Scribd
Upload
147 views

Vulnerability Assessment: Reducing The Risk

The document discusses what is included in a vulnerability assessment, which provides a one-time detailed scan and report on a business's security exposure through non-intrusive passive scanning. It analyzes a range of IP devices and provides prescriptive remediation advice. The assessment leverages industry-leading security software to identify vulnerabilities without impacting network operations.

Uploaded by

RumelaSamantaDatta
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
147 views

Vulnerability Assessment: Reducing The Risk

The document discusses what is included in a vulnerability assessment, which provides a one-time detailed scan and report on a business's security exposure through non-intrusive passive scanning. It analyzes a range of IP devices and provides prescriptive remediation advice. The assessment leverages industry-leading security software to identify vulnerabilities without impacting network operations.

Uploaded by

RumelaSamantaDatta
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

Vulnerability

Assessment

Reducing the Risk


Agenda

• What included in Vulnerability Assessment?


• What is included in a Vulnerability Assessment?
• Key Features
• Benefits
• Q&A
What’s included in Vulnerability
Assessment?

• A one time detailed scan and report on your business security exposure.

• Leverages industry-leading Security/Vulnerability Assessment software

• Non-intrusive, passive scanning does not impact network or device


operations

• Provides detailed scanning & vulnerability reporting on a range of IP


devices

• Includes prescriptive advice to remediate found issues


Threat Undesirable Events Asset
• Insider • Denial of Service • Information
⁻ Executive ⁻ Jam RF Signals ⁻ Sensitive
⁻ Initiate incessant/verbose reports ⁻ Confidential
⁻ Employee
• Back office Compromise ⁻ Restricted
• External Attacker ⁻ Create malicious web services ⁻ Private
⁻ Hacker ⁻ Inject malicious code • Equipment
⁻ Scripkiddie ⁻ Clear device errors and health stats ⁻ Access Point
⁻ Botnet Operator ⁻ Escalate privileges ⁻ Relay
⁻ Phisher • Physical Security Attacks ⁻ Tool PC
⁻ Steal • Services
⁻ Spammer
⁻ Vandalize ⁻ Bandwidth
⁻ Terrorist • Eavesdropping ⁻ Infrastructure
⁻ Malware ⁻ Capture data packets ⁻ Personnel (PII)
⁻ Sniff device bus ⁻ Staff
• Device Spoofing ⁻ Contractors
⁻ Spoof MAC address • Credentials
⁻ Clone endpoint ⁻ RSA Token
⁻ Smart Phone
⁻ iPad

6
All Rights Reserved.
• Common Themes:
– Information Security exists to manage risk, and risk exists as a function of at least threat
and vulnerability
– Vulnerability:
• Flaw or weakness in system security procedures, design, implementation, or internal
controls that could be exercised (accidentally triggered or intentionally exploited) and
result in a security breach or a violation of security policy (NIST SP 800-30: Risk
Management Guide for IT Systems)
• Exposure to attack
– Threat:
• Person or thing likely to cause damage
or danger (Oxford Dictionary)
• The potential for a threat-source to
exercise (accidentally trigger or intentionally exploit)
a specific vulnerability (NIST SP 800-30)

9
– Risk:
• The possibility that something unpleasant will happen (Oxford dictionary)
• The combination of the probability of an event and its consequence
(ISO Guide 73 – Risk Management)
• The potential that a given threat will exploit vulnerabilities of an asset or group of
assets and thereby cause harm to organizations
(ISO 13335 – Information Technology Security Techniques)

10
OTSI Offerings

Information Assurance Vulnerability and Threat Analysis Incident Response


• Incident Management • Network Security • Vulnerability Analysis
• Network Analysis • Identify and Access Management • Penetration Testing
• Cyber Intelligence • Data Privacy and Protection • Remediation
• Cyber Security Policy • Certification and Accreditation • Risk Management
• e-Discovery • Information Security Program and Risk • Playbooks
• Forensics Management • Job Aids
• Malware Analysis • Network Scanning • Run Books
• Reverse Engineering • Blacklist • CyberSOC Ops
• Security Engineering (Architecture) • Whitelist • Patches/Upgrades
• Dashboards / Analytics / Metrics

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy