In view of recent reports of attacks and security breaches among big companies around the world, for example the cases of ransomware attacks and the effect on business and service delivery, there is however an urgent need to ensure that organizations' intranet and internet environment are protected from unauthorized access. Given that Windows Operating Systems and its associated services are popular among end users and corporations, there is need to ensure security of Windows systems in your environment by implementing good control systems, documenting robust policies and promotion of best practices. Information Systems Auditors and other IT Assurance professionals have a duty to ensure the security of all enterprise systems by good systems, physical, logical and environment controls. The material will demonstrate how to conduct audit of Windows systems, intranet and internet network. The list of Windows systems are not exhaustive and are as follows; Microsoft Exchange Server, Windows Server and desktop operating systems, Active Directory/Domain Controller, Skype for Business Server, TMG/ISA Server, VMware Server and Name Server (DSN). The audit program will provide a step by step guide on the assessment of an organization’s intranet and internet security. The material assessed vulnerabilities peculiar with Windows systems in conjunction with their impact on confidentiality, integrity and availability of computer assets.
The audit program provided detailed audit test procedures for the identification of risks, vulnerabilities and control weaknesses. The audit program will covered enterprise policies (IT Security policy, password policy, acceptable use of computer assets policy, network policy, etc.), baseline configuration for Windows systems, patch management, logical access control and authentication, system administration, bring-you-own-device policy, enterprise log management and correlation, vulnerability management, change management, virus control, group policy object (GPO) settings, virtualization, endpoint management, domain management, instant messaging and email services, support and incident management issued, backup and archiving services, spam control and administration, among others.