Information Request Form
The information request form (as shown in Table B.1) will provide you with information that helps define the size and scope of the assessment. If you can't gather all this information before the initial meeting, that's okay because after management has given the project the green light, you'll have the additional support to gather more information.
|
Contact Name |
|
Phone Number |
|
Cell Phone |
|
|
|
Mail Stop |
|
Administrative |
|
For this section, please describe administrative aspects of your organizational environment. |
|
What is the core mission of the organization? |
|
How many locations does the organization have? |
|
Does the assessment encompass all locations or just a limited number of sites? |
|
What event is driving this assessment? |
|
Does the organization have existing security policies and procedures? |
|
Does the organizations have physical controls in place to control the movement of employees and visitors? |
|
Do any vendors or corporate partners have access to the network? |
|
Are any IT services outsourced, and if so, which ones? |
|
Technical |
|
For this section, please describe technical aspects of your organizational environment. |
|
How many servers are located at each site? |
|
What OSs are in place for these servers? |
|
How many workstations are located at each site? |
|
What OSs are in place for these workstations? |
|
What networking protocols are used? |
|
Are there any mainframes? |
|
How many connections are there to the Internet? |
|
What services are made available externally? |
|
What services are made internally? |
|
Is wireless technologies used? |
|
Is VoIP used? |
|
What types of redundant systems are in place? |
|
Security |
|
For this section, please describe the security aspects of your organizational environment. |
|
What type of encryption technologies are used? |
|
Is there a VPN? |
|
Is authentication centralized? |
|
What type of authentication systems are used? |
|
How is access controlled? |
|
What type of firewalls are used? |
|
Is there an IDS/IPS in place? |
|
Legal |
|
For this section, please describe the legal aspects of your organizational environment. |
|
What state, provincial, and federal laws must the organizations comply with? |
|
HIPAA |
|
GLB |
|
SOX |
|
Family Education Rights and Privacy Act |
|
National Institute of Standards and Technologies |
Introduction to Assessing Network Vulnerabilities
- Introduction to Assessing Network Vulnerabilities
- What Security Is and Isnt
- Process for Assessing Risk
- Four Ways in Which You Can Respond to Risk
- Network Vulnerability Assessment
Foundations and Principles of Security
- Foundations and Principles of Security
- Basic Security Principles
- Security Requires Information Classification
- The Policy Framework
- The Role Authentication, Authorization, and Accountability Play in a Secure Organization
- Encryption
- Security and the Employee (Social Engineering)
Why Risk Assessment
- Why Risk Assessment
- Risk Terminology
- Laws, Mandates, and Regulations
- Risk Assessment Best Practices
- Understanding the IT Security Process
- The Goals and Objectives of a Risk Assessment
Risk-Assessment Methodologies
- Risk-Assessment Methodologies
- Risk-Assessment Terminology
- Quantitative and Qualitative Risk-Assessment Approaches
- Best Practices for Quantitative and Qualitative Risk Assessment
- Choosing the Best Risk-Assessment Approach
- Common Risk-Assessment Methodologies and Templates
Scoping the Project
- Scoping the Project
- Defining the Scope of the Assessment
- Reviewing Critical Systems and Information
- Compiling the Needed Documentation
- Making Sure You Are Ready to Begin
Understanding the Attacker
- Understanding the Attacker
- Who Are the Attackers?
- What Do Attackers Do?
- Reducing the Risk of an Attack
- How to Respond to an Attack
Performing the Assessment
- Performing the Assessment
- Introducing the Assessment Process
- Level I Assessments
- Level II Assessments
- Level III Assessments
Tools Used for Assessments and Evaluations
- Tools Used for Assessments and Evaluations
- A Brief History of Security Tools
- Putting Together a Toolkit
- Determining What Tools to Use
Preparing the Final Report
- Preparing the Final Report
- Preparing for Analysis
- Ranking Your Findings
- Building the Final Report
- Contents of a Good Report
- Determining the Next Step
- Audit and Compliance
Post-Assessment Activities
- Post-Assessment Activities
- IT Security Architecture and Framework
- Roles, Responsibilities, and Accountabilities
- Security Incident Response Team (SIRT)
- Vulnerability Management
- Training IT Staff and End Users
Appendix A. Security Assessment Resources
Appendix B. Security Assessment Forms
- Information Request Form
- Document Tracking Form
- Critical Systems and Information Forms
- Level II Assessment Forms
Appendix C. Security Assessment Sample Report
- Appendix C. Security Assessment Sample Report
- Notice
- Executive Summary
- Statement of Work
- Analysis
- Recommendations
- Conclusions
Appendix D. Dealing with Consultants and Outside Vendors
- Appendix D. Dealing with Consultants and Outside Vendors
- Procurement Terminology
- Typical RFP Procurement Steps
- Procurement Best Practices
Appendix E. SIRT Team Report Format Template
EAN: 2147483647
Pages: 138
