1) What should/do/would external or internal IT auditors look at when reviewing the configuration and management of a corporate ISA/TMG server? Could you provide some examples of essential things the audit should look at, common mistakes and misconfigurations admins make, common issues youd find through set it and forget it type configs
2) What sort of things would indicate to an auditor a poorly configured/managed ISA server, please provide some examples in low tech management speak, with subsequent risks. I.e what would auditors make recommendations on in relation to an ISA server if configured or misconfigured/managed in a particular way?