Determining What to Audit and Analyzing Audit Records
In this practice, you will create a list of audit requirements for a fictitious company, and then analyze common MCSE 2003 exams records found in the security log. Complete the exercises that follow. If you are unable to answer a question, review the lesson materials and try the question again. You can find answers to the questions in the “Questions and Answers” section at the end of the chapter.
Exercise 1: Determining What to Audit
Read the following scenario and then answer the question that follows.
Scenario You are an IT auditor at Wingtip Toys. You are asked to specify the audit requirements for a file server in the research department. The file server will store confidential research information. Files are protected by EPS encryption. Communications between researchers’ workstations and the file server are protected by IPSec. Only the researchers and their workstations are allowed to access the file server.
Figure 9-23 shows the configuration for auditing for use of the Take MCSE study guides free download Ownership permission. To ensure that the administrator is caught, you should also audit for privilege use. Two possible events can be recorded. If the administrator attempts access while logged on interactively to the server on which the file resides, the Se_TakeownershipPrivilege, event 578, is recorded. This is a privilege usage event. However, if she takes ownership remotely, the file Take Ownership permission (WRITE_OWNER) is used. This is object access event 560. With all this noted, remember that administrators can also delete audit logs, either in their entirety or by individual events. If you have untrustworthy administrators, the only solution is to not allow them to be administrators.
Also To prevent an administrator from reading a file, you can encrypt the file. However, if you do so, make sure the administrator is not the file recovery agent.
Processing your request, Please wait....
