Unit 7 Technical Assessment Questions

* Check existing security scan reports, from WireShark and NetWitness Investigator, and see if we can identify data leakage, and setup new policies and procedures for monitoring web servers and applications.

mitigation strategy for each risk. Kaplan and Mikes (2010) noted in the case study that Lee explained

With these risks highlighted then reduction of risk, both positive and negative can be identified.

Check we are fulfilling health and safety policies and risk assessment appropriately, keep them up to date and modify them whenever it is necessary.

Any technical fault that involves your computer you should report this to your computer technician if your company has one. Large companies usually have a team of technicians to help solve various problems. Things like photocopier running out of paper use your brain and fill the paper tray yourself with the correct size and type of paper. If there is a jam, try and resolve this yourself without creating danger or ask somebody who knows how to fix this. If someone is required but not available or if you are having trouble tracking them down, the best thing to do is direct the query to the next person in line.

The purpose of a risk assessment (RA) is to identify the entire organization’s risks and quantify the

1.3- Explain what risk assessment is and how this is managed in the work setting.

Formal user access control procedures must be documented, implemented and kept up to date for each application and information system to ensure authorised user access and to prevent unauthorised access. They must cover all stages of the lifecycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access. These must be agreed by IDI. User access rights must be reviewed at regular intervals to ensure that the appropriate rights are still allocated. System administration accounts must only be provided to users that are required to perform system administration tasks.

Routinely ensure that cool air intake vents on the servers are not clogged by dust. Ensure that that there is enough space in front of and behind equipment to allow proper airflow.

Many such software suites are available for no cost. These suites scan a network for possible intrusion vectors. These vectors can then be analyzed for the best way to close the potentially open doors to the network. The GFI Events Manager is available for as low as $45 per node for servers, and as low as $4.50 per node for workstations (www.gfi.com). In addition, there should be a discussion for a periodic network attack by the IT staff or a trusted outside contractor. The reason that an outside contractor should be used on occasion is because IT would have at least some knowledge of how to access the system already. A “black hat” simulated attack would begin with no knowledge of the system network at all. As such, it simulates how a hacker would attempt to access the network. Thus, knowledge of access points would be learned, and a decision made as to how best to close them. The Common Vulnerabilities and Exposures (www.cve.mitre.org) is also an exceptionally useful free

Companies should develop a control that requires that routine vulnerability assessment of their customer facing web sites, network infrastructure, and associated systems (such as database systems). Vulnerability assessment can help identify potential weaknesses to systems and also provide a sort of feedback to the organization’s IT department on their current operational policy and security posture. The cost of performing a routine vulnerability assessment is considerably less than that of an actual data breach.

Which of the following best describes how the composite risk management process should be reflected in your safety briefing?

Exploiting known vulnerabilities with PenTest apps it is very easy to discover if a server is vulnerable (Nessus, metasploit, etc.) SNMP hacking to reveal server uptime (for Windows it is OID 1.3.6.1.2.1.1.3.0) for critical always-on systems they may not have been rebooted for months/years. Easy to back-date in a vulnerability database and see which patches require a reboot and know for certain they aren’t properly applied. If you have an account on the server you can use “net statistics server” or “net statistics workstation” to determine uptime. Security compliance manager is the framework used for Stripping, Hardening, and Compliance purposes. Use this to make a Gold/Master image for mass distribution or for individual stand-alone machines. Explicit guides are defined for hardening the registry and other file system settings. Templates for OS, Roles, Features, and Applications. With System

The Risk assessment will be a vital part of the whole security plan which is a document which basically covers the whole

The reader will become familiarised with the term risk and it definitions from specifically the ISO 31000 standard of risk management and also the definition of risk from the criminology crime triangle. Which one of these two definitions that are the most suitable for usage within the security industry will be discussed and evaluated. How and why consequence is important when assessing risk priorities and determining where to allocate resources will be examined and answered.