ACP 122 (F) - Multilateral Planners Conference

UNCLASSIFIED
ACP 122(F)
VA ACTIVITY LEVELS
606. Within the CCEB context, VA activities are categorised into four incremental levels of
effort:
a. VA Level 1 – Primary Investigation. Identify and validate all system and
connected network elements, analyse topology and locate obvious vulnerabilities
and/or initial entry points;
b. VA Level 2 - Vulnerability Sweep. Exploit vulnerabilities discovered during VA
Level 1, gaining basic access to accounts, and attempt to crack passwords;
c. VA Level 3 - Security Sweep. Exploit vulnerabilities for greater access, exploit
trusted relationships, exploit new vulnerabilities; and
d. VA Level 4 – Stress Testing. Test the system to ensure resilience to denial of
service (DoS) attacks. VA4 must be authorised by the Security Authority (SA), in
consultation with the operational and business sponsors, and will normally only be
appropriate for Mission Critical systems.
ACTIVE VULNERABILITY ASSESSMENT
607. In addition to vulnerability analysis to identify and correct CIS vulnerabilities, there is
also a requirement to provide an independent capability to assess vulnerabilities and improve
defences.
608. The main aim of the assessment is to help system administrators and ISSOs ensure the
security of their networks. It may involve penetration testing and instruction of relevant staff on
how to recognise CIS events and determine the appropriate actions required to respond to those
events. To ensure the validity of these assessments, it may be desirable to exclude system
administrators and ISSOs from prior knowledge of the exercise.
609. Each nation will conduct the assessment on their own systems in accordance with their
own national policies and procedures and undertake to remediate any detected vulnerabilities as
soon as practicable.
610. In the multinational environment, assessments may be conducted at the request of the
operational authority for the multinational environment. Policies and procedures with respect to
VA in multinational environments will be delineated in the applicable System Security Policy
(SSP).
VULNERABILITY ASSESSMENT
611. Vulnerability assessment shall not be limited to technical vulnerability analysis.
Vulnerability assessment shall be part of an operational evaluation of a unit/formation and
should include (but not be limited to):
6-5 Original
UNCLASSIFIED
(Reverse Blank)