Network Vulnerability Assessment

Suitable time frame and testing hours

Some security compliance demands periodic vulnerability assessments over the infrastructure in scope. For example, PCI/DSS demands a half-yearly vulnerability assessment for business-critical assets and yearly for noncritical assets that are covered under the scope of the PCI/DSS certification.

The tester and customer need to keep such compliance-driven requirements in mind while preparing the schedule for an assessment. At the same time, it's always beneficial to consider ongoing and critical changes in an environment that is part of the assessment scope. If the time frame enforced by the security compliance permits it, it's best to perform the assessment after completing critical changes, which will ...