Đang chuẩn bị liên kết để tải về tài liệu:
security assessment case studies for implementing the nsa iam phần 9

Quyết định về mức độ của mối đe dọa hoặc tổn thương của một khách hàng là một process.This hơi chủ quan là một nơi khác trong quá trình IAM rằng kinh nghiệm InfoSec 'người đánh giá là rất quan trọng. Cho dù lỗ hổng này là một cao, trung bình, hay thấp phụ thuộc rất lớn vào tổng thể nguy cơ lỗ hổng này tạo ra cho tổ chức. | 342 Chapter 10 Final Reporting Vulnerability Classification Deciding on the level of threat to or vulnerability of a customer is a somewhat subjective process.This is another place in the IAM process that the assessors INFOSEC experience is critical. Whether the vulnerability is a High Medium or Low depends greatly on the overall risk the vulnerability creates for the organization. For example if a vulnerability exists but there is no threat of exploitation of that vulnerability the overall risk is Low. If a vulnerability exists a threat exists to exploit that vulnerability and if it is on a critical system a High level rating should be considered for the finding. Other designations may be considered depending on the criticality of the systems the likelihood and ease of exploiting the vulnerability and the type of threat involved. All the information gathered in the organizational information and system criticality processes directly tie to the overall risk factor determination for the organization. Positive Findings Every finding during an assessment does not have to involve a negative vulnerability. The assessment team should identify good security practices in addition to the negative vulnerabilities to give the customer a sense of what they are currently doing correctly.This gives the customer a sense that they at least have some foundation on which to build their security program. If you present only negative findings the customer will possibly develop a negative attitude toward any suggestions you make. Here are examples of acceptable and unacceptable positive findings Acceptable positive finding Customer ABC has demonstrated a resolve to provide a secure work environment through the use of a managed firewall and intrusion detection systems that provide quick reporting of anomalies to the security administrator.The security administrator responds to the notification within two hours unless a higher priority is placed on the identified incident. Unacceptable .