Which of the following assessment methodologies defines a six-step technical security evaluation?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The assessment methodology that defines a six-step technical security evaluation is DITSCAP (Department of Defense Information Technology Security Certification and Accreditation Process).
DITSCAP is a standard methodology used by the US Department of Defense to assess and authorize information systems for use in their environment. It is a risk management process that provides a standardized approach to the security evaluation and accreditation of information systems. The six-step technical security evaluation in DITSCAP includes the following:
Definition of the System: The first step involves defining the information system and its security requirements.
Certification of the System: The second step is to assess the system's compliance with security policies and procedures.
Accreditation of the System: The third step is to authorize the system for use by the organization.
Continuous Monitoring: The fourth step is to continually monitor the system's performance and security posture.
Reaccreditation of the System: The fifth step is to reevaluate and reauthorize the system periodically or when significant changes occur.
Decommissioning of the System: The final step is to retire or decommission the system when it is no longer required.
FITSAF (Federal Information Technology Security Assessment Framework) is a methodology used by the US government to evaluate the security posture of federal agencies' information systems.
FIPS (Federal Information Processing Standards) 102 is a standard that provides guidelines for safeguarding unclassified sensitive information in computer systems.
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a risk assessment methodology developed by the Software Engineering Institute (SEI) at Carnegie Mellon University. OCTAVE focuses on identifying and prioritizing an organization's critical assets, the threats to those assets, and the vulnerabilities that could be exploited by those threats.