Managing A Network Vulnerability Assessment

Sample NVA Report 253

1. Analysis of policies, standards, and practices

2. Zero-information-based (ZIB) tests using public information to identify

information assets exposed to the public Internet

3. Top-level analysis from the Internet using a security scanner to identify

exposed information assets more completely, search for backdoors into

the protected network, and expose major vulnerabilities that can be

attacked from the public Internet

4. Use of publicly available cracking tools to obtain a “cracker’s view” of the

exposed devices

5. Focus on individual high-risk devices using a detailed point scanner

6. Analysis of actual system maps and the results of efforts to map the network

from the public Internet

7. Repeat of tests using redundant scanners ...