Vulnerability

Assessment

Reducing the Risk

 Agenda

• What included in Vulnerability Assessment?

• What is included in a Vulnerability Assessment?
• Key Features
• Benefits
• Q&A
 What’s included in Vulnerability
Assessment?

• A one time detailed scan and report on your business security exposure.

• Leverages industry-leading Security/Vulnerability Assessment software

• Non-intrusive, passive scanning does not impact network or device

operations

• Provides detailed scanning & vulnerability reporting on a range of IP

devices

• Includes prescriptive advice to remediate found issues

 Threat Undesirable Events Asset
• Insider • Denial of Service • Information
⁻ Executive ⁻ Jam RF Signals ⁻ Sensitive
⁻ Initiate incessant/verbose reports ⁻ Confidential
⁻ Employee
• Back office Compromise ⁻ Restricted
• External Attacker ⁻ Create malicious web services ⁻ Private
⁻ Hacker ⁻ Inject malicious code • Equipment
⁻ Scripkiddie ⁻ Clear device errors and health stats ⁻ Access Point
⁻ Botnet Operator ⁻ Escalate privileges ⁻ Relay
⁻ Phisher • Physical Security Attacks ⁻ Tool PC
⁻ Steal • Services
⁻ Spammer
⁻ Vandalize ⁻ Bandwidth
⁻ Terrorist • Eavesdropping ⁻ Infrastructure
⁻ Malware ⁻ Capture data packets ⁻ Personnel (PII)
⁻ Sniff device bus ⁻ Staff
• Device Spoofing ⁻ Contractors
⁻ Spoof MAC address • Credentials
⁻ Clone endpoint ⁻ RSA Token
⁻ Smart Phone
⁻ iPad

6
All Rights Reserved.
• Common Themes:
– Information Security exists to manage risk, and risk exists as a function of at least threat
and vulnerability
– Vulnerability:
• Flaw or weakness in system security procedures, design, implementation, or internal
controls that could be exercised (accidentally triggered or intentionally exploited) and
result in a security breach or a violation of security policy (NIST SP 800-30: Risk
Management Guide for IT Systems)
• Exposure to attack
– Threat:
• Person or thing likely to cause damage
or danger (Oxford Dictionary)
• The potential for a threat-source to
exercise (accidentally trigger or intentionally exploit)
a specific vulnerability (NIST SP 800-30)

9
– Risk:
• The possibility that something unpleasant will happen (Oxford dictionary)
• The combination of the probability of an event and its consequence
(ISO Guide 73 – Risk Management)
• The potential that a given threat will exploit vulnerabilities of an asset or group of
assets and thereby cause harm to organizations
(ISO 13335 – Information Technology Security Techniques)

10
 OTSI Offerings

Information Assurance Vulnerability and Threat Analysis Incident Response

• Incident Management • Network Security • Vulnerability Analysis
• Network Analysis • Identify and Access Management • Penetration Testing
• Cyber Intelligence • Data Privacy and Protection • Remediation
• Cyber Security Policy • Certification and Accreditation • Risk Management
• e-Discovery • Information Security Program and Risk • Playbooks
• Forensics Management • Job Aids
• Malware Analysis • Network Scanning • Run Books
• Reverse Engineering • Blacklist • CyberSOC Ops
• Security Engineering (Architecture) • Whitelist • Patches/Upgrades
• Dashboards / Analytics / Metrics