Printable View
So Im doing a network security audit for my grad project, and I was wondering if anyone knows any templates or examples of a formal security proposal. Like what I plan to do and how and such. Or maybe contact info for someone who does? Any help would be appricated
well what do you plan on proposing? what kind of security? physical? digital? both? social engineering attempts? is this a pen test? or just a "textbook" type audit where in theroy things should be right? are you doing only network equipment or the computers on the network? what type of place are you auditing? the type a business will determine greatly how you submit a proposal.
reguardless you will need to state what you want to do, why you want to do it, and why it will benefit the person you are doing it for. include costs, downtime, risk analysis.
templates for this type of thing are not that good becasue they go on such a case by case basis.
Hi
I may be a bit too much business oriented, but my first thought after
quick-reading your post was CobIT[1]. I realised it may be an "overkill"
for your grad project, but at least it gives you a starting point. Here, I
try to give you a list of keywords, with which you can continue. I'd
be happy to learn more myself :(
CobIT has been developed by ISACA (Guidelines[2]) as a "generally
applicable and accepted standard for good Information Technology
security and control practices that provides a reference framework
for management, users, and IS audit, control and security practitioners."
CobIT takes care of a huge variety of standards, including qualification
criterions like NIST, ITSEC[3a], Common Criteria[3b], AS7799.2[4],
SPICE (ISO 15504),...) and provides an integral framework for auditing.
Furthermore, take a look at ISO/IEC 17799[5], which will provide you
some kind of a checklist. It is a code of practice.
ITIL[6] comes to mind. For the combination CobIT, ITIL and ISO 17799
check this PWC-overview[7].
/edit: In case I misunderstood your request: Have a look at SANS audit
policy template[8] :)
Cheers
[1] http://www.isaca.org/Template.cfm?Se...ContentID=7981
[2] http://www.isaca.org/Template.cfm?Se...ontentID=13742
[3a] http://www.itsec.gov.uk
[3b] http://csrc.nist.gov/cc
[4] http://www.bridgepoint.com.au/Documents/7799paper.pdf
[5] http://praxiom.com/iso-17799-audit.htm
[6] http://www.ogc.gov.uk/index.asp?id=2261
[7] http://www.itsmf.org.za/Presentation...d%20BS7799.pdf
[8] http://www.sans.org/resources/policies/Audit_Policy.pdf
XTC46 has asked all the right questions. I'll disagree with his last statement, but I think it may be a matter of semantics...Quote:
Originally posted here by XTC46
well what do you plan on proposing? what kind of security? physical? digital? both? social engineering attempts? is this a pen test? or just a "textbook" type audit where in theroy things should be right? are you doing only network equipment or the computers on the network? what type of place are you auditing? the type a business will determine greatly how you submit a proposal.
reguardless you will need to state what you want to do, why you want to do it, and why it will benefit the person you are doing it for. include costs, downtime, risk analysis.
templates for this type of thing are not that good becasue they go on such a case by case basis.
You are asking for help with a template for the proposal, correct? Easily done. However, we do need the info he is asking about. In a business relationship, this proposal would be considered a formal proposal for services rendered, normally. It could be a contract, or simply the policy & procedure document that is referred to in the contract. Regardless, it should identify both parties, a statement of intent, a description (and link?) of any and all tools that may be used during any physical or digital assessments, and some guidelines on what will and will not be done (i.e. the boundaries...a good example of this is "...we will pursue and attempt to confirm any vulnerabilities up to but excluding actually exploiting the weakness.")
Consider the following Table Of Contents from just such a proposal. I've scrubbed the info, and due to client confidentiality I can not disclose anything else from this document, but this might help you form up something for your project.
1.0 GENERAL INFORMATION
1.1 BACKGROUND & OBJECTIVES
1.2 SERVICE OVERVIEW
1.3 KEY BUSINESS AND TECHNICAL CONTACTS
2.0 SERVICE DESCRIPTION
2.1 SCOPE OF ACTIVITY
2.2 COORDINATION, PLANNING, & PROJECT INITIATION MEETING
2.3 SERVICE COMPONENT OR MAJOR ACTIVITY
3.0 SCHEDULE
3.1 PERIOD OF PERFORMANCE
3.2 PROJECT CHANGE CONTROL
4.0 SERVICE DELIVERABLES
4.1 DESCRIPTION
4.2 ACCEPTANCE OF DELIVERABLES
5.0 ASSUMPTIONS
6.0 COST
6.1 FIRM FIXED PRICE COST FOR SERVICES
6.2 TRAVEL AND EXPENSE REIMBURSEMENT
7.0 SIGNATURES
APPENDIX A PROJECT COMPLETION FORM
APPENDIX B TERMS AND CONDITIONS
Yikes. That is a lot...but I think it should help you decide what format and content you want in your project paper. Keep in mind that these proposals are what we laughingly refer to as the 'Get Out of Jail Free Pass'. This is the legal document that will Save Your Ass(C) if you are accused of malicious hacking. *IF* it's done right, and signed/documented by all parties. It goes without saying that this contract (we use this as a contract itself) goes through Legal before it's even presented to the client.
It may also be of benifit for you to see the other side of the equation, what a potentual client may use to select an auditor?
Note, it is a Word Document.
Quote:
From Here: http://www.foundstone.com/services/F...P_Template.doc
Using this Request for Proposal Template
Foundstone has developed this Request For Proposal (“RFP”) template to help organizations identify and select a quality security vendor to perform professional services work. It also lists questions organizations should consider asking potential vendors to ensure that a thorough and comprehensive approach to the project will be taken. This template should apply in a variety of security-related situations including:
I plan on looking at both digital and physical security as well as a small amount of social engineering. I plan on doing pen-testing on a small ISP. Ill be doing this on both the computers in the office and the network equipment. Thanks for the help
sorry, I meant taking somone elses template wouldnt be that great becasue what youre auditing may have nothing to do what they were auditing. not that creating a template is a bad idea. poor wording, sorry.Quote:
templates for this type of thing are not that good becasue they go on such a case by case basis.
and is this going to be just thr proposal for the work, or are you including the final contract as to what is going to be done, and the results. if so you need to take A LOT of things into consideration such as whats acceptable, what to do with found information. Durring pentesting you are no doubt going to come across some "sensitive" information. Make sure you have all the NDA's signed by you and your team. Also, check who is allowed to see the results of the test, who you report to, who should know you are doing the tests. things along these lines.
Kevin Mitniks new books "the art of intrusion" actually goes into this type of stuff fairly well.