Assesses the potential vulnerabilities identified against established vulnerability databases.
SFIA Skills: Security services
Vulnerability assessment (VUAS) (Level 4)
Conducts automated and manual vulnerability assessments and business impact analyses. Creates test cases using in-depth technical analysis of risks and typical vulnerabilities. Assesses effectiveness of security controls for infrastructure and application components, and recommends remedial action.
Tools and techniques (VUAS) (Level 4)
Contributes to the selection and deployment of vulnerability assessment tools and techniques.
Risk mitigation (VUAS) (Level 4)
Delivers risk treatment plans using one or more recognised control sets.
Risk assessment (VUAS) (Level 4)
Produces a risk assessment table to determine the likelihood and impact to an information or technology asset if a vulnerability is exposed to a threat source, assigning a likelihood and impact to determine risk level. Documents the business impact of a vulnerability being breached.
Critical information and technology assets (VUAS) (Level 4)
Allocates an impact level to critical information and technology assets should their confidentiality, integrity or availability be breached. Collates and analyses catalogues of information and technology assets for vulnerability assessment.
Communication and awareness (VUAS) (Level 4)
Promotes security awareness and communicates information on security risks and potential business impact to senior business managers and others.
Assessment documentation (VUAS) (Level 4)
Documents a full vulnerability assessment and business impact analysis conducted on medium complexity information systems.
Violation and security breach (SCAD) (Level 4)
Investigates security breaches in accordance with established procedures and security standards, and recommends required actions and support/follows-up to ensure these are implemented. Investigates and reconciles violation reports and logs generated by automated systems. Where appropriate (i.e. involving employees within own organisation) interviews minor offenders and compiles reports and recommendations for management follow-up.
Security advice (SCAD) (Level 4)
Provides advice and handles enquiries relating to security, contingency planning and related activities. Acts as subject matter expert for security administration activities.
Policies, standards, processes and guidelines (SCAD) (Level 4)
Maintains security administration processes, and checks that all requests for support are dealt with according to agreed procedures.
Auditable records (SCAD) (Level 4)
For all services and systems within identified remit, maintains auditable records and user documentation. Assists in the preparation and maintenance of other documentation such as business recovery plans, particularly in the data collection and compilation/production/distribution phases of the exercise.
Vulnerability identification and analysis (VUAS) (Level 5)
Takes a comprehensive approach to seeking vulnerabilities across the full spectrum of organisation policies, processes, and defences in order to improve organisational readiness, improve training for defensive practitioners, and inspect current performance levels.
Vulnerability assessment (VUAS) (Level 5)
Plans and manages automated and manual vulnerability assessment activities within the organisation. Assesses effectiveness of security controls for infrastructure and application components and recommends remedial action.
Tools and techniques (VUAS) (Level 5)
Reviews, evaluates, and selects vulnerability tools and techniques.
Risk mitigation (VUAS) (Level 5)
Identifies control owners and holds them accountable for the implementation of policies to reduce the risk of controls allocated to them using a recognised methodology.
Risk assessment (VUAS) (Level 5)
Uses complex quantitative risk analysis methods such as exposure factor, single loss expectancy, annualised rate of occurrence or annualised loss expectancy, to conduct security risk assessments, business impact analysis and accreditation on complex information systems.
Critical information and technology assets (VUAS) (Level 5)
Determines a quantifiable value to the impairment of an identified critical information or technology asset.
Communication and awareness (VUAS) (Level 5)
Communicates to the organisation’s leadership information on security risks to critical information and technology assets, and the impact on the business should vulnerabilities be breached.
Assessment documentation (VUAS) (Level 5)
Documents a full vulnerability assessment and business impact analysis conducted on complex information systems.
Violation and security breach (SCAD) (Level 5)
Ensures that all identified breaches in security are promptly and thoroughly investigated, and that any system changes required to maintain security are implemented. Investigates complex, or highly sensitive violations referred by more junior staff or colleagues, handling issues imaginatively, efficiently and professionally. Obtains factual information and formulates opinions regarding exposed violations. Where appropriate (i.e. involving employees within own organisation) interviews offenders in conjunction with the relevant line manager or on own authority if warranted.
Security training (SCAD) (Level 5)
Ensures that training, guidance and support is provided to security administrators, in all aspects of security policy and control.
Security advice (SCAD) (Level 5)
Provides general security expertise and specialist guidance on security administration and wider security issues.
Policies, standards, processes and guidelines (SCAD) (Level 5)
Contributes to the creation and maintenance of policy, standards, procedures and documentation for security, taking account of current best practice, legislation and regulation.
Changes and continual improvement (SCAD) (Level 5)
Advises on and assists with the assessment of the potential impact on existing access security mechanisms of specific planned technical changes, in order to help ensure that potential compromise or weakening of existing security controls is minimised. Also assists in the evaluation, testing and implementation of such changes.
Auditable records (SCAD) (Level 5)
Ensures that security records are accurate and complete, and that requests for support are dealt with according to set standards and procedures. Recognises requirements for, and creates, auditable records, user documentation and security awareness literature for all services and systems within scope, ensuring that the records provide a comprehensive history of violations, resolutions and corrective action.
Assurance (SCAD) (Level 5)
Monitors the application and compliance of security administration procedures, and reviews information systems for actual or potential breaches in security.
Vulnerability identification and analysis (VUAS) (Level 3)
Determines the potential vulnerabilities that might breach a critical information asset.
Vulnerability assessment (VUAS) (Level 3)
Conducts automated and manual vulnerability assessments under direction. Undertakes moderate-complexity vulnerability assessments using more sophisticated techniques and tools.
Risk assessment (VUAS) (Level 3)
Assesses the likelihood of attack on critical information and technology asset vulnerabilities from a threat source. Assesses the business impact and determines a value to the potential loss should a vulnerability be breached.
Critical information and technology assets(VUAS) (Level 3)
Assigns asset information security requirements and catalogues identified critical information and technology assets for vulnerability assessment.
Communication and awareness (VUAS) (Level 3)
Promotes security awareness and communicates information on known security risks and issues to business managers and others.
Assessment documentation (VUAS) (Level 3)
Documents vulnerability assessments. Evaluates and documents results, escalating and communicating issues where appropriate.
Violation and security breach (SCAD) (Level 3)
Investigates minor security breaches in accordance with established procedures and security standards. Investigates and reconciles violation reports and logs generated by automated systems. Integrates findings from other investigators, and compiles reports and recommendations for management follow-up. Leads the continual monitoring and remediation processes following an incident.
Security advice (SCAD) (Level 3)
Handles all enquiries relating to security administration with only infrequent reference to more senior staff for assistance
Auditable records (SCAD) (Level 3)
For all services and systems within identified remit, maintains auditable records and user documentation. Assists in the preparation and maintenance of evidence required for internal and external audit, compliance or regulatory reporting, security accreditations, and business recovery plans — particularly in the data collection and compilation/production/distribution phases of the exercise.
Vulnerability identification and analysis (VUAS) (Level 2)
Identifies basic vulnerabilities that might breach a critical information or technology asset.
Vulnerability assessment (VUAS) (Level 2)
Undertakes routine vulnerability assessments using automated and semi-automated tools, escalating issues where appropriate. Participates, under supervision, in more complex assessments.
Critical information and technology assets (VUAS) (Level 2)
Identifies and documents critical information and technology assets within the organisation, including the asset type and asset location.
Communication and awareness (VUAS) (Level 2)
Promotes awareness of security risks and issues to colleagues and others.
Assessment documentation (VUAS) (Level 2)
Documents the scope and results of basic vulnerability assessments, or contributes to the documentation of more complex assessments.
Violation and security breach (SCAD) (Level 2)
Assists in the investigation and resolution of issues relating to access controls and security systems. Investigates and reconciles violation reports and logs generated by automated systems. Investigates any other minor security breaches, in accordance with established procedures and security standards. Integrates findings from other investigators, and compiles reports and recommendations for management follow-up.
Security advice (SCAD) (Level 2)
Receives and responds to routine requests for security support. Maintains records and advises relevant persons of actions taken.
Auditable records (SCAD) (Level 2)
For all services and systems within identified remit, maintains auditable records and user documentation. Assists in the preparation and maintenance of evidence for use in internal and external audits, compliance or regulatory reporting, security accreditations, and business recovery plans — particularly in the data collection and compilation/production/distribution phases of the exercise.