System Test and Evaluation

The System Test and Evaluation offering is primarily for companies and government agencies that seek a detailed analysis of information security risks from an insider perspective. It provides a detailed inventory and analysis of all the computing equipment within the network, and all operating system configuration and application vulnerabilities. This offering is for customers who desire to understand their current security posture.

This internally based audit generally follows the National Institute of Standards and Technology (NIST) document "Guideline On Network Security Testing," 800-42. The following basic tasks are performed:

Discovery Scanning: A discovery of resources on the service network is performed. A Discovery Scan must collect enough information about each resource attached to the network to identify the type of resource (router, desktop computer, server, network switch, firewall, etc.), its operating system and if it is running a service that has been determined as being an "Enterprise" level service. Classifying IP equipment that requires appropriate management, disaster recovery, is inherently risky, and/or has a large impact on the network makes in the process of decisioning whether to remediate or accept the risk the equipment presents. The Discovery scan process then becomes a matter of identifying whether a specific machine has these "Enterprise" services or not. If a network device does have them, then a more thorough investigation via a Vulnerability Scan must be performed. Discovery scanning is then reduced to identifying "targets" for further research and then prioritizing that list of targets so that business critical applications receive the most immediate attention.

Summary Steps:
  • All policies are in place and the procedures are understood (at least on a high level).
  • Tune the scanning process for best performance as a pilot or on a test network.
  • Scan for all known networks, then unknown networks.
  • Organize all network resources into a database.
  • Label all resources (where possible) by type; desktop, data communications equipment, server).
  • Tag all servers as "targets" for Vulnerability scanning.
  • Investigate resources where the type is not apparent.
  • Filter remaining resources for oddities, either tag them as "targets" or "type" them.
  • Group all resources by business segment and then sort by priority.
  • Identify the application(s) running on the "target".


Need more information or have a question for Long Wave?
Contact us via our website or by phone at 405.235.2217.