Determining What To Audit And Analyzing Audit Records

In this practice, you will create a list of audit requirements for a fictitious company

, and then analyze common MCSE 2003 exams(http://www.mcsa-70-291.com) records found in the security log. Complete the exercises that follow. If you are unable to answer a question, review the lesson materials and try the question again. You can find answers to the questions in the "Questions and Answers" section at the end of the chapter.

Exercise 1: Determining What to Audit

Read the following scenario and then answer the question that follows.

Scenario You are an IT auditor at Wingtip Toys. You are asked to specify the audit requirements for a file server in the research department. The file server will store confidential research information. Files are protected by EPS encryption. Communications between researchers' workstations and the file server are protected by IPSec. Only the researchers and their workstations are allowed to access the file server.

Figure 9-23 shows the configuration for auditing for use of the Take MCSE study guides free download(http://www.examshots.com/certification/MCSE-2003-50.html) Ownership permission. To ensure that the administrator is caught, you should also audit for privilege use. Two possible events can be recorded. If the administrator attempts access while logged on interactively to the server on which the file resides, the Se_TakeownershipPrivilege, event 578, is recorded. This is a privilege usage event. However, if she takes ownership remotely, the file Take Ownership permission (WRITE_OWNER) is used. This is object access event 560. With all this noted, remember that administrators can also delete audit logs, either in their entirety or by individual events. If you have untrustworthy administrators, the only solution is to not allow them to be administrators.

Also To prevent an administrator from reading a file, you can encrypt the file. However, if you do so, make sure the administrator is not the file recovery agent. To learn why and what you can do to prevent administrators from reading sensitive files, see Lesson 5, "Designing a File Encryption and Decryption Strategy" CCNA exam(http://www.upcert.com) later in the chapter.

by: Shirley Green

POST COMMENT

Battery Reconditioning With Regard To Car Battery Power - Vital Tips Free VIN Check helps us to find out the report of vehicle The Uses Of A Car Camera Search Engine Market Domination Preparing Your Vehicle for Winter Trips How Can You Profit From Search Engine Advertising? Be Informed More About Audi A6 Gps Gobble Up The Number Solitary Tips On Nissan Paladin Gps Harford Rabbi Organized Prayer Hanukkah Acne Blemish Laser Treatment Really Good At Handling Acne Scars New Nissan Sunny to be launched in mid 2011 The Beauty Of The Checker Glossy Garage! The Benefits for Home Audio Products