Network Security and Infrastructure Auditing
Learn how to evaluate and test network security and IT infrastructure from an auditor’s perspective. This course covers network architectures, Infrastructure as Code (IaC), vulnerability scanning, and penetration testing, equipping you with the skills to identify risks and ensure organizations maintain secure and compliant environments.
Course Description
Course 5 of 9 in our IT Auditing Learning Path! Organizations today rely on complex networks, hybrid cloud setups, and automated infrastructure, all of which create both opportunities and risks. Network Security and Infrastructure Auditing equips auditors and IT professionals with the skills to evaluate these environments for security, compliance, and risk exposure.
The course provides practical guidance on reviewing network components such as firewalls, VLANs, and VPCs, as well as modern practices like Infrastructure as Code (IaC). It also explains how to assess vulnerability scans and penetration testing reports, ensuring that findings are properly understood and communicated to stakeholders.
By focusing on real-world practices and modern IT environments, this course prepares you to perform thorough and effective audits of network security and infrastructure.
This course covers topics that align with concepts addressed in Domain 5 of the Certified Information Systems Auditor (CISA®) exam framework. It is not affiliated with, endorsed by, or sponsored by ISACA®, nor does it guarantee exam preparation or certification outcomes.
In this course, you'll learn...
Course Objectives
To explain the role of infrastructure and network security controls within an IT audit.
To identify and assess common components of network architecture (e.g., firewalls, VLANs, VPCs, etc.) from an auditor’s perspective.
To understand how organizations configure and secure common network devices to prevent unauthorized access and mitigate common threats.
To evaluate the risks and control implications of Infrastructure as Code (IaC).
To interpret results from vulnerability scans and penetration tests, and understand how they tie into audit reporting.
To apply practical audit techniques to review network and infrastructure security configurations.
How you'll apply these skills...
Review Network Architectures: Walk through diagrams and configurations to understand firewalls, routers, switches, VLANs, and VPCs from an auditor’s perspective
Assess Infrastructure as Code: Inspect Terraform scripts and other IaC templates for misconfigurations, excessive permissions, and insecure defaults before they scale across environments
Evaluate Cloud Environments: Test security groups, ACLs, and peering connections to confirm isolation, compliance with shared responsibility models, and restricted access to sensitive resources
Interpret Vulnerability Results: Translate technical scan and penetration test outputs into business-relevant risks, filtering out false positives and prioritizing critical issues
Audit Change Management: Verify that firewall rule changes, IaC code commits, and deployment pipelines follow documented approval and review processes
Test Segmentation Controls: Confirm that production, development, and guest environments are properly isolated to reduce the blast radius of potential attacks
Validate Monitoring & Logging: Check firewall logs, VPC flow logs, and alerting processes to ensure suspicious activity is detected and addressed in a timely manner
Report Audit Findings: Deliver clear, evidence-based conclusions that highlight security gaps, business risks, and actionable remediation steps for management
Course Instructor
Michael Carroll, CPA, CISA, CISM
Michael is an accounting and information security professional. He is also an Adjunct Professor at several higher education institutions, where he is responsible for teaching various accounting and information technology courses.
Michael earned his MBA in Accounting and B.S. in Accounting / Accounting Information Systems from Canisius University. Additionally, Michael is a Certified Public Accountant (CPA) and a Certified Information Systems Security Professional (CISSP). Michael is a current member of the NYCPA’s Education Committee and has been an Advisory Board Member for the Academy of Finance (AOF) since 2020.
Michael enjoys traveling, hiking, and watching the Buffalo Bills. He has also participated in several marathon events.
Course Content
Additional Info
Format
5-20 min. videos, 2 quizzes, and a final assessment
Field of study
Information Technology
CPE Credits
CPEs 3.0
Prerequisites
Completion of prior courses in Wisdify’s IT Audit Learning Path is recommended.