TECHNICAL AUDIT OF SECURITY OF INFORMATION - TELECOMMUNICATION SYSTEMS OF ENTERPRISES

The content of the audit and vulnerability testing of the information and telecommunication system (ITS) of any enterprise is considered. Based on the results of the information security audit, the overall security of the company's ITS is assessed. It is proposed to assess the security of IT using penetration testing in the following areas: penetration testing from outside and inside the information infrastructure, social engineering testing of the company's personnel and testing for resistance to DDoS attacks; assessment of the security of the mobile application, web resource and wireless networks. The proposed general algorithm for IT infrastructure penetration testing (analysis of vulnerabilities and security of information resources) in the form of stages: initialization, passive and active intelligence, operation and post-exploitation, systematization and presentation of the results of security assessment, risk and vulnerability assessment, recommendations regarding them elimination. In stages all operations are carried out without causing real damage to the ITS. The purpose of a technical audit is shown, which covers the components of the ITS and can be considered as an ind