How to Do Security Vulnerability Assessments

Security measures should be tested regularly and analyzed for potential flaws.

Security vulnerability assessments often refer to information security assessments such as the vulnerability testing businesses perform to keep their network protected. Physical security, such as guards and closed-circuit camera systems, may also experience vulnerability assessments, such as banks or businesses hiring security firms to check for loopholes in the current security procedures. Both types of vulnerability testing are designed to show potential areas of weakness and this information is then used to increase or enhance security.

Instructions

1. Make a list of the security needs of your business and whether you feel the needs are met by the current security measures. Include information security as well as physical security such as security cameras, guards, and alarm systems.

2. Consult with a security firm that specializes in vulnerability assessments. The best way to check your security vulnerability is to have a security firm attempt to penetrate current security measures. Do not provide the security firm with information beyond what they request as many prefer to conduct the external security assessments "blind"; meaning unaware of current security measures and practices.

3. Contract with a security firm to perform internal and external security vulnerability assessments. Generally, external assessments are performed through the use of network penetration tools to assess any potential holes in information security measures. Physical security may also be assessed externally such as the use of social networking to see how far inside the company a threat can reach.

4. Grant permission for the security firm to perform internal assessments as well. Internal assessments include checking the network for information security as well as potential gaps in security that could leave the company open to attack. This could be as simple as employees leaving a backdoor open to make it more convenient for cigarette breaks or as complex as employees emailing sensitive documents with unsecured email accounts.

5. Review the security assessment findings and the security firm's suggestions for improving overall security measures. Implementing changes such as those suggested by the security firm's findings can increase security and reduce the risk of loss, damage, or other threat to the company and employees.

Tips & Warnings

• Security testing can seem like wasted expenses when no threats have been found, but it is relatively easy and cheap to assess and improve on an existing security system compared to having to implement an entirely new system after the old one is breached.

References

• Northwestern University - Information Security Vulnerability Assessment Program: Network Assessment
• "Assessing Security Vulnerabilities: An Application of Partial and End-Game Verification and Validation"; Edward Snead Frazier II; April 21, 2010