Assessment Objective
Determine if:
- RA-05a.
- RA-05a.[01] systems and hosted applications are monitored for vulnerabilities [Assignment: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
- RA-05a.[02] systems and hosted applications are scanned for vulnerabilities [Assignment: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
- RA-05b. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools;
- RA-05b.01 vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations;
- RA-05b.02 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures;
- RA-05b.03 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact;
- RA-05c. vulnerability scan reports and results from vulnerability monitoring are analyzed;
- RA-05d. legitimate vulnerabilities are remediated [Assignment: response times] in accordance with an organizational assessment of risk;
- RA-05e. information obtained from the vulnerability monitoring process and control assessments is shared with [Assignment: personnel or roles] to help eliminate similar vulnerabilities in other systems;
- RA-05f. vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed.
Assessment Methods
Examine
- Risk assessment policy
- procedures addressing vulnerability scanning
- risk assessment
- assessment report
- vulnerability scanning tools and associated configuration documentation
- vulnerability scanning results
- patch and vulnerability management records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with risk assessment, control assessment, and vulnerability scanning responsibilities
- organizational personnel with vulnerability scan analysis responsibilities
- organizational personnel with vulnerability remediation responsibilities
- organizational personnel with security responsibilities
- system/network administrators
Test
- Organizational processes for vulnerability scanning, analysis, remediation, and information sharing
- mechanisms supporting and/or implementing vulnerability scanning, analysis, remediation, and information sharing
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | RA-05 [H] Vulnerability Monitoring and Scanning |