6.1 : Auditing Operating Systems

Question 1

Auditing operating systems requires attention to:

Answer 1

• Standards
• Maintenance and support
• Change management
• Configuration management
• Security Management

Question 2

Auditor examining standards

Answer 2

Examine written standards to see if they are complete and up-to-date. Examine a sampling of servers and workstations to see whether they comply with the written standards.

Question 3

Maintenance and support Examination

Answer 3

Auditor should examine business record to see whether the operating system running on servers or workstations are covered by maintenance or support contracts.

Question 4

Examination of change management

Answer 4

Examine OS change management processes and records to see whether changes are being performed in a systematic manner.
All changes made should be requested and reviewed in advance, approved by management, and recorded.

Question 5

Examine configuration management

Answer 5

Examine configuration management processes, tools, and recordkeeping

Question 6

Examine security management

Answer 6

The auditor should examine security configuration on a sample of servers, and workstations, and determine whether they are hardened or resemble manufacturer default configuration. Examine also patch management and administrative access.