-: To properly understand the risk
to our network and our systems,
it's important that we conduct
a proper security assessment.
What is a security assessment?
Well, there's many different types
of security assessments that are used
by an organization to protect their enterprise networks.
And these security assessments verify
that the organization's security posture
is designed and configured properly,
to help thwart all those different types
of attacks and threats that are out there.
These security assessments include
vulnerability assessments, penetration testing,
internal and external audits, self-assessments,
password analysis, and many other types.
Each type of assessment is going to serve
a different purpose and provide you with a unique
perspective on the security posture of your network.
For example, a vulnerability management scan
might look across your entire enterprise network
to find vulnerabilities using a fully credentialed
and authorized scan from within your network.
On the other hand, a penetration test
may be conducted from outside your network,
providing you with a uniquely different viewpoint
of your network, that same viewpoint that
a potential attacker's going to have when they're
trying to attack you over the internet.
These assessments may be conducted as part
of your overall risk analysis process,
or you may conduct them due to some contractual,
legal, or regulatory requirements.
For example, if you're part of the federal government,
you have to follow the Federal Information
Systems Management Act, or FISMA.
It's part of the laws and regulations.
These assessments might also be required
under a contractual obligation that
your organization is a part of.
For example, if you take credit cards,
you fall under the Payment Card Industry
Digital Security Standard, known as PCIDSS.
Now, either way, you're going to have to figure out
which assessments meet the goals you need.
And it's your job as a security professional
to help your organization do that.
Now, there are two main types of methodologies
that are used in these assessments.
There's active and passive.
Active assessments utilize a more intrusive technique,
more things like scanning and hands-on testing,
and probing your network to determine
what vulnerabilities might exist.
This can actually result in your networks
or servers being forced offline
if you're too aggressive in your active scans.
Now, a passive assessment on the other hand,
utilizes open source information,
the passive collection and analysis of network data,
and other unobtrusive methods without ever making
direct contact with the targeted networker systems.
We do this to identify the open ports on the network,
the services and software being run,
and other types of similar information.
And here's the key, without ever making direct contact
with the networker systems themselves.
Now, normally you're not going to choose to do
something strictly active or strictly passive.
But you're going to start with a more passive posture,
and then move into a more active posture
as you continue to need more and detailed information.
Passive techniques have a limit to the amount of information
and the type of information that you can learn.
But active techniques really do a great job
of learning about all the details
and the system weaknesses
and the vulnerabilities that exist.