OUTPUTS Lists of OVAL/CVE identifiers for each possibly vulnerable service/system. Examples of live exploits for vulnerabilities where possible. A short write up of each vulnerability including how it was identified. The cleaned up output from any tests used to identify the vulnerability. Document Vulnerabilities (per vulnerability) Write Up Summary - A short (two to three sentence) basic overview of the vulnerability. Description - An in-depth (one to three paragraph) overview of the vulnerability. Approach - Step-by-step explanation of the methodology used that is tool agnostic. Proof - The cleaned up output from tests run to identify the vulnerability. OPERATIONAL SECURITY Treat the data and analyses of this step with the utmost security. Use VPNs or Tor to search if scanning remotely. Seek explicit permission for vulnerability scanning - NOTE: The organization might not be in a position to give you meaningful “permission” to carry out an active remote assessment of "cloud services" used within the organization. In situations where the auditor is doing this work remotely it is important to only run "safe" tests that have no possibility of causing damage to the network. PREPARATION Baseline Skills Vulnerability Scanning: : General TCP/IP and networking knowledge; knowledge of ports, protocols, services, and vulnerabilities for a variety of operating systems; ability to use automated vulnerability scanning tools and interpret/analyze the results Penetration Testing: Extensive TCP/IP, networking, and OS knowledge; advanced knowledge of network and system vulnerabilities and exploits; knowledge of techniques to evade security detection RESOURCES Standard: "Vulnerability Analysis - Research Phase" (Penetration Testing Execution Standard) Framework: "Vulnerability Assessment" (http://www.vulnerabilityassessment.co.uk) Resource: Vulnerability Databases (SAFETAG) Page 91 of 240