Application
This unit describes the skills and knowledge required to run vulnerability assessments and basic penetration tests to identify potential threats to an organisation. It includes the ability to minimise risk and remediate vulnerabilities to confirm that the security of an organisation is maintained.
It applies to individuals who work as penetration tester and security consultants in any business environment.
No licensing, legislative or certification requirements apply to this unit at the time of publication.
Elements and Performance Criteria
1. Prepare to run vulnerability assessment | 1.1 Obtain work details and scope from required personnel and arrange for site access in compliance with required security arrangements, legislation, codes, regulations and standards 1.2 Discuss and evaluate scanning tools and select according to vulnerability assessment requirements 1.3 Establish testing regime and schedule, and documentation requirements according to organisational needs |
2. Run vulnerability assessment and penetration test | 2.1 Perform vulnerability assessment according to organisational procedures 2.2 Identify and document vulnerabilities arising from vulnerability assessment according to organisational procedures 2.3 Run a simple penetration test according to organisational procedures 2.4 Identify and document potential threats arising from penetration test according to organisational procedures 2.5 Contribute and develop ideas in addressing vulnerabilities |
3. Finalise vulnerability assessment process | 3.1 Discuss vulnerabilities identified in vulnerability assessment and penetration testing with required personnel 3.2 Contribute ideas with required personnel and remediate vulnerabilities identified according to organisational procedures 3.3 Escalate unresolved vulnerabilities to required personnel 3.4 Document identified vulnerabilities and work performed according to organisational procedures 3.5 Report to management and confirm vulnerability assessment with required personnel |
Evidence of Performance
The candidate must demonstrate the ability to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including evidence of the ability to:
perform at least one vulnerability test assessment
define and run at least one basic penetration test.
In the course of the above, the candidate must:
assess web based, network based and hardware-based vulnerabilities
adhere to organisational procedures
document and report activities.
Evidence of Knowledge
The candidate must be able to demonstrate knowledge to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including knowledge of:
security risks and vulnerabilities in software systems
tools used in testing a network for vulnerabilities including scanning tools
basic level penetration testing of a system
methods and tools used to protect data in an organisation
risk mitigation strategies that may be used running vulnerability assessments for an organisation
organisational procedures applicable to running vulnerability assessments, including:
establishing goals and objectives of vulnerability assessments
defining scope of testing and establishment of testing regime
documenting established requirements
establishing penetration testing procedures
documenting findings, threats and work performed
key organisational environments, systems and networks required to run vulnerability assessments.
Assessment Conditions
Skills in this unit must be demonstrated in a workplace or simulated environment where the conditions are typical of those in a working environment in this industry.
This includes access to:
required software testing packages
required hardware and its components
vulnerability scanning tools
a server
text-editing software
information applicable to organisational environment, systems and network
required organisation network, systems or applications.
Assessors of this unit must satisfy the requirements for assessors in applicable vocational education and training legislation, frameworks and/or standards.
Foundation Skills
Learning | Identifies and gathers information applicable to business, systems and network |
Numeracy | Measure and record data and interpret testing results using tools |
Reading | Interprets information from a range of sources when establishing vulnerability assessment procedures |
Writing | Prepares documentation detailing vulnerability assessments according to organisational requirements using concise industry specific terminology applicable to cyber security |
Planning and organising | Prepares and manages vulnerability assessment process logically and sequentially |
Problem solving | Uses problem solving skills when interpreting the nature and threat of vulnerabilities identified |
Technology | Uses required technological tools and software in identifying potential threats in an organisation |
Sectors
Cyber security