Evaluating Protection Mechanisms
The first step is looking at the gateways as the potential
points through which entry can be gained by the unauthorized or
malicious code. The controls are implemented through a welldesigned
and secure network architecture, choice of protocols
and encryption mechanisms, choice and configuration of
network devices such as routers, and additional defenses
including firewalls, antivirus and intrusion detection systems.
Evaluating every one of these requires specialist knowledge,
and the auditor would do well to ensure that the audit team
evaluating network security consists of experts who have
specific knowledge of the protocols, the network devices and
the software deployed at the network. The focus of this article
has been to sketch a basic approach to network security audit,
and not to provide specific audit and technical guidelines