Do you know about OCTAVE ?

Information system is a valuable thing for most organizations today. However, many organizations that perform security strategy by focusing on infrastructure weaknesses, they fail to establish due to the assets of the most important information belongs to them. This has created a gap between the operational requirements of organizations with information technology so putting assets at risk. Many security risk management approach to incomplete information, thus failing to include all components of risk (assets, threats, and vulnerability) Many organizations and hired consultants to evaluate the information security risks in the organization. The result may not match the perspective of the organization. Risk assessment conducted by the organization bersengkutan provide knowledge to understand the risks and make the right decision.
The first step to manage information security risks is to identify whether the risk organizations that implement it. After risks are identified, organizations can create a plan of prevention and reduction of risk of each of the known risks. Method Octave (The Operationally Critical Threat, Asset, and Vulnerability Evaluation) allows organizations to do the above. Octave is an approach to information security risk evaluation of a comprehensive, systematic, directed, and conducted himself. The approach is organized in a set of criteria that defines the essential elements of information security risk evaluation.

created by Sigit

Data Protection

Data Protection is MORE than Crypto
Cryptographic technology* can:

Protect your data from prying eyes
- Encryption for confidentiality

Prove the source of information
- Digital signatures for authenticity

Detect unauthorized changes
- Digital signatures for integrity

But it’s not the only way…
*Properly managed, of course!

created by Sigit

Is it difficult to audit Linux Operating System ? Check this out ....

1. We must log in to the system using account root, then :
a. Check Operating System Name, Host and Time System
b. Check Finger Users :
- root
- system
- ftp
- send mail
- bin
- apache
- guest
- O
c. Check this files :
- cat /etc/inittab
- cat /etc/passwd
- cat /etc/shadow or cat /etc/security/passwd
- cat /etc/group
- cat /etc/crontab
- cat /etc/rc.local
- cat /etc/motd
- cat /etc/inetd.conf
- cat /etc/rc.nfs
- cat /etc/rc.tcpip
d. Check Network Configuration
- ifconfig –a
- netstat –an
- netstat –rn

2. Do trial for Security System :
a. Do check to see if system run in safe condition. Whether password / etc /
passwd in enkrip in file. / etc / security / passwd
b. Check to assure that all users have the password
c. If the auditing program is run (enable). Check file /etc/security/audit
/events
d. Do check the permissions of the files below are already set in true :
- -rw-rw-r-- root system /etc/filesystems
- -rw-rw-r-- root system /etc/hosts
- -rw------- root system /etc/inittab
- rw-r--r-- root system /etc/vfs
- -rw-r--r-- root system /etc/security/failedlogin
- -rw-rw---- root audit /etc/security/audit/hosts

3. Perform security testing account :
a. Check configuration password: file /etc/security/login.cfg,use this parameter:
- pass_max_days
- pass_min_days
- pass_min_length
b. Identification of all accounts do have rights as a System Administrator
grep :0: /etc/passwd
c. Attention to the list of user accounts and verify whether a user is not active
still present in existing systems by comparing the user with the passwd file

created by Sigit

How To Audit Data Center ?

1. Identify whether there is implementation of the IT Data Center manajamen not in accordance with policies and procedures

2. Identify whether there are devices and applications that are not listed in the IT Data Center

3. Identify whether there are personnel who are not entitled to be in the IT Data Center

4. Identify whether there are activities that are not in accordance with the schedule activities in the IT Data Center

5. Identify whether there is activity in the Data Center is scheduled but not performed

6. Identify whether there are indications of inadequate capacity of IT resources in the Data Center

7. Identify whether there is physical control did not function as it should be

8. Identify whether there is a function of environmental control not working as it should

create by Sigit

How Audit Organization Information Technology ?

1. Understand the organizational structure, main tasks and functions of the IT Work Force.

2. Understand the authority and responsibility of the Board of Commissioners, Board of Directors, Steering Committee of IT, IT Work Unit, the Risk Management Unit of Work, Work Force IT users, particularly those related to the implementation of the IT function and IT risk management.

3. Understand the work-flow between the various units of work involved in IT risk management

4. Understand the policies and procedures for IT human resources management which includes: recruitment, development, rotation and termination, performance appraisal standards, remuneration.

5. Understand the policies and procedures binding working relationship with consultants, honorary staff, and employees of IT service providers

create by Sigit