Pre-site Inspection Checklist

Basically an audit of a system carried out against a known criterion. A compliance test may come in many different forms dependant on the request received but basically can be broken down into several different types: Operating Systems and Applications: A verification that an operating system and/or applications are configured appropriately to the companies needs and lockdown requirements, thus providing adequate and robust controls to ensure that the Confidentiality, Integrity and Availability of the system will not be affected in its normal day to day operation. Systems in development: A verification that the intended system under development meets the configuration and lockdown standards requested by the customer. Management of IT and Enterprise Architecture: A verification that the in-place IT management infrastructure encompassing all aspects of system support has been put in place. This is to ensure effective change control, audit, business continuity and security procedures etc. have been formulated, documented and put in place. Interconnection Policy: A verification that adequate security and business continuity controls governing the connection to other systems, be they Telecommunications, Intranets, Extranets and Internet etc. have been put in place, have been fully documented and correspond to the stated customer requirements.

Vulnerability assessment is a process of identifying and analysing a system or network for any potential vulnerabilties, flaws or weaknesses that could leave it open to exploitation.

A Penetration Test is essentially an evaluation of a system or networks current state of security and its likelihood to be susceptible to a successful attack by a malicious hacker or nefarious user. The process involves enumeration and scanning for any technical flaws or vulnerabilities. After such flaws are found, attempts are then made to penetrate inside the network and gain a foothold. Once this has been established, attempts are then made to utilise trusts and relationships to gain further ingress into the domain.

Start of test - This is important for a Compliance test as previous failings can immediately be re-tested and verified as secured or still vulnerable to exploit etc.

During test

End of test

Start of test

During test

End of test

This can be important during a vulnerability assessment as it can be used as a guide of how the network has progressed during the time of the last test to the current period. Release of this by the customer may not be in there best interests as it is best to have an independant team to assess all vulnerabilties. The customer can then also assess the overall performance of the testing team and thus its value for money in conducting the test.

Start of test

During test

End of test

Appropriate comment to be made in final report reference receipt of these documents and at what point during the test. This provides mitigation points as the information gained is privileged and was used to gain an unfair advantage in potentially accessing the network. Obviously if the documents were made available after the test, the less weight would be stressed in the final report as they would only be used for reference. This can severly disadvantage the customer as they are potentially disclosing exploitable holes within their network infrastructure. An opposite point of view is the fact that the testing team will verify any fixes that have taken place or that the exploitable hole still exists and still needs attention to mitigate or close. From the customer perspective if an exploitable hole is not discovered it can give an indication that the exploit could possibly be risk assessed and managed.