Download Guideline on Network Security Testing

DRAFT GUIDE TO NETWORK SELF-TEST
ing:
!
Developing and implementing standard operating procedures (security policy)
!
Complying with security policies, standards and requirements
!
Ensure that critical systems are identified and scheduled for periodic testing according to the security policy requirements of each respective system
Information Systems Security Officers
Information Systems Security Officers (ISSOs) are responsible for overseeing all aspects of
information security within a specific organizational entity. They ensure that the organization's information security practices comply with organizational and departmental policies,
standards, and procedures. ISSOs are responsible for the following activities associated with
security testing:
!
Developing security standards and procedures for their area of responsibility
!
Cooperating in the development and implementation of security tools and mechanisms
!
Maintaining configuration profiles of all systems controlled by the organization, including but not limited to, mainframes, distributed systems, microcomputers, and
dial access ports
!
Maintain operational integrity of systems by conducting tests and ensuring that designated IT professionals are conducting scheduled testing on critical systems
System and Network Administrators
Daily, system and network administrators must address the security requirements of the specific system(s) for which they are responsible. Security issues and solutions can originate
from either outside (e.g., security patches and fixes from the vendor or computer security
incident response teams) or within the organization (e.g., the Security Office). The administrators are responsible for the following activities, associated with security testing:
!
Monitoring system integrity, protection levels, and security related events
!
Following-up with detected security anomalies associated with their information
system resources
!
Conducting security tests as required.
Managers and Owners
Managers and owners of a system oversee the overall compliance of their assets with their
defined/identified security requirements. They are also responsible for ensuring that test results and recommendations are adopted as appropriate.
10