Day 2 - Revision history

Gabrielgumbs at 22:43, 5 January 2015

2015-01-05T22:43:36Z

Gabrielgumbs at 22:26, 5 January 2015

2015-01-05T22:26:38Z

Rsnake at 17:28, 15 December 2014

2014-12-15T17:28:40Z

Rsnake at 17:28, 15 December 2014

2014-12-15T17:28:08Z

Rsnake at 17:27, 15 December 2014

2014-12-15T17:27:51Z

Rsnake: Created page with "== Key Activities == Become intimately familiar with what you are meant to protect and at what level. Define processes, procedures, and checklists to align assessment strate..."

2014-12-15T17:26:18Z

Created page with "== Key Activities == *Become intimately familiar with what you are meant to protect and at what level. *Define processes, procedures, and checklists to align assessment strate..."

New page

== Key Activities ==
*Become intimately familiar with what you are meant to protect and at what level.
*Define processes, procedures, and checklists to align assessment strategies to business needs.
*Effectively communicate the introduction and goals of the Application Security assessment program.
*Provide a single point of contact for the program.

== Asset Discovery ==
*Gather Internal, External and Hosted IP ranges.
*Catalogue known domains and subdomains.
*Identify asset meta-data locations. (CMDBs, GRCs, etc.).
*Identify site owners, where those are not already known.
*Gather assessment credentials, including multiple roles for horizontal and vertical testing.
*Identify the rate of application change (e.g. monthly, weekly, etc.…)

== Asset Risk Prioritization ==
*Develop or leverage existing methodology for stack ranking the value of your assets to the business based on
impact to confidentiality, integrity and availability (C.I.A.). (See: [http://csrc.nist.gov/publications/fips/fips199/FIPSPUB-199-final.pdf])

POTENTIAL IMPACT

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!SECURITY OBJECTIVE
!LOW
!MODERATE
!HIGH
|-
|Confidentiality
Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
|The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Integrity
Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation
and authenticity. [44 U.S.C., SEC. 3542]
|The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Availability
Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
|The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|}

*Map asset criticality against attacker profiles with use of a GRC* (Governance Risk Management and Compliance)
tool if available, or using an information asset register such as the University of Oxford Information Asset Register
Tool

For example:
*Tier 1 = Targeted Govt./State sponsor.
*Tier 2 = Hactivism
*Tier 3 = Random Opportunistic

*Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.

== Communication Plan ==
*Set expectations of assessment program for all interested parties.
*Alert Operations team of upcoming activities.
*Gather written buy-in from application stakeholders for the assessment activities.
*Develop, publish, and maintain comprehensive application security and privacy standards, policies, procedures and
guidelines and enforce these in compliance with relevant global regulations and standards.
*Define, document and share application business continuity and incident response plan. (Business Continuity Plan Resources: ITIL, COBIT, NIST)

@@ Line 51: / Line 51: @@
 For example:
-**Tier 1 = Targeted Govt./State sponsor.
+#Tier 1 = Targeted Govt./State sponsor.
-**Tier 2 = Hactivism
+#Tier 2 = Hactivism
-**Tier 3 = Random Opportunistic
+#Tier 3 = Random Opportunistic
 *Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.

@@ Line 1: / Line 1: @@
 == Key Activities ==
 *Become intimately familiar with what you are meant to protect and at what level.
@@ Line 66: / Line 69: @@
 *Develop, publish, and maintain comprehensive application security and privacy standards, policies, procedures and guidelines and enforce these in compliance with relevant global regulations and standards.
 *Define, document and share application business continuity and incident response plan. (Business Continuity Plan Resources: ITIL, COBIT, NIST)

@@ Line 5: / Line 5: @@
 *Provide a single point of contact for the program.
 == Asset Discovery ==
 *Gather Internal, External and Hosted IP ranges.
@@ Line 13: / Line 14: @@
 *Identify the rate of application change (e.g. monthly, weekly, etc.…)
 == Asset Risk Prioritization ==
 *Develop or leverage existing methodology for stack ranking the value of your assets to the business based on
@@ Line 57: / Line 59: @@
 *Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.
 == Communication Plan ==
 *Set expectations of assessment program for all interested parties.

@@ Line 48: / Line 48: @@
 |}
-*Map asset criticality against attacker profiles with use of a GRC* (Governance Risk Management and Compliance) tool if available, or using an information asset register such as the University of Oxford Information Asset Register Tool
+*Map asset criticality against attacker profiles with use of a GRC (Governance Risk Management and Compliance) tool if available, or using an information asset register such as the University of Oxford Information Asset Register Tool
 For example:

Day 2 - Revision history

Gabrielgumbs at 22:43, 5 January 2015

Gabrielgumbs at 22:26, 5 January 2015

Rsnake at 17:28, 15 December 2014

Rsnake at 17:28, 15 December 2014

Rsnake at 17:27, 15 December 2014

Rsnake: Created page with "== Key Activities == *Become intimately familiar with what you are meant to protect and at what level. *Define processes, procedures, and checklists to align assessment strate..."

Rsnake: Created page with "== Key Activities == Become intimately familiar with what you are meant to protect and at what level. Define processes, procedures, and checklists to align assessment strate..."