These audits involve exhaustive technical reviews of the systems, turning this analysis into a comprehensive and in‑depth study at all levels of the IS.

The result of these audits provides an accurate view of present and future security needs of these systems, with the confidence of following the guidelines of a globally recognized quality and trust standard such as ISO 27001.

The methodology followed by Internet Security Auditors aims to enable an exhaustive review of the security aspects of all components within the company’s Information Systems, covering the following aspects:

Network Security

Analysis of the network structure, review of the devices responsible for controlling data flow, the configuration and status of remote and wireless access devices, and protection, filtering and intrusion detection devices, as well as detection of unsecured public access points.

Security of Internal Servers and Network Services

Detection of servers and services with outdated versions, inadequate configurations of Operating Systems and Network Services, and security requirements (updates and patches, security configuration adjustments or complete hardening processes).

Systems and Data Availability Management

Detection of deficiencies in the Backup Policy or its application, in Monitoring or Remote Management Systems, and in Contingency and Continuity Plans or their implementation; detection of devices and systems with high criticality for business continuity; and verification of the fault‑tolerance measures applied.

Protection Systems

Review of the Security of Content Containment and Filtering Systems, detection of anomalies in the functioning of protection systems at application level (Antivirus, Antispam and Content Filtering – Web, FTP, P2P...), identification of security requirements (need for updates or patches, security configuration deficiencies and scope of action) and potential legal implications or reputational damage.

User Workstation Security

Determining the ability of a user to perform actions without control by network administrators on or from their machine (compromising a system, accessing or sharing data or resources, and installing or uninstalling software) and detection of outdated machines with disabled or misconfigured security systems (client antivirus, personal firewalls, monitoring or remote management tools...).

As a result of all the system analysis work and the subsequent analysis of results and documentation, the report will present the findings obtained in the security audit together with recommendations, where necessary (regarding network architecture, systems...).

Some of the results, which will depend on the specific characteristics of each case, are the following:

• Executive summary.
• Results obtained for each of the points analyzed.
• Vulnerabilities detected and classified according to their level of severity, as well as recommendations for their elimination.
• Recommended configuration changes in the systems to improve security.
• Recommended changes in authentication, access control, passwords...
• Recommendations on new applications and services that help increase the level of security.
• Current network map and recommended changes to improve the current network topology.
• Recommended changes in the rules of Perimeter Protection Systems (routers, firewalls, IDS...).
• Identification of critical points where it is advisable to improve availability.
• Recommended changes in the different accesses to the network.
• Recommendations to improve user authentication and access points in the wireless network.
• Recommended changes in antivirus systems, their distribution and configuration.
• Improvements in reactive security systems.
• Recommendations, exceptions and corrective actions for the technical aspects defined by ISO 27001.