Cyber Assess Scheme

Vulnerability Assessments provide insight as to which assets are susceptible to cyber-attacks by providing detailed reports of the weaknesses in the systems scoped for testing. The severity of these weaknesses is measured through authenticated or unauthenticated scans as requested by the applicant. The Assessments also document easily identifiable vulnerabilities, showing how they were discovered. The vulnerabilities are listed with prioritization based on CVSS scores, and recommendations for remediation are provided.

Vulnerability scanning supports IPv4, IPv6 and hybrid networks, whilst Technologies/Operating Systems supported are the following: AIX, Junos, SQL Server, Alma Linux, MacOS X, SuSE, Amazon Linux, Mandriva, Ubuntu, Android MariaDB, Virtuozzo, CentOS MongoDB, VMware ESX, CISCO, MySQL, VMware ESXi, Citrix, Netware, vSphere, DB2, NewStart CGSL Windows, Debian Oracle, F5 Networks, Oracle Linux, Fedora OracleVM, Fortinet Palo Alto, FreeBSD, PhotonOS, Gentoo, PostgreSQL, HP-UX Red Hat, Huawei, Rocky Linux, Hyper-V, iIBM iSeries, Scientific Linux, Informix/DRDA, Slackware, Apple iOS, Solaris.

For the Vulnerability Assessment service, between 5 and 25 devices/components can be scanned. As an alternate option, applicants can opt to have 1 web application assessed.

Service will be capped to 12 businesses with a maximum of 4 business days each, covering the below steps:

• Vulnerability identification

Vulnerability testing can be run via authenticated and unauthenticated scans:

Authenticated scans: Allow vulnerability scanners’ system access to networked resources using remote administrative protocols and authenticate using provided system credentials. Authenticated scans should include information but not be limited to access to low-level data such as specific services, configuration details and accurate information about operating systems, installed software, configuration issues, access control, security controls and patch management.

Unauthenticated scans: Scans that do not provide system access to networked resources, which can result in false positives and unreliable information about operating systems and installed software. However, they can provide visibility into which vulnerabilities on the system/s are easily identifiable without having credentialed access to the system/s.

• Vulnerability analysis

In the vulnerability analysis stage, the following steps will be taken:

1. Identifying the responsible components and root cause of each vulnerability, with manual verification to minimize false positives.
2. Determining the age of vulnerabilities.
3. Assessing exploitability based on CVSS 3.1 format.
4. Evaluating the exploit code maturity using CVSS 3.1 format.

• Risk assessment

The applicant will be presented the Risk scores. For each vulnerability, the vulnerability ranking will include CVSS scores.

• Remediation

The applicant will be guided in terms of prioritization of vulnerabilities according to CVSS 3.1 format, accompanied by recommendations for remediation.

Penetration Testing involves both manual and automated testing to replicate real-life cyber-attacks, mapping out potential breach paths that attackers might take. The primary objectives are to validate the effectiveness of existing security controls based on specified goals and scope, ensuring they adequately protect the system or assets in question. Covert testing is used to evaluate the response capabilities of IT and security personnel when faced with simulated cyber-attacks.

In cases where vulnerabilities are identified and deemed exploitable, detailed documentation is provided, illustrating the breach methods used for each vulnerability. Additionally, the service offers recommendations for remediation to prevent the recurrence of these vulnerabilities and enhance overall cybersecurity defences.

Service will be capped to 3 large businesses with a maximum of 8 business days each, and 6 SMEs with a maximum of 6 business days each, as follows:

Guided by The Penetration Testing Execution Standard and NIST SP800-115, Technical Guide to Information Security Testing and Assessment, the Penetration Testing activities to be included, but not limited to, are:

• Intelligence Gathering
• Threat Modelling
• Vulnerability Analysis
• Exploitation
• Post Exploitation
• Reporting which would align with the PTES Reporting section and also the PTES Technical Guidelines – Reporting section. The report will include clear explanation on the identification and explanation of vulnerabilities, with associated recommended remedial actions, step-by-step attack replication instructions, evidence of compromise/verification with screenshots and solutions. Detailed technical reports and executive summary reports with recommendations and a remediation plan with prioritised actions for risk mitigation are also included.

Security Architecture Reviews involve assistance and guidance in the development and design of architectures that effectively manage identified risks through appropriate controls. It includes the identification and articulation of risks at both abstract and detailed levels in systems and services design.

This service provides guidance on reducing the likelihood of exploiting vulnerabilities and minimizing the impact in case of a compromise. It offers support for secure development, building, deployment, operation, and management of systems and services. Additionally, the service advises on adopting and securely implementing common architectural blueprints or patterns. Applicants are guided in selecting technologies that adequately mitigate potential vulnerabilities identified in system architectures. Furthermore, the service simplifies technical security analysis into easily understandable language for both technical and executive audiences, facilitating better decision-making and understanding of security measures.

Service will be capped to 3 businesses with a maximum of 10 business days each, as follows:

Security Architecture assessments align with at least one of the below Threat Modelling approaches and where technically possible with Zero Trust Architecture principles as per NIST.SP.800-207:

• Draft NIST Special Publication 800-154, Guide to Data-Centric System Threat Modelling
• STRIDE
• Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
• IDDIL/ATC

The final report is intended to include a threat model for the systems under review, including a list of potential attack vectors and means to mitigate these. Recommendations on adopting and securely implementing common architectural best practices are also included.

The Risk Assessment and Management service offers guidance and advice to applicants to determine the appropriate approach to risk assessment based on their specific activities and desired business outcomes. Working collaboratively, this service helps applicants gain a realistic understanding of cybersecurity risks related to their business objectives.

The service includes the conduct and documentation of the risk assessment, assisting the applicants in identifying and addressing cybersecurity risks that align with its goals. As a result, such assessments will help facilitating informed security and business decision-making processes, providing the applicants with comprehensive support in managing cybersecurity risks effectively.

Cybersecurity control recommendations are provided to ensure comprehensive management of identified risks.

Additionally, the service helps in developing and documenting tailored risk management plans that align with the applicant’s business objectives and activities. Furthermore, the service assists applicants in developing adaptive approaches to continuously manage evolving risks, considering changes in the business, threat landscape, and technology.

Risk Assessment and Management can be conducted at all three tiers in the risk management hierarchy—including Tier 1 (organization level), Tier 2 (mission/business process level), and Tier 3 (information system level).

For the Risk Assessment service, applicants must opt for one of the 3 specified tiers.

Tier 1 includes, for example:

• organization-wide information security programs, policies, procedures, and guidance;
• the types of appropriate risk responses (i.e., risk acceptance, avoidance, mitigation, sharing, or transfer);
• investment decisions for information technologies/systems;
• procurements;
• minimum organization-wide security controls;
• conformance to enterprise/security architectures;
• monitoring strategies and ongoing authorizations of information systems and common controls.

Tier 2 includes, for example:

• enterprise architecture/security architecture design decisions;
• the selection of common controls;
• the selection of suppliers, services, and contractors to support organizational missions/business functions;
• the development of risk-aware mission/business processes;
• the interpretation of information security policies with respect to organizational information systems and environments in which those systems operate.

Tier 3 includes, for example:

• design decisions (including the selection, tailoring, and supplementation of security controls and the selection of information technology products for organizational information systems);
• implementation decisions (including whether specific information technology products or product configurations meet security control requirements);
• operational decisions (including the requisite level of monitoring activity, the frequency of ongoing information system authorizations, and system maintenance decisions).

Service will be capped to 3 businesses with a maximum of 10 business days each, as follows:

According to the NIST Special Publication 800-30 Risk Management Guide and NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments, the Risk Assessment and Management activities to be included, but not limited to, are:

• System Characterization
• Identify Threat Sources
• Identify Threat Events
• Identify Vulnerabilities and Predisposing Conditions
• Analyse Controls
• Determine Likelihood
• Determine Impact
• Determine Risk
• Recommend Controls for Risk Management
• Document Results which will align with APPENDIX K of NIST Special Publication 800-30 Revision 1 – Guide for Conducting Risk Assessments

The Audit and Reviews service offers comprehensive guidance to applicants on maintaining and continuously improving their internal or external cybersecurity standards, policies, and procedures. Applicants can choose specific parts of their policies or procedures to be audited or reviewed, aligning with standards such as the “ISO27k” family, NIST CSF, and PCI-DSS.

The service also assists applicants in meeting certification or compliance requirements related to these standards. Additionally, for existing cybersecurity policies and procedures, applicants can opt for audits and reviews of specific parts of their policies/procedures/standards in line with a subset of the standards mentioned, assisted through recommendations of changes or improvements.

Service will be capped to 3 businesses with a maximum of 10 business days each, as follows:

Guided by the Guidelines for auditing management systems (ISO 19011:2018), the activities to be included, but not limited to, are:

• Determine any areas of interest, concern or risks to the auditee in relation to the specific audit
• Determine feasibility of audit
• Collect and verify information
• Audit evidence
• Evaluate evidence against audit criteria
• Generate audit findings
• Determine audit conclusions
• Conduct closing meeting & Audit Report