NTISthis.com

Evidence Guide: ICTCYS404 - Run vulnerability assessments for an organisation

Student: __________________________________________________

Signature: _________________________________________________

Tips for gathering evidence to demonstrate your skills

The important thing to remember when gathering evidence is that the more evidence the better - that is, the more evidence you gather to demonstrate your skills, the more confident an assessor can be that you have learned the skills not just at one point in time, but are continuing to apply and develop those skills (as opposed to just learning for the test!). Furthermore, one piece of evidence that you collect will not usualy demonstrate all the required criteria for a unit of competency, whereas multiple overlapping pieces of evidence will usually do the trick!

From the Wiki University

 

ICTCYS404 - Run vulnerability assessments for an organisation

What evidence can you provide to prove your understanding of each of the following citeria?

Prepare to run vulnerability assessment

  1. Obtain work details and scope from required personnel and arrange for site access in compliance with required security arrangements, legislation, codes, regulations and standards
  2. Discuss and evaluate scanning tools and select according to vulnerability assessment requirements
  3. Establish testing regime and schedule, and documentation requirements according to organisational needs
Obtain work details and scope from required personnel and arrange for site access in compliance with required security arrangements, legislation, codes, regulations and standards

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Discuss and evaluate scanning tools and select according to vulnerability assessment requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Establish testing regime and schedule, and documentation requirements according to organisational needs

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Run vulnerability assessment and penetration test

  1. Perform vulnerability assessment according to organisational procedures
  2. Identify and document vulnerabilities arising from vulnerability assessment according to organisational procedures
  3. Run a simple penetration test according to organisational procedures
  4. Identify and document potential threats arising from penetration test according to organisational procedures
  5. Contribute and develop ideas in addressing vulnerabilities
Perform vulnerability assessment according to organisational procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify and document vulnerabilities arising from vulnerability assessment according to organisational procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Run a simple penetration test according to organisational procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify and document potential threats arising from penetration test according to organisational procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Contribute and develop ideas in addressing vulnerabilities

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Finalise vulnerability assessment process

  1. Discuss vulnerabilities identified in vulnerability assessment and penetration testing with required personnel
  2. Contribute ideas with required personnel and remediate vulnerabilities identified according to organisational procedures
  3. Escalate unresolved vulnerabilities to required personnel
  4. Document identified vulnerabilities and work performed according to organisational procedures
  5. Report to management and confirm vulnerability assessment with required personnel
Discuss vulnerabilities identified in vulnerability assessment and penetration testing with required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Contribute ideas with required personnel and remediate vulnerabilities identified according to organisational procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Escalate unresolved vulnerabilities to required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Document identified vulnerabilities and work performed according to organisational procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Report to management and confirm vulnerability assessment with required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Assessed

Teacher: ___________________________________ Date: _________

Signature: ________________________________________________

Comments:

 

 

 

 

 

 

 

 

Instructions to Assessors

Required Skills and Knowledge

The candidate must demonstrate the ability to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including evidence of the ability to:

perform at least one vulnerability test assessment

define and run at least one basic penetration test.

In the course of the above, the candidate must:

assess web based, network based and hardware-based vulnerabilities

adhere to organisational procedures

document and report activities.

The candidate must be able to demonstrate knowledge to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including knowledge of:

security risks and vulnerabilities in software systems

tools used in testing a network for vulnerabilities including scanning tools

basic level penetration testing of a system

methods and tools used to protect data in an organisation

risk mitigation strategies that may be used running vulnerability assessments for an organisation

organisational procedures applicable to running vulnerability assessments, including:

establishing goals and objectives of vulnerability assessments

defining scope of testing and establishment of testing regime

documenting established requirements

establishing penetration testing procedures

documenting findings, threats and work performed

key organisational environments, systems and networks required to run vulnerability assessments.