Materials Needed A notepad may be useful Considerations Communicate with the staff members the level of confidentiality you are treating discussions around their device and technology usage with - i.e. explain what incident response triggers you have agreed upon with the organization, and that anything not triggering that is to be only reported in aggregate. Walkthrough The auditor inspects a subset of key and/or representative user devices (work & personal). The auditor should focus on the work devices to limit scope creep, but if the office has many personal devices accessing organizational accounts/data, the auditor should share what "red flags" they are looking for and work in tandem with device owners and/or IT staff. For a small office, it may be possible to check every machine. For larger offices, the auditor should use a subset to get a feel for the overall security stance of user devices. See the Appendix for a per-OS guide of where to find key data. Recommendation Upgrade Operating Systems Popular operating systems like Windows XP are, sadly, no longer receiving security updates. Move to Licensed Operating Systems While "pirated" operating systems are extremely common (especially Windows) they often leave much to be desired in terms of security. If the OS is not receiving regular updates from the software creator, it is extremely vulnerable to thousands of potential attacks. Page 72 of 240