<\/span><\/h3>\nA server audit involves looking deep into users, network configuration, security, log files, application and services. Below is there audit process<\/p>\n
<\/b>1.1. Users
\n<\/b><\/strong>The audit should primarily check how a user accesses your system and what authentication mode the system uses. After the identification is done, you categorize the list of users according to the roles and functions and evaluate their need to access the site. This helps in identifying the types of users who have a valid reason to access the site and setting up different types of access rights for the users in accordance with the business need. In case you come across a user with an access right but without a need, simply remove the user.<\/p>\n1.2. Network Configuration
\n<\/b><\/strong>Network configuration accompanies three prime aspects: configuration, listening ports and firewall.<\/p>\nThe configuration checks whether the IP addresses, netmask and gateway are secured. Listening ports offers insights on the active services so that you can check their purpose in the business. Lastly, Firewall is the network shield. You can configure the setting of the firewall as per your system storage. Keep it simple, the more sensitive the data, the less number of systems it should communicate with.<\/p>\n
1.3. Security
\n<\/b><\/strong>There is a dire need to check whether proper access rights have been assigned to different users based on their business roles. For this, you may choose to assign controlled access to the users and prevent any unauthorized execution of files. You may still account situations where a few files won\u2019t have a proper owner. In such cases, you have to put SetUID or SetGID into action and block any type of illicit file execution. It helps in defending your system from attacks that are planted using executables.<\/p>\n1.4. Log files
\n<\/b><\/strong>This is the gold mine for auditors. Log files contain an account of all the actions that have been performed on the system. Thus, study these file as minutely as possible as they help in performing the most accurate RCA in case of an incident. Check whether the calls and actions are properly logged and connected the to main applications. For a secured logging mechanism check the syslog configuration and find out if remote logging is allowed by the system. In case remote logging is not found on the system, then we suggest deploying a SIEM solution to start the practice.<\/p>\n1.5. Applications and services
\n<\/b><\/strong>Your server is the storehouse of applications and services. During the process, take a look at these applications because it will help you assess how much your server is exposed to attacks. If you come across any suspicious application, then can create backdoors for other applications.<\/p>\n
![](\"https:\/\/www.nethues.com\/blog\/app\/uploads\/2021\/07\/Mobile-App1-01-01.png\"alt=\"user-flow\")
\r\n\t\t<\/div>\r\n![](\"https:\/\/www.nethues.com\/blog\/app\/uploads\/2021\/07\/Mobile-App-01-01.png\"alt=\"user-flow\")
\n\t\t<\/div>\n