Re: mapping vulnerabilities into high medium low risk

thomasng_at_bigfella.is-a-geek.net
Date: 09/18/03

  • Next message: Stamford, Mark: "RE: mapping vulnerabilities into high medium low risk" 
    Date: Thu, 18 Sep 2003 10:22:25 +0800 (SGT)
To: pen-test@securityfocus.com

    Hi All,
    Thanks for all your help.
    From the responses, I guess there alot of overlap of pen-test and risk
    assessment than I thought. I agree that alot of times, you have to
    consider the cost of the compromised information to the customer. However,
    from a technical point of view of a PT, the risk is the same of a root
    exploit present in a system without production data compare to a system
    with production data.

    It is currently my believe that it is the PT Team's job to highlight all
    vulnerabilities discovered and place a value to the technical possibility
    of an attack utilising that vuln. Also place a technical cost (whether
    remote attack possible, whether shell possible, etc) to the vuln. Let's
    call this value "technical risk" out of lack of a better name.

    The "technical risk" should be without consideration to the cost that the
    company
    believes the data is worth within the system. After putting these on
    paper, have another column of "revised risk" for each vuln. This column
    will then be discussed with the management to come out with the final
    revised risk.

    Arrhh.... I just looked through the SP800-30 by NIST. Section 3.7.1
    Risk-Level Matrix. I guess my "technical risk" will be the result of the
    risk-level matrix. This should be the same regardless of which site I PT.
    Then followed by another level of discussion with the management to come
    out with a "revised risk".

    I find that this may be a better approach instead of factoring the cost of
    the system at the begining because many times, the customers comes back
    disagreeing with you on the final result. This is because they have to
    report to higher management and will look bad if they have alot of high
    risks. So we protect outselves by stating the techical risk and there will
    be less argument when it comes to the revised risk. Ultimately, the
    customers will have to justify to higher management on why they alter the
    result in the revised risk... not the PT Team.

    Thanks once again for all your help.

    Thomas

    ---------------------------------------------------------------------------
    FREE Trial!
    New for security consultants and in-house pros: FOUNDSTONE PROFESSIONAL
    and PROFESSIONAL TL software. Fast, reliable vulnerability assessment
    technology powered by the award-winning FoundScan engine. Try it free for 21 days at: http://www.securityfocus.com/sponsor/Foundstone_pen-test_030825
    ----------------------------------------------------------------------------

  • Next message: Stamford, Mark: "RE: mapping vulnerabilities into high medium low risk"

    Relevant Pages

    • Re: Getting Mega Projects Done
      ... I believe that technical risk is ... the proven market for cheaper space launch in ... done to decrease the market risk for the passenger market? ...
      (sci.space.policy)
    • Re: MSNBC - How a safe haven could help save Hubble
      ... risk - keep in mind that once HST dies in 2007-08, ... > that software and use it on all sorts of future missions. ... The schedule is far too tight, and the technical risk far too high, to ...
      (sci.space.policy)
    • Re: Element of Risk
      ... I wasn't expecting really high marks - but a 1.4!!! ... alot of that stuff was very difficult - I guess alot of jugglers think ... into element of risk. ...
      (rec.juggling)
    • Element of Risk
      ... I wasn't expecting really high marks - but a 1.4!!! ... alot of that stuff was very difficult - I guess alot of jugglers think you ... into element of risk. ...
      (rec.juggling)
    • Re: mapping vulnerabilities into high medium low risk
      ... > risk assessment than I thought. ... I agree that alot of times, ... introduction to risk assessment and assessment strategies I've seen ... technology powered by the award-winning FoundScan engine. ...
      (Pen-Test)