OUTPUTS List of all assets in the organization and whom they belong to. List of software running on staff devices. List of known vulnerabilities, and identifiable malware, that the office is vulnerable to. List of malware found by running updated anti-virus on office computers (if anti-virus installed during device inspection.) OPERATIONAL SECURITY Treat device assessment data as well as any additional service information learned with the utmost security PREPARATION Baseline Skills Basic systems administration experience for common operating systems RESOURCES Guidelines: "Guidelines on Firewalls and Firewall Policy" (NIST 800-41) Benchmarks: "Security Configuration Benchmarks" (CIS Security Benchmarks) Repository: "National Checklist Program Repository - Prose security checklists" (National Vulnerability Database) Security Guidance: "Operating Systems Security Guidance" (NSA) Password Security Guide: "How to Teach Humans to Remember Really Complex Passwords" (Wired) Guide: "Security on Passwords and User Awareness" (HashTag Security) Video: "What’s wrong with your pa$$w0rd?" (TED) Article: "Password Security: Why the horse battery staple is not correct" (Diogo Mónica) Organization: "Passwords Research" (The CyLab Usable Privacy and Security Laboratory (CUPS)) Privilege Separation Across OS identify what privileges services are running as identify is the admin user is called admin or root Identify if users are logging in and installing software as admin. Page 70 of 240