How do you carry out a cyber security audit? 5 steps to optimising your security

In France, one company in two was the victim of a cyber attack in 2023 (source: data.gouv.fr), and this trend is set to continue, with an 11-point increase in 2024 (source: Docaposte 2024 Cybersecurity Barometer).

Faced with this persistent cyberthreat, businesses need to implement cybersecurity strategies to protect themselves from the theft of confidential data, avoid financial losses (one business in eight reports costs of over230,000, according to the same barometer) and damage the integrity of their information systems (IS) and their reputation.

It is essential to carry out regular cyber security audits to assess the effectiveness of the strategies in place and identify any vulnerabilities. This is despite the fact that 72% of companies believe they are doing enough to protect themselves. This time it's the French National IS Security Agency that's telling us so.

This audit also enables companies that do not yet have a cybersecurity system to identify weaknesses in their IS and remedy them. So what is a security audit and how do you go about it? Find out in this article. 🤓

See all software Cybersecurity

What is a cybersecurity audit?

Definition and importance

An IT security audit is a systematic, independent and documented process designed to assess theeffectiveness of the systems, rules and protocols implemented to ensure the company's digital security and compliance.

🗓️ Carried out at least once a year by experts, each cybersecurity audit gives rise to a detailed action plan to :

1. correct any vulnerabilities detected
2. and secure information systems in an appropriate and proportionate manner.

Cybersecurity audits are of the utmost importance for businesses, which face increasingly sophisticated cyberattacks on a daily basis, thanks in particular to new technologies and AI.

Why carry out a cyber security audit? 10 objectives

The digital world is constantly evolving. Companies are regularly integrating new technologies, enabling the various players involved to be more agile and to have simple access to the information they need, both locally and when on the move. The spread of teleworking and nomadism is contributing to the physical and virtual expansion of connection points to corporate networks, thereby multiplying the number of entry points for cybercriminals.

Against this backdrop, a cyber-security audit is primarily designed to :

1. Identify the vulnerabilities of the IS as a whole,

2. Anticipate risks,

3. Reassess the relevance of cybersecurity strategies,

4. Improve digital security equipment and software,

5. Updating the regulatory compliance of systems,

6. Updating practices,

7. Raise awareness of cyber risks among all employees and pass on best practices,

8. Drawing up concrete recommendations on all aspects of cyber security,

9. Optimise the budgets allocated to cyber security and the resources mobilised,

10. Reduce the financial costs and damage caused by acts of cyber-maliciousness (data theft, business interruption, impact on the company's reputation).

What are the ANSSI's audit recommendations?

The Agence nationale de la sécurité des systèmes d'information (ANSSI- French national agency for information systems security), a benchmark in cyber security and cyber defence, recommends that comprehensive cyber security audits be carried out on a regular basis.The ANSSI, a benchmark in cybersecurity and cyberdefence, recommends that comprehensive cybersecurity audits be carried out on a regular basis. With this in mind, it has published a set of requirements for information systems security audit providers.

According to the ANSSI, the cybersecurity audit must :

• measure the level of compliance of the IS in terms of security (best practices, benchmarks, standards, etc.),

• assess the level of IS security based on various audits (organisational and physical, architecture, configuration and source code, intrusion tests),

• correct IS non-compliance and vulnerabilities by implementing appropriate security measures.

Types of cybersecurity audits to consider

In accordance with ANSSI recommendations, the cybersecurity audit covers the company's entire information system.

Technical audit: analysis of systems and networks

The technical cybersecurity audit involves an in-depth analysis of :

• Network architecture (tree structure, cabling, wireless connection, interconnection equipment, firewall),

• Operating systems installed on servers and user workstations (fixed and mobile),

• Applications and databases.

Strategic audit: assessing security policies

The assessment of security policies concerns the overall architecture of a company's information system, the organisation of teams, levels of expertise, processes, risk management and the way in which risks are anticipated. Yes, all that. 😮‍💨

During this audit, the people involved :

• analyse the documentation relating to security policies

• conduct interviews with managers

• assess the organisation and technical systems in place,

• establish points of comparison with security benchmarks and standards.

Intrusion tests: identifying vulnerabilities

This stage of the cyber security audit consists of identifying vulnerabilities that could be exploited. These tests take place in several phases:

• Gathering accessible information to model the possible attack surface,

• Analysis of connection ports, services accessible from the Internet, cloud services, websites, email servers and access points such as VPNs (virtual private networks) and DMZs (isolated sub-networks), but also the vulnerabilities that can be exploited.network architecture to identify possible access points on the local network, connected objects or services hosted in private clouds,

• Simulation of real attacks targeting the vulnerabilities identified by code injection, session hijacking, cross-site scripting (XSS, injection of content into a web page), etc.

Compliance audit: ensuring compliance with regulatory standards

The purpose of this audit is to identify any non-compliance and to detect any discrepancies between the company's current practices and the requirements in terms of security and data protection. The audit also involves several stages:

• Gathering information and analysing procedures,

• Assessment of the quality and efficiency of internal controls,

• Highlighting deviations from regulations and risks,

• Assessment and recommendations.

📑 The authoritative standards and benchmarks in this field are:

• ISO/IEC 27001, the global reference standard for information security management systems (ISMS) ,

• General Data Protection Regulation (RGPD), providing a framework for data processing on European territory,

• NIS 2 Directive (Network and Information Systems Security), aimed at reinforcing the level of cybersecurity of European companies and institutions...

5 steps to auditing and strengthening your IS security

Stage 1: Preparing your cyber security audit

The aim of this first stage of the cybersecurity audit is to determine the objectives, scope and procedures for carrying out the process.

Draw up clear specifications for the audit

Drawing up a set of specifications makes it possible to

• Clearly set out the priority objectives of the cyber security audit,
• check that data processing complies with the RGPD,
• assess the procedures for updating and correcting vulnerabilities, etc.

The scope of the audit is also set out in the specifications. It may cover the whole of the company's information system, or just specific areas such as network and telecoms infrastructures, systems and backup, cloud instances and security policies.

Depending on the context, the specifications may also specify the types of threat requiring particular attention, such as phishing, software and system vulnerabilities, endpoints, etc.

The specifications must also include a specific, operational backup and business continuity plan. This plan must be capable of restoring normal operation of the systems affected by the intrusion tests in a very short space of time.

The audit plan detailed in the specifications should also indicate the timetable and main stages of the audit, and identify the team leader and the various people involved.

Choose the right audit provider

The service provider will be chosen on the basis of its references, proven expertise and the methods, techniques and equipment it has at its disposal for carrying out the work.

Use the requirements framework published by ANSSI to establish the criteria for choosing your service provider.

Involve the stakeholders in the process

The team mobilised to carry out the cybersecurity audit must bring together external and internal auditors to combine :

• A high level of technical expertise and the objectivity of external contributors,

• Precise knowledge of the information system they have developed and operate on a daily basis.

Stage 2: Conducting the cyber security audit

Collect the data

The initial phase of the security audit consists of gathering all the documents that can be used as part of the operation:

• documentation relating to the company's security policy,
• service continuity plans (response to attacks, escalations, etc.),
• network diagram (visual representation of the network and its components),
• a precise inventory of IT assets.

If this is not the first cyber security audit, previous audit reports and the events documented in them should also be included.

Carry out penetration tests: white box vs. black box

There are two methods for carrying out penetration tests as part of a cybersecurity audit:

• The white box penetration test or white box pentest,

• The black box pentest.

👉 As part of a white-box penetration test, all the information is transmitted transparently to the test manager, including architecture documents, administrator access to servers, configurations and source code, and the privileges associated with the profiles of legitimate IS users identified as potential attackers.

👉 As part of a black-box intrusion test, the auditors have no information about the information system being audited, with the exception of IP addresses, URLs or domain names.A black-box intrusion test simulates an attack similar to that carried out by someone completely outside the company, whereas a white-box intrusion test simulates an attack similar to that carried out by someone completely outside the company.a white-box penetration test identifies vulnerabilities that may not be visible during a conventional penetration test.

Step 3: Analyse the results of the audit

Interpret the results to identify vulnerabilities

Following the cybersecurity audit, the auditors must provide an overall assessment of the compliance and security of the audited information system. curity of the information system audited, putting each identified vulnerability into context (test procedure, results).

Assess the criticality of the vulnerabilities identified

The cybersecurity audit report must propose a severity level for each non-compliance and vulnerability, based on a predefined scale. For each problem identified, recommendations are drawn up, including one or more solutions that are proportionate and adapted to the level of risk.

Stage 4: Drawing up a post-audit action plan

Prioritise the actions to be taken according to risk

The report issued at the end of the cybersecurity audit enables internal teams to plan future operations. A precise timetable establishes a prioritisation according to the level of criticality and details the resources to be mobilised and the actions to be taken to correct these anomalies.

Implement a reinforced cyber security policy

The recommendations resulting from the cybersecurity audit help to develop the company's security and compliance policy. The IT Department can then incorporate them into a reinforced strategy that takes account of developments in cyber attacks, IS vulnerabilities and the solutions to be put in place. The cybersecurity audit gives companies all the information they need to establish a resilient cybersecurity policy. ✅

Plan awareness-raising sessions for employees

Alongside the actions undertaken by IT teams, it is important to plan awareness-raising sessions for employees. These provide an opportunity to review the results of the cybersecurity audit and make the teams aware of the potential damage threatening the company if security and compliance measures are not applied.

It's also an opportunity to update the best practices to be applied so as not to endanger the entire IS!

Step 5: Monitoring and continuous improvement of cyber security

Update security and incident response protocols

In addition to the priority actions set out in the post-audit cybersecurity action plan, the teams in charge of IT security and data protection must undertake a review of the company's cybersecurity policies. The aim is to integrate different practices and processes into the existing system in order to secure the information system (access controls, network organisation, etc.).(access control, network organisation with the creation of DMZs, changes to the solutions deployed on client workstations).

To optimise monitoring and alert procedures and adapt responses to more systematic, personalised and even stealthier attacks, it is necessary to update the procedures to be followed in the event of an attack or intrusion, establish different scenarios depending on the attack, and define everyone's role.

Regularly assess the state of cyber security

IT teams use the history of actions carried out as part of the cyber security audit to step up the monitoring of network and system activities. Regular vulnerability scans and the systematic installation of corrective patches and security updates are necessary to respond effectively to evolving cyber threats.

Integrate cyber security into the corporate culture

Cybersecurity and the protection of the information system are the responsibility of everyone in the company. Of course, at different levels, but for a cybersecurity system to be effective and to know how to react in the event of an attack or following an unintentional error, users need to know how to use it. an unintentional error, users need to learn to incorporate the right reflexes into their day-to-day use , through regular information meetings and by raising awareness of best practice.

Everyone involved needs to be involved and informed of the outcome of the cyber-security audit, so that they feel empowered.

What tools can facilitate the audit process?

The experts in charge of cybersecurity audits in different areas of information systems use different tools:

• Vulnerability scanners to detect vulnerabilities in systems, applications and networks,

• Intrusion testing tools to simulate attacks,

• Network analysis and traffic monitoring tools,

• Compliance audit and rights analysis tools,

• Cybersecurity audit reporting and report generation tools...

What are the common mistakes to avoid during an audit?

An enterprise cybersecurity audit requires rigorous project management to prevent mistakes from jeopardising the objectives pursued. The main mistakes to avoid are

• Poor preparation of the upstream phases of the audit,

• Rough drafting of the specifications,

• Lack of rigour in the choice of service provider,

• Lack of rigour in data collection and analysis,

• Not defining a precise schedule for the various phases,

• Not involving internal teams in the audit and in reporting the results,

• Neglecting to ensure that the information system complies with the requirements for processing and storing confidential data,

• Produce an inaccurate report and define inadequate corrective actions.

See all software Cybersecurity

Investing in security for your company's future

Corporate cybersecurity has become essential in the face of increasing cyberthreats, which have multiple consequences, both financially and in terms of the company's reputation and long-term survival. To preserve the integrity of your information systems and data, you need to :

• Invest in cutting-edge cybersecurity hardware and software, such as EDR (Endpoint Detection and Response) patch management software, a new-generation firewall and intrusion detection probes,

• Regularly update your IT assets,

• Carry out regular cyber security and compliance audits,

• Implement an agile and resilient cyber security strategy,

• Involve all your employees and make them aware of good cyber security practices.

Investing in IT security is the best way to protect your company's IT assets, reputation and competitiveness in increasingly exposed environments.