Do we need to prepare for this at all?? Tina. Begin forwarded message:
From: "Kwiatkowski, Matthew A." <[email protected]> Date: March 16, 2011 12:30:51 PM CDT To: "[email protected]" <[email protected]> Subject: INFO: IG Audit Update
All,
CSPO has settled on dates for external and internal vulnerability scanning. The external scanning will begin on or around March 28th and continue for about a week. Internal Scanning will start on or around May 2nd and continue for approximately 2 weeks.
What can you do now? Please review external (outside the firewall scan results in Scavenger), if there are any outstanding vulnerabilities that need addressing and you need help, please contact the CSPO. CSPO has been reviewing results and may be contacting specific divisions.
We have also gotten word that they will be focusing on webapps. CSPO will increase our scanning using tools that the auditors will be using to scan our webapps space. This may result in online forms being submitted, so be on the watch-out for those.
We have submitted a NO-scan list that will include items from our last external audit (mostly visitor and non-ANL entities) which was vetted by the CSPR’s and the CSPO. This list hasn’t had much churn or change and we were very comfortable with the last audit results generated from this list.
CSPO has only come to an agreement for external scanning(most hosts are protected by the Tier 1). The internal scanning agreement has not been finalized. If you have production nets (Like APS) that are running experiments during the early May timeframe, please let the CSPO know so we can assess the risk of the auditors scanning your nets.
-- Matt Kwiatkowski M.S.I.S. Cyber Operations Lead Argonne Cyber Security Program Office
Argonne National Laboratory http://www.anl.gov 9700 South Cass Avenue Bldg 240 Office 4110 Argonne, IL 60439
[email protected] Phone (630) 252-6465 Fax (630) 252-9689
HEALTH WARNING: Care should be taken when lifting this e-mail, since its mass, and thus its weight, is dependent on its velocity relative to the user.
Thanks for the reminder - I thought I'd sent this on. On Mar 18, 2011, at 14:34 , Tina Stanton-Piersanti wrote:
Do we need to prepare for this at all??
Tina.
Begin forwarded message:
From: "Kwiatkowski, Matthew A." <[email protected]> Date: March 16, 2011 12:30:51 PM CDT To: "[email protected]" <[email protected]> Subject: INFO: IG Audit Update
All,
CSPO has settled on dates for external and internal vulnerability scanning. The external scanning will begin on or around March 28th and continue for about a week. Internal Scanning will start on or around May 2nd and continue for approximately 2 weeks.
What can you do now? Please review external (outside the firewall scan results in Scavenger), if there are any outstanding vulnerabilities that need addressing and you need help, please contact the CSPO. CSPO has been reviewing results and may be contacting specific divisions.
We have also gotten word that they will be focusing on webapps. CSPO will increase our scanning using tools that the auditors will be using to scan our webapps space. This may result in online forms being submitted, so be on the watch-out for those.
We have submitted a NO-scan list that will include items from our last external audit (mostly visitor and non-ANL entities) which was vetted by the CSPR’s and the CSPO. This list hasn’t had much churn or change and we were very comfortable with the last audit results generated from this list.
CSPO has only come to an agreement for external scanning(most hosts are protected by the Tier 1). The internal scanning agreement has not been finalized. If you have production nets (Like APS) that are running experiments during the early May timeframe, please let the CSPO know so we can assess the risk of the auditors scanning your nets.
-- Matt Kwiatkowski M.S.I.S. Cyber Operations Lead Argonne Cyber Security Program Office
Argonne National Laboratory http://www.anl.gov 9700 South Cass Avenue Bldg 240 Office 4110 Argonne, IL 60439
[email protected] Phone (630) 252-6465 Fax (630) 252-9689
HEALTH WARNING: Care should be taken when lifting this e-mail, since its mass, and thus its weight, is dependent on its velocity relative to the user.
participants (2)
-
Craig Stacey -
Tina Stanton-Piersanti