Security Assessment Workplan

1
Security Assessment Workplan

• Network Security
• CS654
• Mike Payne

2
Security assessment workplan

• What is a Security Assessment Workplan?
• The Security Assessment Workplan is a Workplan
  which Assesses the Security posture of the
  organization being evaluated.

Puryears rule with supporting data from
Killmeyer 2nd edition page 287
3
Security assessment workplan
There are Three Major Sections

• Operating Environment, Security Administration,
  and Management
• Operational Security Programs
• Computer Operations Security

4
Security assessment workplan
Information Security Assessment Workplan
Organization_____________________________________
_____________
Business Unit____________________________________
______________
Review Conducted on______________________________
___________
Review Conducted by______________________________
___________
5
Security assessment workplan
Section I concentrates on obtaining an
understanding of the operating environment, the
management of specific programs developed as a
part of the Information Security Architecture
6
Security assessment workplan

• Section I contains information such as types and
  numbers of computers, operating systems, methods
  used for remote access, WAN connections, e-mail
  software and number of servers, ISPs with
  approved methods of connection, and all browser
  software approved for use.

7
Security assessment workplan

• Hacker It should be pretty obvious that if this
  information were to get into the hands of a
  hacker it would be the same as rolling out the
  red carpet to your network!

8
Security assessment workplan

• Security Manager (SM) Just as the hacker can use
  this information to take over your network, a SM
  will use this same information to find wholes in
  the security of the network in order to protect
  it.

9
Security assessment workplan
Section II provides an overview of operational
security programs Section III focuses on the
security of computer operations. Separate
workplans are directed at the security of
specific components of the operating environment
networks, applications, databases, and operating
systems.
10
Security assessment workplan

• Questions?