Соответствие требованиям

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

CIS Critical Security Controls v7.1 (SANS Top 20)

Framework

CSC 20

Для проведения оценки соответствия по документу войдите в систему.

Список требований

CSC 20 Penetration Tests and Red Team Exercises
Test the overall strength of an organization's defense (the technology, the processes, and the people) by simulating the objectives and actions of an attacker.
CSC 20.1 Establish a Penetration Testing Program
Establish a program for penetration tests that includes a full scope of blended attacks, such as wireless, client-based, and web application attacks.
Обязательно для implementation Group 2 3
CSC 20.2 Conduct Regular External and Internal Penetration Tests
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors that can be used to exploit enterprise systems successfully.
Обязательно для implementation Group 2 3
CSC 20.3 Perform Periodic Red Team Exercises
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively.
Обязательно для implementation Group 3
CSC 20.4 Include Tests for Presence of Unprotected System Information and Artifacts
Include tests for the presence of unprotected system information and artifacts that would be useful to attackers, including network diagrams, configuration files, older penetration test reports, e-mails or documents containing passwords or other information critical to system operation.
Обязательно для implementation Group 2 3
CSC 20.5 Create Test Bed for Elements Not Typically Tested in Production
Create a test bed that mimics a production environment for specific penetration tests and Red Team attacks against elements that are not typically tested in production, such as attacks against supervisory control and data acquisition and other control systems.
Обязательно для implementation Group 2 3
CSC 20.6 Use Vulnerability Scanning and Penetration Testing Tools in Concert
Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability scanning assessments should be used as a starting point to guide and focus penetration testing efforts.
Обязательно для implementation Group 2 3
CSC 20.7 Ensure Results from Penetration Test are Documented Using Open, Machine-readable Standards
Wherever possible, ensure that Red Team results are documented using open, machine-readable standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so that results can be compared over time.
Обязательно для implementation Group 3
CSC 20.8 Control and Monitor Accounts Associated with Penetration Testing
Any user or system accounts used to perform penetration testing should be controlled and monitored to make sure they are only being used for legitimate purposes, and are removed or restored to normal function after testing is over.
Обязательно для implementation Group 2 3

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.