within the application.
Chapter 11: Auditing WLAN and Mobile Devices
WLAN and Mobile Devices Background
Mention wireless inside a corporate environment and people immediately think of either their
Conceptually, WLAN and mobile devices both communicate using electromagnetic radio waves from the device to a remote base station. Laptops
WLAN Background
WLAN enables you to roam past your cube into the conference room and still get your e-mail. However, WLAN traditionally
In 1990, the
Institute of Electrical and Electronic Engineers
(IEEE)
You might hear Wi-Fi used in the place of WLAN. Wi-Fi is a brand originally licensed by the Wi-Fi Alliance to describe the underlying technology based on IEEE 802.11 specifications. The
|
Protocol |
Release Date |
Frequency |
Bandwidth |
|---|---|---|---|
|
IEEE 802.11 |
1997 |
2.4 GHz |
2 Mbps |
|
IEEE 802.11a |
1999 |
5 GHz |
6, 9, 12, 18, 24, 36, 48, 54 Mbps |
|
IEEE 802.11b |
1999 |
2.4 GHz |
5.5, 11 Mbps |
|
IEEE 802.11g |
2003 |
2.4 GHz |
6, 9, 12, 18, 24, 36, 48, 54 Mbps |
| Note |
Note that technically every component in a wireless network is called a
station.
There are two types, access points and wireless
|
Wireless clients are also called
supplicants.
The access points connect the wireless network to the wired network, and the wireless clients or supplicants connect the wireless network to the mobile device. Mobile devices could be a laptop, a wireless enabled
personal digital assistant
(PDA), or other device configured to communicate with the access point. The set of
There are two types of BSSs, independent and infrastructure. Independent BSSs are ad hoc networks working without an access point. Infrastructure BSSs have access points that can communicate with each other, allowing stations in one BSS to communicate with other stations in a different BSS. An
extended service set
(ESS) is a set of connected BSSs. Each ESS has an ID called the
SSID
consisting up to 32
Figure 11-1:
Example WLAN architecture.
If you're new to WLANs, then this probably sounds like a lot, and you may think that it's overly difficult to audit. We are going to stick to the basics during the audit process and suggest that you do the same. It's easy to let the scope of a WLAN audit get out of hand, but you can audit for most of the risk by
Data-Enabled Mobile Devices Background
Blackberry devices were by far the most widely used mobile devices in the corporate world at the
In essence, these smartphones with PDA-like features enable the workforce to take data outside the walls of their companies. This is done with the help of providers such as Blackberry and Good Technologies, which interface your users with your network and the rest of the world through the mobile operator's wireless framework. A typical communications
Figure 11-2:
Service provider illustration.
The