The Security Audit
Security vs Performance

Effective network administration involves more than just penetration testing. The best practice involves knowing the needs or your organization and how it relies on availability of its information. It wouldn’t be practical to impose such strict restriction on accessing systems or applications that your users just end up working against you. They will eventually circumvent any security controls you’ve put place only to make they’re job easier. Attempting to weaken controls to provide users with an easy to use environment may compromise the security of the network. Where should the line be drawn? This is where the auditing technique used comes to play. Using a risk-based assessment can provide a clear representation of where to find the middle ground.

One possible method of auditing your network is to develop a scheme that decides what your organization considers critical information. Decide which systems are critical systems. Use Risk Assessment to help determine where attention should be focused when deciding the value of that data. The overall process is extremely long and impossible to cover in this short space. For more information about designing an auditing policy for your network, review the procedure guidelines designed by the ISACA. Even if your not in charge of information security at your organization, the topics covered there are worth the read.