INTERNAL AUDIT DEPARTMENT

AUDIT PROGRAM FOR

LTE FIREWALL AUDIT

Date Initiated: 8/29/2017

Date Completed: Click here to enter a date.

Reviewed By: _____________________ _____________________ __________________

Print Name Signature Date

Approved by: _____________________ _____________________ __________________

Print Name Signature Date

DEPARTMENT: Internal Audit
SECTION: IT Audit
OBJECTIVES:
1. Identify and obtain the current architecture of the LTE Network
2. Identify and review Policies and Procedures in place for Firewall Security.
3. Identify and review General Controls in place for Firewall Security.
4. Review the filters and conditional filter handling on the Firewalls.
NO. CONTROL OBJECTIVE
1 Identify and obtain the
current architecture of the
LTE Network
2 Identify and review Policies
and Procedures in place for
Firewall Security.
3 Identify and review General
Controls in place for
Firewall Security.
4 Review the filters and
conditional filter handling on
the Firewalls.
Page 2
AUDIT PROGRAM
LTE Firewall Audit
Audit ID:
PERIOD REVIEWED: Sept 2017
CONTROL TEST REF PERFORMED
BY/
DATE
a. Obtain LTE Network diagram to highlight all
nodes, Routers, Servers, Firewalls, Switches,
Base stations, etc.
b. Identify Internet Facing Firewalls and
potential critical points.
a. Obtain and review the security policy in
place.
b. What software and procedures are in place to
address detection and remediation of Viruses,
Worms, Spoofers, and Sniffers
c. Determine the intrusion detection system used
and actions taken based upon the intrusion
detection.
a. Establish how many people have access to the
Firewalls and view their permissions and
roles to justify access.
b. Establish the frequency of updates and
patches applied to Firewalls and by whom.
c. Identify the methodology used to monitor the
Network and Firewall performance.
d. Establish the frequency of Backups and the
last recovery executed on Firewalls.
a. How are security rules set and enforced?
b. Obtain Firewall rules and verify if
unnecessary TCP/IP services been
deactivated.
c. Review host and client host services to ensure
that host is configured for only those
necessary services.