NIST

Risk Assessment Methodologies

/ Miguel Bigueur / 1 Comment

RISK

I will discuss three of the top information security risk assessment methodologies; OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation), FAIR (Factor Analysis of Information Risk), and NIST RMF (National Institute of Standards and Technology’s Risk Management Framework) . Included will be a brief overview of each including three pros and cons associated with the use of each one. Lastly, I will discuss my recommendations and the reasoning behind why.

Continue reading →

Remediation

/ Miguel Bigueur / Leave a comment

201402NIST-Cybersecurity-Framework-its-future-and-what-it-means-to-you

I will reflect upon the differences observed between three different vulnerability scanners and management tools, Nessus, Nexpose, and OpenVAS. Areas to be reviewed include, ease of use, accuracy of findings, depth of information in the tool and reports, actionability of the information provided and any other relevant criteria believed to be relevant. This report will also compare the results, remediation advice, and reliability as observed by the three different software programs. The test used for this report will be performed on a virtual network constructed entirely inside of a virtual machine on a 2009 Mac Pro using Parallels 10. The free versions of Nessus and Nexpose vulnerability scanners will run against the Metasploitable 2 virtual machine inside of Parallels and OpenVAS, which is a free open source vulnerability scanner, will be referenced from a YouTube video. Each test will be performed under identical network conditions.

Continue reading →