<div dir="ltr">The first thing to ask them would be what their concerns are. <div>If the clients and server are only being used by customers for casual internet access then there would be little risk to the business.</div><div><br></div><div>The first things to ask are :-</div><div>Is there an adequate firewall in place ? - I have been using ClearOS since it was born (formerly clarkconnect) which provides a cheap solution for keeping intruders out and logging activity.</div><div><br></div><div>Is there separate data on a server ? and what kind of data is this ? Security is a big issue, and it has lots of answers depending on the organisation.</div><div><br></div><div>You should start by asking the questions such as</div><div><br></div><div>What do they want from a "Security Audit" ?</div><div><br></div><div>What data is held, and who has access to it ?</div><div>What measures are in place to protect its privacy, and what backups exist ? Can backup data be accessed outside the system ?</div><div>Does the organisation need a GDPR statement ? Is there and need to register as a data controller ?</div><div><br></div><div>Office systems and administration systems should sit behind a secondary firewall if public internet access is provided, again I would use a ClearOS gateway.</div><div><br></div><div>I suspect that they just need to make sure that they comply with GDPR, and to know that their business systems are protected from public access.</div><div><br></div><div>I still have some older systems from Lawyers which can be used for gateways if you need any.</div><div><br></div><div>Good Luck.</div><div>Mark</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 20 Feb 2019 at 13:35, Edinburgh Linux Users Group <<a href="mailto:edlug@lists.edlug.org.uk">edlug@lists.edlug.org.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p>Another reply to the OP in response to a reply from this list.<br>
</p>
<div class="gmail-m_3033861278480989599moz-cite-prefix">On 20/02/2019 10:13, dockrin wrote:<br>
</div>
<blockquote type="cite">
<cite>AndrewR wrote on Tue, 19 February 2019 13:55</cite>
<blockquote>
<pre style="white-space:pre-wrap;font-family:Verdana,Geneva,Lucida,"Lucida Grande",Arial,Helvetica,sans-serif">Another reply
-------- Forwarded Message --------
Subject: Re: [EdLUG] Fwd: [Baen Baen's Bar] Cybersecurity
Date: Tue, 19 Feb 2019 19:51:41 +0000
From: Edinburgh Linux Users Group <u></u>
Reply-To: <a href="mailto:edlug@lists.edlug.org.uk" target="_blank">edlug@lists.edlug.org.uk</a>
To: Edinburgh Linux Users Group <u></u>
Hi Andrew
(Obligatory disclaimer: I am neither a lawyer, nor a security
professional. The following stems from my experience in general and
cannot constitute advice.)
On the face of it, yes, if it is an independent professional auditor,
they will need full access to the system, or for him to provide proof
that everything he is doing meets their requirements. Generally, only
full access can provide such proof.
Log files only provide minimal insight into what a system has done in
the past ; it does not show how the system is configured, and what
practices are in place, and whilst your friend's contact may in good
faith believe he has a secure system and only his own processes are
running on his computers, it is the auditor's responsibility to
investigate it for themselves, first hand, and to possibly ferret out
anything that was missed by the friend.
That is what an audit precisely is.
Conversely:
If he himself is concerned about their activities, he can seek out a
lawyer to provide him with a proper Non Disclosure Agreement contract to
have the auditor sign - I wouldn't know it is standard practice, but I
think he would be within his rights to require this in turn.
If the computers in question are not being used directly to service the
organisation or hold the organisation's data who is requiring the audit,
there is a question mark over to what extent they can require the audit
to be carried out. That's an entirely different question.
Tai
===
Tai Kedzierski
Linux Operations and Deployments Engineer
RHCSA # 170-060-834
<u></u>
I use LibreOffice <u></u> , a free,
Freedom-respecting replacement for MS Office
/Open Source Free Software is a matter of liberty, not price./
<a class="gmail-m_3033861278480989599moz-txt-link-freetext" href="https://www.fsf.org/about/what-is-free-software" target="_blank">https://www.fsf.org/about/what-is-free-software</a>
On Tue, 19 Feb 2019 at 19:12, Edinburgh Linux Users Group
<u></u>> wrote:
I just received this email. Can anyone advise the OP on this question ?
Andrew Ramage
-------- Forwarded Message --------
Subject: [Baen Baen's Bar] Cybersecurity
Date: Tue, 19 Feb 2019 11:32:46 -0600vise
From: piobair <u></u> <u></u>
Reply-To: <a href="mailto:baens_bar@bar.baen.com" target="_blank">baens_bar@bar.baen.com</a> <u></u>
Organization: Baen's Bar
To: <a href="mailto:baens_bar@bar.baen.com" target="_blank">baens_bar@bar.baen.com</a> <u></u>
Newsgroups: Baen_Baens_Bar
The Board of Directors overseeing a friend of mine has decided that they need a security audit by an independent auditor. My friend's entire system is running on Linux with Linux servers and (mostly) thin clients.
He put out an RFP and, in his words, they want the keys to the front door in order to see if the china cabinet is locked.
Can an adequate audit be made from the /var/log files?
--
EdLUG mailing list
<a href="mailto:EdLUG@lists.edlug.org.uk" target="_blank">EdLUG@lists.edlug.org.uk</a> <u></u>
<a class="gmail-m_3033861278480989599moz-txt-link-freetext" href="https://lists.edlug.org.uk/mailman/listinfo/edlug" target="_blank">https://lists.edlug.org.uk/mailman/listinfo/edlug</a>
<u></u><u></u><u></u><u></u><u></u><u></u><u></u><u></u><u></u><u></u></pre>
<pre style="white-space:pre-wrap;font-family:Verdana,Geneva,Lucida,"Lucida Grande",Arial,Helvetica,sans-serif">--
EdLUG mailing list
<a href="mailto:EdLUG@lists.edlug.org.uk" target="_blank">EdLUG@lists.edlug.org.uk</a>
<a class="gmail-m_3033861278480989599moz-txt-link-freetext" href="https://lists.edlug.org.uk/mailman/listinfo/edlug" target="_blank">https://lists.edlug.org.uk/mailman/listinfo/edlug</a></pre>
</blockquote>
--
<p>Doc Krin, deep in the Ozarks!</p>
<br>
<p>A man’s greatest glory is to love his wife and raise his
children well // Mankind’s greatest shame is an uncherished
child. James Richard Shaver</p>
<p>"You can not leave behind what is always by your side" Richard
Castle </p>
<p>The saddest words ever said: "If only...." </p>
<br>
<fieldset class="gmail-m_3033861278480989599mimeAttachmentHeader"></fieldset>
<pre class="gmail-m_3033861278480989599moz-quote-pre">_______________________________________________
Baens_bar mailing list
<a class="gmail-m_3033861278480989599moz-txt-link-abbreviated" href="mailto:Baens_bar@bar.baen.com" target="_blank">Baens_bar@bar.baen.com</a>
<a class="gmail-m_3033861278480989599moz-txt-link-freetext" href="http://bar.baen.com/cgi-bin/mailman/listinfo/baens_bar" target="_blank">http://bar.baen.com/cgi-bin/mailman/listinfo/baens_bar</a>
</pre>
</blockquote>
</div>
-- <br>
EdLUG mailing list<br>
<a href="mailto:EdLUG@lists.edlug.org.uk" target="_blank">EdLUG@lists.edlug.org.uk</a><br>
<a href="https://lists.edlug.org.uk/mailman/listinfo/edlug" rel="noreferrer" target="_blank">https://lists.edlug.org.uk/mailman/listinfo/edlug</a></blockquote></div>