+Penetration Testing
|
Penetration Testing
Description
Mechanisms exist to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Annual external vulnerability scan; penetration test when required by customers/contracts
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Annual penetration test by qualified tester
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Annual penetration test by qualified third-party tester
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Enterprise penetration testing program
∙ Annual external and internal pen tests
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise penetration testing program
∙ Annual and event-driven pen tests
∙ Red team exercises
∙ Purple teaming
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Vulnerability & Patch Management (VPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with VPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Attack Surface Management (ASM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
Level 2 Planned Tracked
Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel, or contracted professionals, conduct annual penetration testing on network segments hosting High Value Assets (HVAs).
Level 3 Well Defined
Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.
▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution and vulnerability scanning solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct penetration testing on Technology Assets, Applications and/or Services (TAAS).
Level 4 Quantitatively Controlled
Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
|
EULAW
|
Artikolu 27 Format u kontenut tar-rapport dwar ir-rieżami tal-qafas tal-ġestjoni tar-riskju tal-ICT
-
|
|
EULAW
|
Artikolu 26 Ittestjar avvanzat tal-għodod, sistemi u proċessi tal-ICT ibbażat fuq it-TLPT
-
|
|
EULAW
|
Artikolu 26 1
1. L-entitajiet finanzjarji, għajr l-entitajiet imsemmija fl-Artikolu 16(1), l-ewwel subparagrafu, u għajr il-mikrointrapriżi, li huma identifikati f’konformità mal-paragrafu 8, it-tielet subparagrafu, ta’ dan l-Artikolu, għandhom iwettqu, mill-inqas kull tliet snin, ittestjar avvanzat permezz tat-TLPT. Abbażi tal-profil tar-riskju tal-entità finanzjarja u b’kont meħud taċ-ċirkostanzi operazzjonali, l-awtorità kompetenti tista’, fejn neċessarju, titlob lill-entità finanzjarja biex tnaqqas jew iżżid din il-frekwenza.
|
|
EULAW
|
Artikolu 26 2
2. Kull test tal-penetrazzjoni bbażat fuq it-theddid għandu jkopri diversi funzjonijiet kritiċi jew importanti ta’ entità finanzjarja, jew ikoprihom kollha, u għandu jitwettaq fuq sistemi ta’ produzzjoni li jkunu qed jappoġġjaw tali funzjonijiet.
L-entitajiet finanzjarji għandhom jidentifikaw is-sistemi, il-proċessi u t-teknoloġiji sottostanti rilevanti kollha tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti u s-servizzi rilevanti kollha tal-ICT, inkluż dawk li jappoġġjaw il-funzjonijiet kritiċi jew importanti u servizzi li ġew esternalizzati jew ikkuntrattati lil fornituri terzi ta’ servizzi tal-ICT.
L-entitajiet finanzjarji għandhom jivvalutaw liema funzjonijiet kritiċi jew importanti jeħtieġ li jiġu koperti mit-TLPT. Ir-riżultat ta’ din il-valutazzjoni għandu jiddetermina l-ambitu preċiż tat-TLPT u għandu jiġi vvalidat mill-awtoritajiet kompetenti.
|
|
EULAW
|
Artikolu 26 3
3. Meta l-fornituri terzi ta’ servizzi tal-ICT ikunu inklużi fl-ambitu tat-TLPT, l-entità finanzjarja għandha tieħu l-miżuri u s-salvagwardji meħtieġa biex tiżgura l-parteċipazzjoni ta’ fornituri terzi ta’ servizzi tal-ICT bħal dawn fit-TLPT u għandha dejjem iżżomm ir-responsabbiltà sħiħa li tiżgura l-konformità ma’ dan ir-Regolament.
|
|
EULAW
|
Artikolu 26 4
4. Mingħajr preġudizzju għall-paragrafu 2, l-ewwel u t-tieni subparagrafi, meta l-parteċipazzjoni ta’ fornitur terz ta’ servizzi tal-ICT fit-TLPT, imsemmi fil-paragrafu 3, tkun raġonevolment mistennija li jkollha impatt negattiv fuq il-kwalità jew is-sigurtà tas-servizzi mogħtija minn fornitur terz ta’ servizz tal-ICT lill-konsumaturi li jkunu entitajiet barra mill-kamp ta’ applikazzjoni ta’ dan ir-Regolament, jew fuq il-kunfidenzjalità tad-data marbuta ma’ servizzi bħal dawn, l-entità finanzjarja u l-fornitur terz ta’ servizzi tal-ICT jistgħu jaqblu bil-miktub li l-fornitur terz ta’ servizzi tal-ICT jidħol direttament f’arranġamenti kuntrattwali ma’ tester estern, għall-fini li jwettaq, taħt id-direzzjoni ta’ entità finanzjarja waħda ddeżinjata, TLPT aggregat li jinvolvi diversi entitajiet finanzjarji (ittestjar aggregat) li għaliha l-fornitur terz ta’ servizzi tal-ICT jipprovdi servizzi tal-ICT.
Dak l-ittestjar aggregat għandu jkopri l-firxa rilevanti ta’ servizzi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti kkuntrattati lill-fornitur terz rispettiv ta’ servizzi tal-ICT mill-entitajiet finanzjarji. L-ittestjar aggregat għandu jitqies bħala TLPT imwettaq mill-entitajiet finanzjarji parteċipanti fl-ittestjar aggregat.
L-għadd ta’ entitajiet finanzjarji parteċipanti fl-ittestjar aggregat għandu jiġi kkalibrat kif xieraq b’kont meħud tal-kumplessità u t-tipi ta’ servizzi involuti.
|
|
EULAW
|
Artikolu 26 5
5. L-entitajiet finanzjarji għandhom, bil-kooperazzjoni tal-fornituri terzi ta’ servizzi tal-ICT u partijiet oħra involuti, inkluż it-testers iżda eskluż l-awtoritajiet kompetenti, japplikaw kontrolli effettivi ta’ ġestjoni tar-riskju sabiex inaqqsu ir-riskji ta’ kwalunkwe impatt potenzjali fuq id-data, ħsara lill-assi, u tfixkil ta’ funzjonijiet, servizzi jew operazzjonijiet kritiċi jew importanti fl-entità finanzjarja stess, il-kontropartijiet tagħha jew is-settur finanzjarju.
|
|
EULAW
|
Artikolu 26 6
6. Fi tmiem l-ittestjar, wara li jkunu ġew miftiehma r-rapporti u l-pjanijiet ta’ rimedju, l-entità finanzjarja u, fejn applikabbli, it-testers esterni għandhom jipprovdu lill-awtorità, iddeżinjata skont il-paragrafu 9 jew 10, sommarju tas-sejbiet rilevanti, il-pjanijiet ta’ rimedju u d-dokumentazzjoni li turi li t-TLPT twettaq skont ir-rekwiżiti.
|
|
EULAW
|
Artikolu 26 7
7. L-awtoritajiet għandhom jipprovdu lill-entitajiet finanzjarji b’attestazzjoni li tikkonferma li t-test twettaq f’konformità mar-rekwiżiti kif tixhed id-dokumentazzjoni sabiex ikun jista’ jsir rikonoxximent reċiproku tat-testijiet tal-penetrazzjoni bbażat fuq it-theddid bejn l-awtoritajiet kompetenti. L-entità finanzjarja għandha tinnotifika lill-awtorità kompetenti rilevanti bl-attestazzjoni, is-sommarju tas-sejbiet rilevanti u l-pjanijiet ta’ rimedju.
Mingħajr preġudizzju għal tali attestazzjoni, l-entitajiet finanzjarji għandhom f’kull ħin jibqgħu kompletament responsabbli għall-impatt tat-testijiet imsemmija fil-paragrafu 4.
|
|
EULAW
|
Artikolu 26 8
8. L-entitajiet finanzjarji għandhom jikkuntrattaw testers biex iwettqu t-TLPT f’konformità mal-Artikolu 27. Meta l-entitajiet finanzjarji jużaw testers interni biex iwettqu t-TLPT, huma għandhom jikkuntrattaw testers estern għal kull tliet testijiet.
L-istituzzjonijiet ta’ kreditu li huma kklassifikati bħala sinifikanti f’konformità mal-Artikolu 6(4) tar-Regolament (UE) Nru 1024/2013, għandhom jużaw biss testers esterni f’konformità mal-Artikolu 27(1), il-punti (a) sa (e).
L-awtoritajiet kompetenti għandhom jidentifikaw l-entitajiet finanzjarji li huma meħtieġa jwettqu TLPT waqt li jqisu l-kriterji stabbiliti fl-Artikolu 4(2), abbażi ta’ valutazzjoni ta’ dawn li ġejjin:
|
(a)
|
fatturi relatati mal-impatt, b’mod partikolari safejn is-servizzi pprovduti u l-attivitajiet imwettqa mill-entità finanzjarja jimpattaw is-settur finanzjarju;
|
|
(b)
|
it-tħassib possibbli dwar l-istabbiltà finanzjarja, inkluż il-karattru sistemiku tal-entità finanzjarja fil-livell tal-Unjoni jew dak nazzjonali, kif applikabbli;
|
|
(c)
|
il-profil speċifiku tar-riskju tal-ICT, il-livell ta’ maturità tal-ICT tal-entità finanzjarja jew il-karatteristiċi tat-teknoloġija involuti.
|
|
Kwistjonijiet marbuta
- Secure Controls Framework -
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/
Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.
|