I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the sites to share data with each other across our WAN.

I have been recently tasked with the following objective to be completed within 4 months:

Produce a report giving a risk analysis of the security weaknesses in our software suite and infrastructure, with current and proposed mitigations.

This will be the first time that this kind of analysis is performed on our system and, not having any significant security experience, I am not sure where to begin.

So, my question is: how should I best approach an analysis of the risks and vulnerabilities of an enterprise software system and the infrastructure that surrounds it?

Or, to put it another way, how should I break down the task of analysing the security of our system and our infrastructure?

Please note that there is a separate team at another site that is responsible for general network security.

Are there any recommended resources (websites, books, etc) to which I should refer?

closed as too broad by TildalWave, Xander, Adi, Steve, Scott Pack Mar 23 '14 at 16:09

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    With you having little to no security experience, might I suggest that step one be to find someone with that kind of experience to work on the project? – Stephen Touset Mar 22 '14 at 0:03
  • I agree that it was a very broad question. I think the fact that I have not been accustomed to break down the issue of software security into smaller components meant that my question would lack precision. – David Brower Mar 24 '14 at 9:36

Risk assessments are really an ongoing task, because your report will produce a result which is based on the known vulnerabilities as of today. Obviously new vulnerabilities are being discovered all the time, so the risk assessment must be carried out periodically in order to give your management the most current information.

There are different types of risk assessments which could apply to this situation.

If you are an analyst and wish to understand if and where you have vulnerabilities, then an automated vulnerability scanner could be used to produce an assessment of the application and infrastructure it is running on. Take a look at Nessus or Qualys, however there are many other options.

If you are a software engineer or similar and you have a good understanding of the business requirements and process flow of the application in question, then you could undertake a threat modelling exercise. This will allow you to analyse the data flows and data models to identify areas of risk. This can help to define security controls which can be implemented in the software application itself. It can also identify areas where other diverse controls, such as firewalls, IDS/IPS or WAF, may be deployed.

If you have already deployed your application and you need to understand if it is vulnerable to compromise, where those vulnerabilities are and what the impact of the vulnerabilities are to the data, then a penetration test may be useful.

For a more mature organisation, then risk management is a continuous process that leads to continual improvement. Look into ISO 27001 and ISO 27005 for a standard approach to information security risk management.

  • That's exactly what I was looking for. Many thanks. – David Brower Mar 23 '14 at 22:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.