Skip to content

Introduction to Auditing and Monitoring

Auditing

Auditing is an official inspection and verification of an organisation’s financial records, procedures, and statements to ensure accuracy, reliability, and compliance with applicable laws, regulations, and accounting standards.

Objectives

  • Assess the effectiveness of internal controls
  • Identify and assess risks
  • Assess the efficiency and effectiveness of information systems.
  • Ensure compliance with laws and regulations.

Audit types

  • Internal
  • External
  • Third-Party

Audit Frameworks

Audit frameworks help auditors assess an organisation’s policies, processes, controls, and compliance with regulations while providing efficiency, value, and transparency to the audit process.

  • COSO: is a private-sector initiative that develops frameworks for enterprise risk management, internal control, and fraud deterrence.
  • COBIT: is a framework for the governance and management of information and technology (IT).
  • ISAE 3402: is an international standard that provides guidance on the assurance of controls over financial reporting.
  • ISO 27001; is an international standard for information security management. It provides a set of best practices for information security management. It is typically used in various industries, including financial services, healthcare, and government.
  • ITIL: is a framework of best practices for IT Service Management (ITSM).
  • PCI DSS: is a set of security requirements for organisations that accept payment cards. It is designed to protect cardholder data from unauthorised access, use, disclosure, alteration, or destruction.
  • SOX: is a federal law that establishes auditing and financial reporting requirements for public companies.

Audit Areas

  • Information Systems Hardware
  • OS
  • File Systems
  • Database Management Systems
  • Network Infrastructure
  • Network Operating Controls
  • IT Operations
  • Lights-Out Operations
  • Problem Management Operations
  • Monitoring Operations
  • Procurement
  • Business Continuity Planning
  • Disaster Recovery Planning

Logs purposes

  • Troubleshooting
  • Monitoring
  • Auditing
  • Compliance

System loggind Daemons

  • rsyslog
  • syslog-ng
  • journald

Log Types Linux

  • system logs: contain information about the general health and operation of the system.
  • Application logs: contain information about the specific applications running on the system.
  • Security logs: contain information about security-related events, such as login and failed authentication attempts.
aureport --summary
#only failed logs
aureport --failed
#sucessful logins
ausearch --message USER_LOGIN --success yes --interpret
#failed logins
ausearch --message USER_LOGIN --success no --interpret

Linux logs and Windows logs

Feature Linux Logs Windows Logs
Location /var/log %SystemRoot%\System32\Logfiles
Format Syslog EventLog
Logging levels Debug, Info, Notice, Warning, Error, Critical Debug, Information, Warning, Error, Critical
Tools for viewing logs tail, grep, less Event Viewer

Monitoring

Involves continuously observing and checking an IT system’s performance and metrics.