CMGT431 Testing and Assessment Strategies Paper

Part I: Mapping Vulnerabilities to Security Controls My 5 security control families as specified in NIST SP 800-53(Rev.4) are: AT-1 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES AC-17 REMOTE ACCESS CA-7 CONTINUOUS MONITORING CM-10 USER-INSTALLED SOFTWARE CM-3 CONFIGURATION CHANGE CONTROL

Part II: Security Controls Testing

Family Criteria security awareness and training policy and procedures Control ID: AT-1 Control Name: Security awareness and training policy and procedures (Organizational users) Vulnerability: Social Engineering Recommended mitigation: Providing a training session so they do not give personal information or information about PPK, including its infrastructure or networks unless they are certain of...