Assessment Objective
Determine if:
- RA-05(10) the output from vulnerability scanning tools is correlated to determine the presence of multi-vulnerability and multi-hop attack vectors.
Assessment Methods
Examine
- Risk assessment policy
- procedures addressing vulnerability scanning
- risk assessment
- vulnerability scanning tools and techniques documentation
- vulnerability scanning results
- vulnerability management records
- audit records
- event/vulnerability correlation logs
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with vulnerability scanning responsibilities
- organizational personnel with vulnerability scan analysis responsibilities
- organizational personnel with security responsibilities
Test
- Organizational processes for vulnerability scanning
- mechanisms/tools supporting and/or implementing vulnerability scanning
- mechanisms implementing the correlation of vulnerability scan results
Susietos užduotys
| Saito tipas | Užduotis |
|---|---|
| blocks | RA-05(10) Correlate Scanning Information |