Editor's note

Resource
• http://www.iso.org/iso/home.html [1]
• http://www.iec.ch/ [2]
• http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=42103 [3]
• https://www.isaca.org/Pages/default.aspx [4]
• http://www.isaca.org/Knowledge-Center/cobit/Pages/Downloads.aspx [5]
• http://csrc.nist.gov/ [6]
• http://csrc.nist.gov/publications/ps/ps199/FIPS-PUB-199-nal.pdf [7]
• http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-nal_updated-errata_05-01-2010.pdf [8]
• http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-nal.pdf [9]
• http://csrc.nist.gov/publications/nistpubs/800-70-rev2/SP800-70-rev2.pdf [10]
• http://web.nvd.nist.gov/view/ncp/repository [11]
• http://csrc.nist.gov/publications/nistpubs/800-53A-rev1/sp800-53A-rev1-nal.pdf [12]
The actual assessment begins with a set of
determination statements that related to the security
controls implemented from the catalog in NIST SP800-
53. An individual control listed in NIST SP800-53 may
have multiple assessment objectives listed for the
control in NIST SP800-53A.
For example, NIST SP800-53 provides control AC-
1 Access Control Policies and Procedures. NIST
SP800-53A has two control objectives listed: AC-1.1
and AC-1.2. NIST SP800-53A assessment objective
AC-1.1 determines if the policy and procedures exist,
contain certain key items, distributes the policy,
develops procedures, and distributes the procedures
to the appropriate staff. Control objective AC-1.2
determines if the policies and procedures have a
defined update schedule and the organization actually
updates the policies and procedures according to the
schedule.
The output of the security control assessment is the
security assessment report. The security assessment
report details the items tested and documents the results
to provide evidence for each finding. For each item a
rating of either satisfied (S) or other than satisfied (O).
The organization may wish to have a summary report
that provides the highlights of the report, a synopsis of
key findings, and recommendations for addressing the
deficiencies.
The security assessment report will need to be
reviewed by senior management. Management may
determine that certain items present a lower or higher
risk than indicated in the controls assessments and
risk assessments based on the organization mission
and the operational environment. Items that should
be addressed are used to create a plan of actions
and milestones (POAM) that management can use to
direct remediation efforts. After management review,
the system security plan and risk assessment should
be updated accordingly. It should be noted that some
risk will remain after the implementation of controls.
This residual risk may be accepted by management
starterkit 02/2011(2)
or transferred to others through actions such as
obtaining insurance policies.
The risk management cycle is a continuous process.
After these steps have been completed, the results
should be used as a starting point for a new risk
management cycle. The risk management framework
can be adapted to the individual requirements of the
organization. Since technologies and threats evolve
over time, the risk management cycle should be
repeated at regular intervals. The process can be used
for new systems under development to ensure proper
control selection or it can be applied to existing system
to perform a gap analysis to evaluate current controls
with the desired state.
BART HOPPER
Bart Hopper has earned numerous certications during
his 18 years as an information technology professional.
His certications cover the areas of information security,
Windows administration, Unix administration, and database
administration. He lives in Nashville, Tennessee.
Page 39 http://pentestmag.com