Information Gathering : Information And Intelligence Gathering

Protocol capture tools and protocol analyzers are important tools for an information systems security professional. These utilities can be used to troubleshoot issues on the network. They can verify adherence to corporate policies, such as whether or not clear text privacy data is being sent on the network. They can be used to test security countermeasures and firewall deployments and are needed to perform audits, security assessments, network baseline definitions, and identification of rogue IP devices.

Companies should develop a control that requires that routine vulnerability assessment of their customer facing web sites, network infrastructure, and associated systems (such as database systems). Vulnerability assessment can help identify potential weaknesses to systems and also provide a sort of feedback to the organization’s IT department on their current operational policy and security posture. The cost of performing a routine vulnerability assessment is considerably less than that of an actual data breach.

As it applies to an IT environment, a vulnerability assessment is used to identify existing vulnerabilities giving the environment owner an awareness of what needs to be fixed (Who needs a Vulnerability Assessment, 2017). The assessment needs to be viewed for what it is, a onetime occurrence that in no way highlights all vulnerabilities. Multiple assessments of vulnerability must be conducted over time to ensure that as many possible avenues of weakness are explored, identified, and marked for improvement. As new systems are added, programs changed, or other changes to the system are made vulnerabilities might be created.

3. Implement effective monitoring of networks through the use of electronic scanning in order to

Documents intended for Senior Management - advice and recommendation on the type of issues included, the level of detail and wording appropriate for that audience.

in four categories: intrinsic features e.g. duration of the connection, type of the protocol (tcp, udp, etc),

A vulnerability assessment is a risk testing process which finds, quantity and rank possible vulnerabilities to threats in as many security defects as possible in a given timeframe. Depend upon organization scope there are many way to conduct vulnerability assessment. This assessment may involve automated and manual techniques.

4. Identify the network protocols that are used in the protocols that are in the local are network at your shall or workplace. Why were these protocols chosen for your network? Was IPX ever implemented in your local area network? Why? if your network is using IP, what address class(es) is being used? Why? see if you can find out if and how class D and class E addresses are used in your network.

The National Preparedness Goal under the direction of Presidential Policy Directive 8 outlines the means to which all facets of the nation can prepare. The stated objective of the National Preparedness Goal is to create “a secure and resilient Nation with the capabilities required across the whole community to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk.” (NPG, 2015, p.5) That process starts with the completion of a risk assessment. “A risk assessment collects information regarding the threats and hazards, including the projected consequences or impacts.” (National Preparedness System, 2011, p.2) The method used to complete the assessment is the Threat and Hazard Identification and Risk Assessment (THIRA) process.

When it comes to the protection and mitigating of any structure or organization risk analysis and vulnerability assessments must be conducts so as to know what’s to be protected, the threats manmade or natural disaster, ranking the potential of threat as well as the probability. In terms of critical infrastructure the risk analysis and vulnerability assessment has guidelines from Homeland Security Presidential Directive Number 7(HSPD-7).

Network protocol communications, network connections established by host computer, network routing information, information about computers

Identification of critical information is the process of identifying what information is needed by the enemy, not so much protecting everything that is classified or sensitive unclassified, but protecting what is more vital and would be more useful to the enemy. Analysis of threats is the research and analysis of intelligence, counterintelligence and open source information on the likely enemies of a planned operation. Analysis of vulnerabilities is to examine each and every aspect of the planned operation and try to identify certain OPSEC indicators that could reveal critical information and then compare those indicators with the enemy intelligence collection capabilities used in the previous actions that they have taken in the past. Assessment of risk is where they first analyze the vulnerabilities identified in the previous action and see what OPSEC measures can be taken to prevent the opportunity of the enemy getting information, and then those measures are selected for execution based upon a risk assessment done by the commander and staff. Application of appropriate OPSEC measures is when the command implements the OPSEC measures selected in the assessment of risk, action, or in the case of planned future operations and activities, which includes the measures in specific OPSEC plans. Assessment of Insider Knowledge is assessing and ensuring employees, contractors, and key personnel having access to critical or sensitive information practice and maintain proper

Intelligence collection and apprehension of criminals have occurred for many years; however, with the exception of the Federal Bureau of Investigation, these actions were performed by different organizations. Nonetheless, roles and responsibilities have changed since the attacks on September 11, 2001. Intelligence-led policing and the National Criminal Intelligence Sharing program were incorporated, and fusion centers were established to help gather intelligence from different levels of the government. Although law enforcement at the local, state, and tribal levels aid in intelligence collection, it is important to ensure that intelligence gathered to protect national security and law enforcement

Nearly every community has some sort of community risk, threat, and assessment plan that takes into account one of the six potential risks that are of concern to homeland security. Though each of these plans will likely differ from one another, many communities will have the same types of information in their plans. This essay will look at the Threat and Hazard Identification and Risk Assessment Guide (THIRA), the Community Risk Reduction Planning Guide, as well as FEMA’s National Preparedness plan. Any combination of these guides are a good starting point for every community in America. At top of every communities list as well as the nation is the protection of the critical infrastructure. Loss of infrastructure regardless of how big or small the community is could have very crippling effects on that community.

As mentioned above the first threat in this threat modeling process is vulnerability and threat source identification. In this step it is job of the threat modeler to perform research to identify detailed sources of information about threats and vulnerabilities. When choosing sources about threat and vulnerabilities it is essential to ensure that the sources are up to date and credible. This often requires the threat modeler to look for published sources of information or even scholarly websites to ensure the integrity and accuracy of the information. One example of an excellent source for information about threats and vulnerabilities which are commonly used by threat modelers in the National Institute of Technology’s National Vulnerability Database. This is an up to date government repository of identify vulnerabilities