CSE 6203 Security Evaluation and Assessment Methodology Section: M Spring-2021

downloaded from

Scholarfriends

https://scholarfriends.com

Downloaded by: browsegrades@gmail.com | https://scholarfriends.com/singlePaper/216250/security-evaluation-and-assessment-methodology Distribution of this document is illegal.

CSE 6203 Security Evaluation and Assessment Methodology Section: M Spring-2021

Submitted by: MD Salekin Ferdouas ID: 012202013

This study source was downloaded by 100000840858457 from CourseHero.com on 07-07-2022 15:53:08 GMT -05:00

https://www.coursehero.com/file/109017563/ID-012202013-MIDdocx/

MD Salekin Ferdouas ID: 012202013

Answer to the Question No- 1(a) The security risk assessment team must understand the limitations of the interview process. Information gathered during an interview should be considered as a way to identify areas for further study. The interviewer can make mistakes through misinterpretation of the questions or the answers provided, or through misreporting what was said. Many security risk assessments are performed by teams with relatively little experience. In these situations, the likelihood that a question or the answer provided is misinterpreted is greatly increased. Even experienced information security professionals can misinterpret what is said by the interviewee.

The interviewee can make mistakes as well. It is quite typical that the interviewee is unfamiliar with many of the terms used within the interview process, or the interviewee may have a different understanding of the question than the interviewer does. In these cases, the answer provided may not be accurate. Also, interviewers tend to be eager to please and will attempt to answer questions as much as they can. This process leads to guessing and “filling in the blanks.” Again, this can result in inaccurate answers.

Answer to the Question No- 1(b) It is important to collect and retain the evidence for all data gathered during a security risk assessment.

Evidence is used to support the claims made during the analysis portion of the security risk assessment process. Although this may sound like a lot of extra work, proper evidence collection and tracking does not place an undue burden on the project. Instead, collecting and tracking evidence properly can actually reduce the effort required to perform a security risk assessment. This evidence:  



Is easy to do if you do it while you are gathering data.

Provides better data upon which to make judgments. It is easier to assess the value or certainty of data if you know how you got it, i.e., “Somebody said this,” as opposed to “We found this vulnerability.”

Provides a way to avoid arguments with the customer.

Answer to the Question No- 1(C) Threat statement: “An employee may cause the release of sensitive information” Associated administrative controls: • Acceptable-use policy • Monitoring • Two-man control • Job rotation • Clearance refresh • Ethics training

This study source was downloaded by 100000840858457 from CourseHero.com on 07-07-2022 15:53:08 GMT -05:00

https://www.coursehero.com/file/109017563/ID-012202013-MIDdocx/

MD Salekin Ferdouas ID: 012202013

• Sanctions policy • Separation of duty • Job rotation • Termination procedures • Out-briefing

Answer to the Question No- 1(d) It is important to carefully and fully document all aspects of the security testing effort. Because the security risk assessment team will be testing a live system, several elements require diligence in the security test documentation effort.

“When you are part of the security team performing tests on a live system, you must be aware that your team will be the first one blamed if anything goes wrong anywhere near the time or place you are testing.”

Be prepared to work with the assessed organization to help them determine the root of any problem.

Detailed test documentation can save a lot of time and headaches when dealing with this situation. Also consider that, from time to time, your security tests may have actually been the catalyst for causing errors or system crashes. Even seemingly benign security tests such as a port scan can exercise some interfaces that have not been previously tested. In the case of custom-made applications, a simple security scan may cause delicate and untested applications to fail. Documentation comes in handy here in helping to resolve the problem.

Answer to the Question No- 2(a) If the organization has policies and procedures in place for dual control, the assessment team should inspect these controls to determine their effectiveness. Inspection of these controls can be accomplished through an understanding of the policies and job descriptions and then a review of any evidence of separation of duties.

Double-Key Data Entry—This is a data entry method in which each transaction is entered twice. The first data entry and the second data entry are checked for consistency with each other. This control helps to reduce errors and fraud.

Identify critical transactions requiring separation: • Development/production • Key generation/key delivery • Design and implementation/audit

This study source was downloaded by 100000840858457 from CourseHero.com on 07-07-2022 15:53:08 GMT -05:00

https://www.coursehero.com/file/109017563/ID-012202013-MIDdocx/

MD Salekin Ferdouas ID: 012202013

• PO creation/PO payment • Associate transactions with accounts or individuals • Check of conflicts of interest

Answer to the Question No- 2(b) The incident response plan and procedures provide the direction and authority to the incident response team for identification, containment, and recovery capabilities. The process of gathering data through observation is a subtle one. With a few exceptions, this process is passive and depends on team members being aware of the organization’s policies and procedures and keeping an eye out for opportunities to confirm or disprove the organization’s adherence to policies and procedures. I would gather data through the observation stage of RIIOT method as follows: Were there any obvious breaches to security policies?

• Were acceptable-use policies followed?

• Were visitor control policies followed?

• Was change management policy followed?

• Did you see any passwords on monitors or other areas (e.g., under keyboards or phones)?

Answer to the Question No- 2(c) The system operators are performing checks to ensure quality of workmanship, while the audit function is performing checks to detect violations of policy and to reduce the opportunity for fraud, waste, and abuse. When Violations of the acceptable-use policy are monitored and reported: • Attempt to violate the acceptable use policy by going to some forbidden Web sites. Ask to see the monitor logs later that day.

• In conjunction with your external security testing, review system monitoring effectiveness.

Answer to the Question No- 2(d) The sanitization test requires that the security risk assessment team have tools to check the effectiveness of the assessed organization’s sanitization methods. The security risk assessment team should be familiar with the media disposal and destruction procedures. With those procedures in mind, the team should collect samples of sanitized data, test the media for proper sanitization, and document the results.

Collection of Samples—Samples of media that should be sanitized can be collected from storerooms, recycle bins, or work areas dedicated to this task. The team should seek only those devices that are believed to have completed the sanitization process.

Test Media for Residual Data—The assessment team can test the data-sanitization measures to assess their effectiveness. The tests should start with simple read attempts, but could progress to low-level attempts to

This study source was downloaded by 100000840858457 from CourseHero.com on 07-07-2022 15:53:08 GMT -05:00

https://www.coursehero.com/file/109017563/ID-012202013-MIDdocx/

MD Salekin Ferdouas ID: 012202013

read data residuals with the use of tools. These tools can vary from the quality-assurance option in datasanitization tools to disk recovery tools and data forensic tools.

Document Results—The security risk assessment team needs to document the results of the attempts to read data from sanitized media. Any findings will be referenced as evidence in the final risk assessment report. It is important to record what data was captured as well as the effort and toil the team required in gaining access to the data.

Answer to the Question No- 2(e) When it becomes clear that an employee will no longer be employed at the organization, the termination procedures must be handled appropriately to avoid a breach in security. The potential for fraud, waste, and abuse can be rather high, especially with disgruntled employees who have had access to sensitive information and critical systems. There are many approaches to safeguarding the organization from the potential of a security breach in the event of an employee termination. The organization should have a clear set of procedures to be followed upon an employee’s termination. These procedures need to be tailored to the organization, because they will be dependent upon the industry, environment, and business structure. Some examples of items that should be included within termination procedures include the return of capital equipment and security access cards, termination of accounts, and the turnover of duties.

This study source was downloaded by 100000840858457 from CourseHero.com on 07-07-2022 15:53:08 GMT -05:00

https://www.coursehero.com/file/109017563/ID-012202013-MIDdocx/ Powered by TCPDF (www.tcpdf.org)