USER DEVICE ASSESSMENT SUMMARY This component allows the auditor to assess the security of the individual devices on the network. This component consists of interviews, surveys, and inspection of devices. PURPOSE Compromised devices have the ability to undermine nearly any other organizational attempt at securing information. Knowing if devices receive basic software and security upgrades and what core protections against unauthorized access exist is vital to designing a strategy to make the host more secure. THE FLOW OF INFORMATION Information Threats Actors Results Activity Threats Actors Capacity Capacity Activities Activities Barriers Barriers Assets Assets Vulnerabilities Vulnerabilities User Device Assessment Information Flow GUIDING QUESTIONS What work and personal devices do staff use to accomplish their work, store work related files, or engage in work communications? What organizational and external/personal services do staff use to accomplish their work, store work related files, or engage in work communications? What are the organizational processes that staff take part in and the tools and communication channels that are used in those process'? What are the existing in/formal security practices that the participants use to address risks. APPROACHES Conduct a Hands on Device Interview/Audit: Inspect and record information on user devices (work & personal) for security concerns (patch levels, user privileges, drive encryption, ports/services running, anti-virus capabilities) Password User Survey: Have staff take the password use survey for ALL devices used for work. 44,45 A Day In the Life:Have staff walk you through a usual "day in their life" showing you what devices they use, how they use them, and what data they have to interact with to conduct their work. Page 69 of 240