1. VULNERABILITY ASSESSMENT FOR THE POLICE DEPARTMENT’S NETWORK

2. Pen-Testing vs. Vulnerability Assessment The two terms are related but penetration testing has more of an emphasis on gaining as much access as possible. While vulnerability testing places the emphasis on identifying areas that are vulnerable to a computer attack.

3. An automated vulnerability scanner will often identify possible vulnerabilities based on service banners or other network responses that are not in fact what they seem. A vulnerability assessor will stop just before compromising a system, whereas a penetration tester will go as far as they can within the scope of the contract.

4. A penetration test is like any other test in the sense that it is a sampling of all possible systems and configurations. Unless the contractor is hired to test only a single system, they will be unable to identify and penetrate all possible systems using all possible vulnerabilities. As such, any Penetration Test is a sampling of the environment. Furthermore, most testers will go after the easiest targets first.

5. STEPS INVOLVED IN VULNERABILITY ASSESSMENT 1. Identify and understand your business processes. 2. Pinpoint the applications and data that underlie business processes. 3.Find hidden data sources.

6. 4.Determine what hardware underlies applications and data. 5.Map the network infrastructure that connects the hardware. 6.Identify which controls are already in place.

7. 7.Run vulnerability scans. 8.Apply business and technology context to scanner results.

8. RISKS INVOLVED IN CONDUCTING AN INTERNAL VULNERABILITY ASSESSMENT. 1.Vulnerability assessments can provide an overwhelming, incoherent amount of data. 2.They typically contain numerous false positives, especially for areas such as patch management and secure application development.

9. 3.Due to lack of impact analysis, they have inadequate risk rankings often based on tool suggestions. 4.They are unable to chain together vulnerabilities to determine overall impact to the business. 5.They fail to identify logical attack vectors such as password reuse and application logic flaws. 6.Recommendations for remediation are often generic and based on tool output.

10. VULNERABILITY ASSESSMENT WITH A THIRD PARTY The outsourcing company must follow the FISMA requirements, by applying the NIST standards and guidelines. Establish an Information Security Assessment Policy to be followed. Determine the objectives of each security assessment

11. The consulting firm should be accountable for any damage caused by errors on during the exercise. Sign a formal agreement for the Vulnerability Assessment. Non-disclosure information externally.

12. The 3rd party should provide an Analyze findings, and develop risk mitigation techniques accordingly and report security Incidents (FISMA 3544(b)(7)). The 3rd party should periodically testing and evaluating the security controls and techniques (FISMA section 3544(a)(2)(D)).

13. LEGAL CONSIDERATIONS The 3' parties are required to meet the same security requirements as federal agencies (FISMA and OMB policy). As part of the contract and the service-level agreements, the consulting firm requires the use of the security controls in NIST Special Publication 800-53 and 800-53A

14. Evaluate potential legal concerns before starting an assessment (The assessments that involve intrusive tests - Pentest). Legal Department may review the assessment plan developed by the 3- party. The Legal Department should address privacy concerns, and perform other functions in support of assessment, planning. (FISMA, section 3542(a)(1)(B)).

15. REFERENCES Snedaker, S. (2007). The Best Damn IT Security management Book Period, Syngress publishing. National Institute of Standards and Technology. (2009). Recommended Security Controls for Federal Information Systems and Organizations (NIST Special Publication 800-53, 2009 Edition). Gaithersburg, MD. National Institute of Standards and Technology. (2010). Guide for Applying the Risk Mona Framework to Federal Information Systems (NIST Special Publication 800-37, revision 1). Gaithersburg, MD. National Institute of Standards and Technology. (2010a). Guide for Assessing the Security Con in Federal Information Systems and Organizations (NIST Special Publication 800-53A). Gaithersburg, MD.