VULNERABILITY SCANNING AND ANALYSIS SUMMARY This component has the auditor discover possible flaws the organization's devices, services, application designs, and networks by testing and comparing them against a variety of online and offline resources (vulnerability databases, vendor advisories, and auditor investigation) to identify known vulnerabilities. Basic vulnerability analysis should be occurring along-side the other activities so that evidence can be gathered from the network, however, deeper research into specific discovered exploits can happen after the on-site audit to fully take advantage of the short time the auditor has on site. PURPOSE It is not uncommon for a cash-strapped human rights NGO to outsource most of its IT infrastructure to a cloud provider, such as Google Apps, or to ad-hoc services (Dropbox, Yahoo! mail, Wordpress, etc.). A better-resourced organization may be more likely to host its critical services at a remote data center, but not have someone designated to update and patch systems as vulnerabilities are released, or to view the services from a security -as opposed to availability -- standpoint. THE FLOW OF INFORMATION Information Threats Actors Results Activity Threats Actors Capacity Capacity Activities Activities Barriers Barriers Assets Assets Vulnerabilities Vulnerabilities Vulnerability Analysis Information Flow GUIDING QUESTIONS What level of proof do you need to identify to convey the importance (or importance) of a vulnerability to the organization? What would the organization and IT think is an appropriate amount of the IT staffs time that you can request to get the information you need? APPROACHES Vulnerability Scanning: Run vulnerability scans against websites, externally facing servers, and key intranet servers. Explore Vulnerability Databases: Search vulnerability databases for potential risks to systems and software used on servers, user devices, and online services. Examine Service Configuration Files: Examine configuration files for vulnerabilities using "hardening", or "common mistake" guides found online. Page 90 of 240