Security Proplanation And Enumeration Protocol : Security Content Automation Protocol

8. Once a vulnerability is identified by Nessus®, where can you check for more information regarding the identified vulnerability, exploits, and the risk mitigation solution?

Since the system/application domain involves business’s mission-critical systems and applications, as well as data, it is important to ensure security of this domain. Failure to do so can result in a large loss of information and can ultimately lead to the cease of productions. This will ensure the protection of confidential data and its integrity. By implementing monitoring software tools, this will analyze any potential vulnerability that may exist on the

Companies should develop a control that requires that routine vulnerability assessment of their customer facing web sites, network infrastructure, and associated systems (such as database systems). Vulnerability assessment can help identify potential weaknesses to systems and also provide a sort of feedback to the organization’s IT department on their current operational policy and security posture. The cost of performing a routine vulnerability assessment is considerably less than that of an actual data breach.

HTML5 will also allow pen-testers to review new scans, create new policies, and view scans from any device on the scanner, which means the entire network will be secure. This magnificent security tool is capable of providing any vulnerability within the IP address range, network or host located on the network. Within the configuration and compliance auditing, it can be compared to the Security Content Automation Protocol (SCAP), which is a method used to enable automated vulnerability management (National Institute of Standards and Technology, 2016). Nessus will also ensure the system is configured to be compliant within the security structure of Windows, Linux, Mac OS and applications. One more feature included is the integration of patch management, which allows patch information to be retrieved and to be included in the patch management report. Nessus will go one step further and check to ensure that patches have been properly installed, will audit mobile device weaknesses, gathering data and writing reports about potential threats for the devices connected to the network, whether it be iOS, Android, or Windows operating

Critical “1” risk, threats, and vulnerability User Domain Risks Threats, and Vulnerabilities Risk Impact/Factor None Critical

A vulnerability assessment is a risk testing process which finds, quantity and rank possible vulnerabilities to threats in as many security defects as possible in a given timeframe. Depend upon organization scope there are many way to conduct vulnerability assessment. This assessment may involve automated and manual techniques.

Target of Evaluation: An IT system, product or component that is identified/subjected to require security evaluation.

is a database of known software vulnerabilities and exposures and how to mitigate them with

Lab #1 – Part A – List of Risks, Threats, and Vulnerabilities Commonly Found in an IT Infrastructure

Objective: Assess the security vulnerabilities of an organization's computer/network operating systems along with the techniques used to protect them.

1.19 (U) Critical Elements. The Critical Elements are the specific elements that are both critical to the successful operation of the system and contribute to the national security advantage. Information pertaining to components, parts, and materials that are peculiar and critical to the successful operation of the system are identified as Critical Program Information (CPI) and Critical Components (CC). It is these pieces of information or technology that must be protected. Protecting the CPI and CC consists of protecting both the CPI and CC lists themselves in addition to CPI protection countermeasures. The CCs are commercial units and are not protected by security classification, however, the list of CCs is protected. The security classification

approved by the instrument developers. Scores are calculated and translate into one of four risk

Armando, A., Basin, D., Boichut, Y., Chevalier, Y., Compagna, L., Cuéllar, J., ... & Vigneron, L. (2005, January). The AVISPA tool for the automated validation of internet security protocols and applications. In Computer Aided Verification (pp. 281-285). Springer Berlin Heidelberg.

Prepare a common checklist of vulnerabilities and define its risk level (High, Medium and Low) as per the organisation impact on the application. So that analyst refer to the common checklist and high the issue in a correct category.

In the three maintained products the threats and risks are to be identified. Such as the data base securing, user identification, authorizing proper managers, protections from hackers and updated firewalls and less vulnerable software.