ISSAF

ISSAF

1. overview

   • information systems security assessment framework
   • objectives
     • end to end references for security assessment
     • standardize infosys security assessment process
     • set minimal level of acceptable processes
     • baseline for which an assessment should be performed
     • assess safeguards deployed against unauthorized access
     • act as a reference for infosec implementation
     • strengthen existing security processes and technology

2. 1. planning and preparation

   • exchange information
   • plan and prepare for test
   • sign formal agreement
     • mutual legal protection
     • approach & methodology
     • identified test cases
     • escalation paths
     • contact individuals

3. 2. assessment

   • layers
     • information gathering
     • vulnerability identification
     • penetration
     • gaining access and privilege escalation
     • enumeration further
     • compromising remote users / sites
     • maintaining access
     • covering tracks
     • network mapping
   • targets
     • networks
     • hosts
     • applications & dbs

4. 3. reporting, cleanup, destroy artifacts

   • final report
     • mgt summary
     • project scope
     • tools & exploits used
     • dates & times of tests
     • output of performed tests
     • vulnerabilities list
     • recommendations how to solve
     • action points
   • clean up and destroy artifacts
     • list any that can't be removed in final report