Introducing the Assessment Process

The assessment process can be carried out in one of three ways: level I, level II, or level III types. A level I assessment is focused on information. Level I assessments require you to request and review all the security policies and procedures the organization has. This job has been simplified because the documentation has been broken into 18 distinct classes, which are shown in Table 7.1. Each of the classes of policies will be discussed in this chapter. After these documents are reviewed, you can progress to employee interviews. The interviews are with the people who carry out the day-to-day tasks outlined in the various policies that were reviewed. They will be able to provide you with valuable information about how things are actually done versus how procedure describes that they should be done. They can also offer insight into ways to improve security. It's important to note that interviews are not interrogations. Employees should be able to speak freely with you and not worry that their comments will be attributed to them or used against them.

Table 7.1. Categories and Classes of Policy Control

Management

Technical

Operational

INFOSEC documentation

Identification and authentication

Media controls

INFOSEC roles and responsibilities

Account management

Labeling

Contingency planning

Session controls

Physical environment

Configuration management

Auditing

Personal security

Malicious code protection

Education training and awareness

Maintenance

System assurance

Networking connectivity

Communications security

The next item to be tackled in a level I assessment is system demonstrations. System demonstrations give you the opportunity to match up what is stated in policy versus what is actually done. System demonstrations are just as the name impliesdemonstrations. You will let employees who normally perform a task go through the process while you observe.

With the completion of system demonstrations, you will have completed a level I assessment. Will you need to go further? Well, it depends. Level II and III assessments focus on technology. Items such as vulnerability scanning, password cracking, and exploiting vulnerabilities are all part of level II and III assessments. Performing a level III assessment or ethical hack just to show that someone can break in is important only to demonstrate that it endangers the organization or its key business processes. By itself, a level III assessment provides only an adversarial view, is usually external in nature, and does not examine policies, procedures, or the underlying security structure and may provide only a short-term fix. Figure 7.1 outlines the assessment process and details the flow of level I, II, and III assessment activities.

Figure 7.1. Assessment process.

Let's start by taking a look in more detail at what needs to be accomplished during a level I assessment.

Note

An assessment is not an audit. Whereas audits are focused on ensuring compliance with established policies and operational procedures, assessments are more concerned with the big picture. Some of the questions an assessment seeks to answer are the following: Are procedures in place? Do you adequately protect the organization's core business? Do employees have suggestions on how to improve security or make changes to current procedures? Assessments, unlike audits, are based on a policy of nonattribution. If the janitor reports that he has seen confidential information in the trash, there's no need to attribute that statement directly to him; simply state that media control policies are not being followed.


Introduction to Assessing Network Vulnerabilities

Foundations and Principles of Security

Why Risk Assessment

Risk-Assessment Methodologies

Scoping the Project

Understanding the Attacker

Performing the Assessment

Tools Used for Assessments and Evaluations

Preparing the Final Report

Post-Assessment Activities

Appendix A. Security Assessment Resources

Appendix B. Security Assessment Forms

Appendix C. Security Assessment Sample Report

Appendix D. Dealing with Consultants and Outside Vendors

Appendix E. SIRT Team Report Format Template



Inside Network Security Assessment. Guarding your IT Infrastructure
Inside Network Security Assessment: Guarding Your IT Infrastructure
ISBN: 0672328097
EAN: 2147483647
Year: 2003
Pages: 138

Flylib.com © 2008-2020.
If you may any questions please contact us: flylib@qtcs.net