Copyright Goodheart-Willcox Co., Inc. 91 SUMMARY Evaluating Security ■ ■ A security assessment is a periodic exercise that evaluates a company’s security preparedness. Its purpose is to keep networks, devices, and data safe by discovering vulnerabilities and threats and offering recommendations to lessen the risk for future attacks. ■ ■ A comprehensive IT security strategy incorporates technological solutions, policies, procedures, and a detailed security assessment of an organization. It is necessary to assess the security posture of an enterprise environment so that security solutions can be recommended and implemented. This evaluation is a structured and detailed approach to locate IT vulnerabilities. ■ ■ The types of assessments conducted in an organization vary based on the organization’s mission and technology and can cover a wide spectrum. Regardless of the type of assessment used, it is necessary for an organization to locate and monitor current threat intelligence to identify any current and potential future attacks. Threat Hunting ■ ■ Threat hunting is the practice of proactively searching for cyber threats and vulnerabilities not already detected or identified in a network. ■ ■ Effective threat hunting requires threat intelligence. The intelligence is analyzed information used by a company to understand the threats that have, will, or are currently targeting an organization. ■ ■ Intelligence infusion is the combination of intelligence information from many sources to create a comprehensive threat profile. The profile provides security teams with comprehensive analysis and correlation of information to effectively respond to potential imminent threats. Vulnerability Scan ■ ■ A vulnerability scan is a security assessment that searches a computer or network for potential vulnerabilities or weak security configurations. For a comprehensive security assessment, vulnerability scanning is completed in conjunction with penetration testing. ■ ■ Two general categories of vulnerability scans include noncredentialed scan and credentialed scan. ■ ■ A vulnerability scanner is software that automates the process of scanning computer systems for potential security weaknesses in software, configurations, and other settings. A scanner can also enable users to scan applications, web applications, and networks to identify potential problems. ■ ■ Scan output identifies missing internal security controls, which could include a lack of up-to-date security patches and no installed firewall or antivirus software. Scanning a system can also identify common misconfigurations on computers that leave the systems vulnerable to hackers.