Auditing a mission critical environment?

[David Almada]

Hi everyone,
Sorry for being recurrent on the subject, but I was not clear on my first post. I want to conduct an audit on a mission critical environment , but I do not know which are steps to do.Any sugestions are welcome.
Thanks in advance.

David

[Armin Feller]

Hi David,

please have a look at following doc (Performance management overview ):

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B8844-90003/B8844-90003_top.html&con=/hpux/onlinedocs/B8844-90003/00/00/11-con.html&toc=/hpux/onlinedocs/B8844-90003/00/00/11-toc.html&searchterms=performance&queryid=20030115-052940

More infos can be found at:

http://www.docs.hp.com

and search for "performance"

Best regards,
Armin

[Joanne Keegan]

Hi David,

When you say auditing - do mean security, performance, or some other type of audit?

Regards,

Jo

[Michael Tully]

If your talking 'audit' your generally talking about how vunerable a system is, or what is happening on it.

Auditing by auditors. This generally means security. Depending on the auditors, this can vary from checking a few users access rights, system file permissions, application file permissions, cron
If your talking system auditing, then you would need to turn on the auditing tools.

There are tools like HP-UX Bastille (which is free) would be a good start for evaluating your system.

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

[David Almada]

Hi jo,
In fact I am talking about auditing the implementation of the all environment. Something like:
This environment follow the rules of a mission critical environment?
The aplication was designed to run as a mission critical aplication?

Well this kind of stuff I'm talking about.

David

[Jeff Barber]

As has already been mentioned audits come in many flavours. I would suggest you need to ask whoever has commissioned the audit to tell you what kind of outputs he/she is looking for. Could be a "how will this system standup resilience-wise" type audit so you'll need to look at connectivity, single points of failure, disc mirroring, backup/recovery strategy. Or it could be a "what can be done to reduce costs" type audit or a "how secure is this system" audit in which case you'll need to look at auditing procedures, file permissions, password procedures, maybe physical access as well as network security.