# Presentation: 172078

## Results SummarySurvey on IT Security Tools and Techniques

**Robert W. Cobb**
**and Staff**
**National Aeronautics and Space Administration**
**IT Roundtable**
**25 March 2003**

## Survey Questionnaire Developed to

- Gain an understanding of how various OIG’s are assessing their IT vulnerabilities
- Collect information on successful IT tools and techniques
- Facilitate the exchange of ideas and experiences regarding IT security/vulnerability audits and evaluations

## About the Respondents

- Questionnaires were sent to PCIE/ECIE members.
- We received 26 responses from a variety of OIG’s.

## Results: Assessing Vulnerability

- _Vulnerability Assessments as Performed by OIG’s_:
- 25 OIG’s performed some level of vulnerability assessment, with the level varying widely.
- 22 used contractors for at least some level of assistance.
- 3 performed all the work in-house.

## Results: Assessing Vulnerability (cont.)

- _Penetration Tests as Performed by Agencies or Departments_:
- 19 perform penetration tests.
- 15 contracted this work out.
- OIG’s oversaw the work of 18 Agencies or Departments performing penetration testing.

## Results: Assessing Vulnerability (cont.)

- •	Most OIG offices reported no major resistance to vulnerabilities assessments being conducted, although the potential for “disruption of operations” was the most common objection.
- •	Many noted that “rules of engagement” were established prior to the initiation of tests.

## Results: Assessing Vulnerability (cont.)

- •	Best Practices:
- Share your assessment plan.
- Be sensitive to operational concerns.
- Invite auditees as observers.
- Share assessment results.

## Results: Successful Assessment Tools

- ISS Internet Scanner, Nessus, NMAP, Superscan, and Solarwinds (dozens more cited).
- ISS Internet Scanner touted for its excellent reporting capabilities, ranks vulnerabilities, and provides mitigation techniques.

## Results: COTS Products Versus In-house Proprietary Tools

- OIG’s reported heavy use of commercial off-the-shelf (COTS) products.
- Many used freeware and shareware as well as COTS products.
- Few used in-house proprietary tools.

## Results: Other Successful Tools and Techniques

- Interviews are used extensively to facilitate system reviews.  Discussions often foster close rapport and honest discussion, which helps point to weaknesses and vulnerabilities for which to test.
- Many report using guidance provided by the National Institute of Standards and Technology.

## Results: OIG Vulnerability Assessment Working Trends

- Several have staff devoted exclusively to conducting vulnerability assessments or to overseeing contractors.
- Most have staff who spend at least some of their time working on vulnerability assessments.
- While a few OIG’s are hiring vulnerability assessment employees, staff size is generally expected to remaining static, with contractors being added as needed for penetration testing.

## Results: OIG Personnel Utilized for Vulnerability Assessments

- Most used a combination of the personnel listed below.
- A large majority employ GS-511 Auditors.
- Over half use Information Technology Specialists (GS-2210).
- A few utilize Management Analysts (GS-343).

## Results: Most Recommended/Attended Vulnerability Assessment Training

- The SANS Institute
- MIS Training Institute
- IGATI
- USDA Graduate School
- Learning Tree
- Canaudit

## Contacts for This Survey:

- David M.Cushing
- (202) 358-2572
- _[David.M.Cushing@nasa.gov](mailto:David.M.Cushing@nasa.gov)_
- Dana Mellerio
- (202) 358-0271
-  Dana.M.Mellerio@nasa.gov