In my last role with my ex-employer when my manager asked me to develop security assessment service. I made some Google search and I found the best way is to establish a framework, also because working under a formal process model make the task easy and development after that efficient,. I found the NSA developed INFOSEC Assessment Methodology (IAM). I started to read more about it and I found a brilliant book which helped me a lot from Syngress which is “Security Assessment: Case Studies for Implementing the NSA IAM”. After that I started to use these resources to start to build our Security Assessment framework and I have just decided to share this information with my peers who interested in IT Security. Here is what I got.
Let’s assume we are going to make security assessment for company called “XYZ”
Introduction
XYZ company network may expose vulnerabilities to attackers in many ways. A key area is information exposure. Many details about XYZ Company that an attacker can gather can be used to assist in an attack. This includes technical data, such as what public services XYZ company offer, as well as Non-technical items, such as who your business partners are. The next area of importance is connectivity. Can attackers send and receive information to the systems within XYZ company network? This is dominated by the impact XYZ company s’ firewalls (and filtering routers) have on connectivity into XYZ company network, but it can also be affected by the controls XYZ company have in place to allow workstations and notebook computers to connect to XYZ company internal network. The last major area that needs to be examined is whether the services XYZ company network relies on contain exploitable vulnerabilities.
The roadmap for making security assessment consists of the following core phases with corresponding deliverables:
Planning
Determine the scope of our assessment at XYZ Company. Decide how we will conduct it. Develop written rules of engagement to control the assessment and, most important, gain proper written approval to perform it. Assemble our toolkit to perform the assessment.
Reconnaissance
Obtain technical and non-technical information on the XYZ Company and known public hosts, such as mail, web, and DNS servers…etc.
Network service discovery
Determine which hosts and network devices at XYZ Company can be accessed from the outside. For each of these systems, determine what services are running on them.
Vulnerability discovery
Probe externally accessible systems and remote services to determine whether they expose known vulnerabilities to the outside. Analyze initial results to eliminate false positives.
Verification of perimeter devices
Evaluate firewall and router configurations at XYZ Company to ensure that they are well configured. Verify that firewalls at XYZ Company do not pass traffic that should be blocked. Verify that anti-discovery and anti-DoS controls are in place and work as expected at XYZ Company. Test intrusion detection/prevention sensors to ensure that they detect, log, and alert on suspicious activity.
Remote access
Verify security controls of known remote access systems, including remote access servers, wireless access points, and VPNs. Search for unauthorized (rogue) modems and wireless access points at XYZ Company.
Exploitation (optional)
Attempt to use exploitation techniques against the discovered vulnerabilities. Based on the goals of the test, this may be an iterative activity. Successful exploitation may lead to additional access on the network, which may open the opportunity up for further exploitation.
Results analysis and documentation
Analyze discovered vulnerabilities to determine their overall effect on the level of risk to the network's security at XYZ Company. This is normally based on the vulnerabilities' impact to the affected system, the criticality of the system, the likelihood that the vulnerabilities will be exploited, and the effort required to remediate the vulnerabilities. Produce an assessment report that provides a list of prioritized vulnerabilities by level of risk and provides recommended steps to resolve the individual and root causes for the vulnerabilities.
Recommendations
A final report will be compiled with recommendations and possible solution to be implemented at XYZ Company to leverage security and/or defend against breaches.
Reference: NSA & Syngress
