Scribd Logo
Upload

Welcome to Scribd!

  • 4K views

    Vulnerability Assessment Audit Checklist

    Uploaded by

    rajesh35techie
    The document provides a checklist for conducting a vulnerability assessment audit with 10 requirements. It prioritizes assessing high-risk systems and vulnerabilities like the SANS Top 20. It also defines roles and responsibilities for vulnerability management, identifies sources of vulnerability and patch information, and ensures processes for evaluating and installing patches in a timely manner while testing for side effects. The checklist also accounts for alternative controls if patches are unavailable and requires logging and regular reviews of the vulnerability management process.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as XLS, PDF, TXT or read online from Scribd

    Vulnerability Assessment Audit Checklist

    Uploaded by

    rajesh35techie
    4K views2 pages
    The document provides a checklist for conducting a vulnerability assessment audit with 10 requirements. It prioritizes assessing high-risk systems and vulnerabilities like the SANS Top 20. It also defines roles and responsibilities for vulnerability management, identifies sources of vulnerability and patch information, and ensures processes for evaluating and installing patches in a timely manner while testing for side effects. The checklist also accounts for alternative controls if patches are unavailable and requires logging and regular reviews of the vulnerability management process.

    Original Description:

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    XLS, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides a checklist for conducting a vulnerability assessment audit with 10 requirements. It prioritizes assessing high-risk systems and vulnerabilities like the SANS Top 20. It also defines roles and responsibilities for vulnerability management, identifies sources of vulnerability and patch information, and ensures processes for evaluating and installing patches in a timely manner while testing for side effects. The checklist also accounts for alternative controls if patches are unavailable and requires logging and regular reviews of the vulnerability management process.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as XLS, PDF, TXT or read online from Scribd
    Download as xls, pdf, or txt
    4K views2 pages

    Vulnerability Assessment Audit Checklist

    Uploaded by

    rajesh35techie
    The document provides a checklist for conducting a vulnerability assessment audit with 10 requirements. It prioritizes assessing high-risk systems and vulnerabilities like the SANS Top 20. It also defines roles and responsibilities for vulnerability management, identifies sources of vulnerability and patch information, and ensures processes for evaluating and installing patches in a timely manner while testing for side effects. The checklist also accounts for alternative controls if patches are unavailable and requires logging and regular reviews of the vulnerability management process.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as XLS, PDF, TXT or read online from Scribd
    Download as xls, pdf, or txt
    of 2

    Vulnerability Assessment Audit Checklist

    No Requirement Status
    1 Prioritize high-risk systems.
    2 Prioritize high-risk vulnerability. The SANS Top 20 are, by consensus, the most
    common and most often exploited vulnerabilities. They should be dealt with first.
    3 Define roles and responsibilities with respect to vulnerability management, including
    monitoring and identifying (for all of the software and hardware) the vulnerabilities
    and release of patches, risk assessment, identifying the urgency with which the
    patch needs to be deployed, carrying out the actual update (refer to control
    A.12.5.1) and dealing with any coordination. There should be absolute clarity about
    accountability, and individual responsibilities should be clearly written into job
    descriptions.
    4 Identify, for each of the software and other technology items, the relevant source of
    information about vulnerability identification (possibly through Bugtraq or CVE) and
    patch release (usually the vendor website, or through use of an appropriately
    configured automatic update facility), and this information should be regularly
    reviewed and, where necessary, updated.
    5 Ensure that there are set steps, within a predetermined time line (such time line to
    be developed in the light of a process-level risk assessment), for identifying the
    risks of proceeding and of not proceeding with any given patch, for deciding what
    steps should be taken and for implementing that decision – which should usually be
    to install the patch unless there are good reasons not to.
    6 Allow, under certain emergency circumstances, the patch to be installed following
    the incident response process (see Chapter 25) rather than the change
    management one; any such decision should be properly tracked and all the records
    updated appropriately.
    7 Ensure that, where necessary (the risk assessment process drives this), and prior
    to implementation, patches are tested and evaluated to ensure that there are no
    side effects on other systems.
    8 Allow, in circumstances where a patch for an identified vulnerability is not yet
    available or the side effects of implementing it are not acceptable, the organization
    to adopt alternative controls, such as turning off services that are affected by it,
    modifying firewalls or other access controls, increasing user awareness to detect
    and respond to attacks or increased monitoring of activity to identify an attack on
    the vulnerability.
    9 Ensure that there is always an audit log of activity in relation to vulnerability
    management.
    10 Provide for regular monitoring and review of the vulnerability management process,
    not just through the internal audit function to ensure that it is working acc ording to
    specification but also by the information security adviser to ensure that the
    specification remains adequate in the light of the organization’s evolving risk
    assessment and risk treatment plan, in the changing security environment.
    Notes

    You might also like