Re: Sample Risk Assessment Report

infosecgod_at_gmail.com
Date: 01/14/05

  • Next message: Faisal Khan: "DoS/DDoS Attack" 
    Date: 14 Jan 2005 00:51:58 -0000
To: pen-test@securityfocus.com
    ('binary' encoding is not supported, stored as-is) In-Reply-To: <9E97F0997FB84D42B221B9FB203EFA276E9563@dc1ms2.msad.brookshires.net>

    >If you use some Google hacking you can find security scan reports. =3D)
    >Not exactly what you want..but
    >
    >Nessus
    >http://www.computec.ch/dokumente/windows/sicherheit_von_windows/2-scanni
    >ng/nessus-report.html
    >http://mrcorp.infosecwriters.com/os_scan/xpscan/default/default.html
    >http://www.rit.edu/~wjh3710/pub/old.html
    >http://www.kefk.net/Admin/Nessus/kefk_net/
    >

    It is important to understand the difference between a vulnerability scanner report - which these are - and what has been requested - a risk assessment report.

    This is one of the main reasons why security has gotten a bad name for itself in the corporate world - IT/security managers do not want to see another list of things they need to do (fix). A risk assessment takes the information delivered by the scanners and other testing techniques and provides understanding of the scanning results within the context of business risks. This means that using Nessus/ISS/eEYE results do NOT equal risk assessment. These tools are important parts of the risk assessment process but do not represent risk assessment.

    Risk assessments assign values to IT assets and use these values to understand risk within a business context. A better area to look would be at the risk methodologies themselves such as –

    http://www.security-risk-analysis.com/
    http://www.cert.org/octave/
    http://www.riskworld.net/

    are good places to start

    J/

  • Next message: Faisal Khan: "DoS/DDoS Attack"

    Relevant Pages

    • WSJ: Fed Grapples With a New Risk Reality
      ... Fed Grapples With a New Risk Reality ... Balance Sheet Swells From the Assets Accumulated on a Rescue Tour ... was used to buy mortgage-related securities and loans in the rescues ...
      (misc.invest.stocks)
    • Re: Health and Safety Advisor
      ... it's responisbilities towards risk assessments and documenting safe ... could bog you down in paperwork till the cows come home. ... Pioneering is a construction skill. ...
      (uk.rec.scouting)
    • RE: Sample Risk Assessment Report
      ... I am confused by your definition of assets scure. ... I agree that business risks differ from technical risks; ... I cannot discuss methodology in detail, but I can say that threat risk ... Subject: Sample Risk Assessment Report ...
      (Pen-Test)
    • Re: What would the Tories have done?
      ... rate lending could only be funded through short term borrowings ... work well in a mortgage bank if there is only one type of asset: ... In practice banks hold assets with fixed and variable rates ... their risk adjusted assets. ...
      (uk.politics.misc)
    • Re: Leave bank shareholders with nothing, or they can bail themselves out
      ... Nationalizing the banks would indeed wipe out investors. ... Confessions of a risk manager ... and sovereign-wealth funds were all looking to invest in assets. ... from my own risk managers forewarning me that a senior trader was about to ...
      (misc.news.internet.discuss)