IT Employment

What does the company need? How critical is the IT? If you look at the IT from a business perspective rather than a technical challenge you can assign priorities, risk exposure and real value to your recommendations.
Remember to check with the client that this work is really wanted .. maybe they just want someone to 'fix their lan'

Also check www.sans.org and www.giac.com

The first thing I normally do is define the audit. Do they want software/hardware audit? Do they need things like hd/ram/os. Is this more of a pen. test? (ports/firewall config etc).

Define the critical areas of data. Users, Accting files, SQL db, whatever. Then find out who 'owns' or is in charge of that data. This will help you define your criteria.

If all you are looking for is a simple hw/sw grab some of the low end software apps and you can get a quick snapshot. Ask the customer to purchase the software required as it is theirs to keep.

You have already received good feedback from the two earlier respondants. (Biz needs and definition of body of work)

Define the scope of your Audit, 'what it will cover' (ie; what will be delivered), and 'what it will not cover'.

Get buy-in from your client on your proposed direction. (Your work might include doing a topology map, (Visio is fine for this exercise), of hw, networking and software), defining user group(s), monitoring / redundancy / security rendered under deployed architecture and the resources required to maintain the 'As Is' configuration.

Then you can get to work showing off how you can improve their setup AFTER your client imparts a clear vision of their IT needs as it supports their core business and their plans for growth in near future. Be sure to contemplate ROI considerations before you make recommendations to change their existing real estate.

Good luck!
Allison

If penetration testing is defined as being in scope, it would be a good idea to have the proper legal documentation, especially if they want you to test agsinst denial of service attacks.

You should also get them to define whether or not the IT department will be aware of the security audit. Part of the audit might be to test response strategies, where only a few people are in-the-know.