Okaloosa County BOCC — April 5, 2016 — Letter of Engagement for IT Risk Assessment — reading text

proprietary tools to identify vulnerabilities residing in web applications. Unidentified web application vulnerabilities could lead to compromise of both web servers and backend database servers which leads to the loss of confidential and\or proprietary information. Vulnerabilities identified in the web application assessment include:  SQL Injection  Command Injection  Cross Site Scripting  Parameter Manipulation  Buffer Overflows  Broken Access Control  Broken Authentication and Session Management  Error Handling  Invalidated Parameters  Insecure Configuration Management Our assessments are based on industry security standards and best practices including OWASP Web Application Security Standards. Testing methodologies consist of the following three phases:  Information Gathering – The tester gathers information about the web application, including number of pages, forms, user names and passwords and access points into the application.  Passive Application Logic Identification – The tester tries to understand the logic behind the application and develop a method for further testing.  Active Vulnerability Identification – The tester uses a variety of testing methodologies to identify and validate vulnerabilities found during previous testing. A rules of engagement letter will be executed prior to initiating actual network penetration and web application testing, authorizing this activity. The rules of engagement letter will define the specific time window and targets for testing, and will provide notification and controls guidance specific to this testing. Warren Averett Technology Group suggests testing web applications annually or after any network or software changes that affect the application architecture. Our application testing team holds industry certifications relevant to penetration and web application testing (i.e. Web Application Penetration Tester (WAPT), Certified Penetration Tester (CPT), Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP)). 6 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com PROJECT SCOPE: DETAIL Step 1. System Characterization The first step in assessing the state of information technology and associated risk is to define the scope of the effort. To do this, WATG will identify where mission critical data and PII (Personal Identifiable Information) is created, received, maintained, processed, or transmitted. Using information‐gathering techniques, the IT system boundaries are identified, as well as the resources and the information that constitute the system. Taken into consideration will be functional priorities for systems and applications, organizational policies, regulations, the distributed work force, and removable media and portable computing devices (e.g., laptops, tablets, smartphones, removable media, and backup media). WATG will examine the following network architecture with an emphasis on availability, proper controls, capacity, and user access integrity. a. Server Configuration and Network Devices – Review of wiring and switching infrastructure, routers, hubs, wireless access points, etc. Check for capacity issues related to the existing data footprint versus projected data growth, CPU, memory, server operating system, and hardware warranty. b. Applications – E‐mail, database, web services, Anti‐Virus, and Anti‐Malware c. Security Implementation – Firewall configuration, segmentation, access controls, content filtering, data loss prevention, encryption, endpoint and mobile device management, logging and auditing. d. Disaster Recovery/Business Continuity capabilities – Backups, recovery time objective and the number of recovery points available. Off‐site backups. e. Remote Access Setup – VPN, terminal server, Citrix, etc. f. Printing Configurations – Shared, network printers, scanning g. Environmental Conditions – Proper server room temperature and temperature monitoring and alerts. Physical access to network hardware. Output – Characterization of the IT system assessed, a good picture of the IT system environment and the most critical assets, and delineation of system boundary. Step 2. Threat Identification For this step, potential threats (the potential for threat‐sources to successfully exercise a particular vulnerability) are identified and documented. A threat‐source is any circumstance or event with the potential to cause harm to an IT system (intentional or unintentional). Common threat‐sources can be natural, human, or environmental (refer to the NIST SP 800.30 Threat Source List for examples). Tailor the list based on the individual organization and its processing environment. Output – A threat statement containing a list of threat‐sources that could exploit system vulnerabilities. 7 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com Step 3. Vulnerability Identification The goal of this step is to develop a list of technical and non‐technical system vulnerabilities (flaws or weaknesses) that could be exploited or triggered by the potential threat‐sources. Vulnerabilities can range from incomplete or conflicting policies that govern an organization’s computer usage to insufficient safeguards to protect facilities that house computer equipment, to any number of software, hardware, or other deficiencies that comprise an organization’s computer network. Output – A list of the system vulnerabilities (observations) that could be exercised by the potential threat‐sources. Step 4. Control Analysis The goal of this step is to document and assess the effectiveness of technical and non‐technical controls that have been or will be implemented by the organization to minimize or eliminate the likelihood (or probability) of a threat‐source exploiting a system vulnerability. Output – List of current or planned controls (policies, procedures, training, technical mechanisms, etc.) used for the IT system to mitigate the likelihood of a vulnerability being exercised and reduce the impact of such an adverse event. Step 5. Control Recommendations The purpose of this step is to identify controls that could reduce or eliminate the identified risks, as appropriate to the organization’s operations. The goal of these controls is to reduce the level of risk to the system and data to an acceptable level. Factors to consider when developing controls may include effectiveness of recommended options (i.e. system compatibility), legislation and regulation, organizational policy, operational impact, and safety and reliability. Control recommendations provide input to the risk mitigation process, during which the recommended procedural and technical security controls are evaluated, prioritized, and implemented. Control recommendations for data security will be considered against technology improvements needed to address obsolescence, improve operational efficiency and advance business continuity. Output – Recommendation of control(s) and alternative solutions to mitigate risk and to advance information systems processes and management. Step 6. Results Documentation Results of the General IT assessment are documented in an official report or briefing and provided to the County Commissioners and management stakeholders to make decisions on policy, procedure, budget, and system operational and management changes. Output – A General IT assessment report that describes the state of the existing information systems technology, its associated threats and vulnerabilities and provides a roadmap of recommendations for technology improvements and controls implementation. 8 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com FEE SCHEDULE Warren Averett Technology Group estimates that this project will involve several members of our team who each work at a rate commensurate to experience and role. To ensure a successful project and an accurate estimate for cost, we are pleased to present the expertise defined in the Scope of Services section for a fee of $48,500 The terms of this agreement shall commence upon the date of approval by both parties and will remain in effect until completion of the project. WARREN AVERETT TECHNOLOGY GROUP RESPONSIBILITES In order to ensure a successful engagement throughout the term of this agreement, Warren Averett Technology Group accepts the following responsibilities: 1. Furnish consultants possessing the skills necessary to perform the services described in this agreement. 2. While on company premises, we will respect and work under the management and direction of the point of contact at the Okaloosa County Board of County Commissioners. 3. Provide services and schedule actions which may interrupt business production, whether remotely or onsite, in accordance to the direction of management of the Okaloosa County Board of County Commissioners. CLIENT RESPONSIBILITIES In order to ensure a successful engagement throughout the term of this agreement, some responsibilities do exist for Okaloosa County Board of County Commissioners’ management: 1. Management is responsible for decisions and functions, and for designating a competent employee to oversee all information technology and consulting services provided by Warren Averett Technology Group. 2. Management is also responsible for evaluating the adequacy and results of the services performed and accepting responsibility for such services. 3. It is understood and acknowledged that the management of Okaloosa County Board of County Commissioners is responsible to establish and maintain a system of internal accounting controls. Warren Averett Technology Group and its affiliates are not and cannot be responsible for the design, establishment or maintenance of the company’s system of internal accounting controls. 4. Management of Okaloosa County Board of County Commissioners will provide Warren Averett Technology Group personnel with access to company premises and will ensure a management representative is present and available to Warren Averett Technology Group personnel while on company premises performing this engagement. 9 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com PROJECT TEAM JASON ASBURY President and Member Project Leader D 334.260.2402 | F 334.274.1500 │ Montgomery, AL Jason.Asbury@warrenaverett.com Jason Asbury has fifteen years of experience working in