- [Narrator] When you're ready to begin
a security assessment program, where should you start?
Let's take a look at four common ways
to conduct a security assessment:
baseline reporting, an attack surface review,
code reviews, and architecture reviews.
Baseline reporting is a great way to get started.
Baseline reports provide you with an initial view
of the system's security status.
They are often performed against the organization's
security configuration standard
and are best presented as a gap analysis
that shows the differences
between the system's current configuration
and the security baseline.
Administrators may then work to reconcile those differences
and make security adjustments until the system
matches the desired baseline state.
There are tools to assist with this process.
For Microsoft systems,
the Microsoft Baseline Security Analyzer, or MBSA,
produces gap analysis reports.
Organizations adopting the Center for Internet Security
configuration baselines may use
the center's configuration assessment tool,
a Java-based utility that compares
a system's current configuration to a security baseline.
Attack surface reviews work to identify
what security professionals call the attack surface
of a system.
This simply means that they identify
all possible means of attacking a server or service.
Attack surface reviews make heavy use of scanners,
including port scanners, vulnerability scanners,
and application scanners.
They adopt the mindset of an attacker
seeking possible ways to exploit the system.
Code reviews are critical when an organization
is involved in the creation of custom application code.
These reviews perform both automated
and manual assessments of software security.
Mature organizations integrate peer-based
code review into their software promotion
and release processes.
They also use design reviews
to vet development plans
prior to creating code.
IT systems are complex combinations
of application servers, databases, networks,
storage, and other resources.
Sometimes the way these components fit together
introduces security vulnerabilities.
Architecture reviews take a comprehensive look
at system security from this high level approach,
analyzing how components interact
and how those interactions may introduce
confidentiality, integrity, and availability issues.
Well designed security programs
include a variety of assessment techniques
that overlap and complement each other.
Using baseline reporting, attack surface reviews,
code reviews, and architecture reviews
provides the organization with good insight
into its current security status.