Madhya Pradesh Agency for Promotion of Information Technology

(A CERT-In Empanelled organisation of Govt. M.P Under Dept. of Science & Technology)

C.13 The security auditors know their tools, where the tools came from, how the tools work, and have them tested in a restricted test area before using the tools on the customer organization and the result of such testing should be approved formally by the authorized person of auditee organization. C.14 C.15 The exploitation of Denial of Service tests is done only with explicit permission. C.15 Social engineering and process testing are performed in non-identifying statistical means against untrained or non-security personnel. C.16 Social engineering and process testing are performed on personnel identified in the scope and may not include customers, partners, associates, or other external entities. C.17 High risk vulnerabilities such as discovered breaches, vulnerabilities with known, high exploitation rates, vulnerabilities which are exploitable for full, unmonitored or untraceable access, or which may put immediate lives at risk, discovered during testing are reported immediately to the customer with a practical solution as soon as they are found. C.18 C.19 Refrain from carrying out Distributed Denial of Service testing over the Internet. C.19 Refrain from any form of flood testing where a person, network, system, or service, is overwhelmed from a larger and stronger source. C.20 Notify the auditee whenever the auditor changes the auditing plan, changes the source test venue, has high risk findings, previous to running new, high risk or high traffic tests, and if any testing problems have occurred. Additionally, the customer is notified with progress updates at reasonable intervals. C.21 C.22 Reports include all unknowns clearly marked as unknowns. C.22 All conclusion should be clearly stated in the report with the clear objective evidence for each conclusion drawn. C.23 Reports use only qualitative metrics for gauging risks based on industry-accepted methods. C.24 Auditee is notified when the report is being sent as to expect its arrival and to confirm receipt of delivery. C.25 All communication channels for delivery of report are end to end confidential.

- D. GENERAL GUIDELINES

D.1 Auditee must implement the guidelines and advisories issued by CERT-In and/or suitable Government Agency time to time in their auditing program. D.2 Regular interaction framework during audit should be setup. D.3 Auditee should interview manpower deployed by auditor for conducting the audit. D.4 Ensure that auditor is utilizing industry standard methodologies, best practices for security testing. D.5 Scope of audit (in case of VA/PT) should not be limited to the few lists like OWASP top 10 or SANS Top 25 programming errors, it must include discovery of all known vulnerabilities. D.6 Auditee must demand for the working notes upon completion of the audit (provisions for this must be made in the audit contract itself) and should ask for audit evidences collected to be submitted as appendix along with the final audit report. D.7 Audit report format should be mutually agreed upon (Auditee and Auditor) and finalized before commencement of the audit. A sample web-application audit report for reference is available at Annexure-I. D.8 Regular meetings should be held between the auditor and auditee representatives (SPOCs) to review the progress of the audit in order to assess and improve the audit efficiency. D.9 Auditee must ensure that the tests agreed upon in the audit contract are actually being conducted by the auditor and also that the prescribed timeline is being followed, through the aforementioned meetings. D.10 CERT-In empanelled auditors are selected after much scrutiny and testing but it is vital to understand that while the list of empanelled auditors is true and accurate, CERT-In cannot guarantee the authenticity of audit details provided by these organizations. D.11 While selecting an auditor, it is the responsibility of the auditee to check the domain audit conducted, previous audits conducted and other relevant details. An auditee should have a clear understanding of the

State IT Center, 47-A, Arera Hills, Bhopal -462011, Tel: +91-755-2518702

Website: www.mapit.gov.in|| Email: info@mapit.gov.in