Auditing IT Infrastructures for Compliance, 3rd Edition

Performing a Security Assessment for the Entire IT Infrastructure and Individual Domains

Various tools are used to perform a security assessment. The assessment may target the entire IT infrastructure, a single domain of the IT infrastructure, or anything in between. All assessments should follow a plan and be performed with a disciplined approach. There are different approaches to identify security weaknesses within an organization. Some of the approaches include the following:

• Network scan—This provides an automated method for discovering host systems on a network. Although a network scan doesn’t necessarily discover all vulnerabilities, it does determine which systems are active on the network and what services they offer or what ports ...