Letter: Vendors can't solve all vulnerabilities, so use multiple assessment tools

Regarding "FAR Council issues final security configuration rule," a reader writes: It is virtually impossible for a vendor to ensure that all computer vulnerabilities are removed. However, the following is a guide which contract officers could use in contracts:

"The contractor shall ensure that all well-known vulnerabilities removed or mitigated prior to system testing and acceptance."

Vulnerability assessment tools such as the Real Secure Internet Security Scanner, Nessus, and The Harris STAT scanner are excellent tools which could be used to evaluate and assess software systems. It is recommend that multiple scanning tools be used since they are on different
production lines and different discovery methods.


Anonymous



What do you think? Paste a comment in the box below (registration required), or send your comment to [email protected] (subject line: Blog comment) and we'll post it.

Featured

  • Oversight
    President of the United States of America, Donald J. Trump, attends the 2019 Army Navy Game in Philadelphia, Pa., Dec. 14, 2019. (U.S. Army photo by Sgt. Dana Clarke)

    Trump shakes up official watchdog ranks

    The White House removed an official designated to provide oversight to the $2 trillion rescue and relief fund and nominated a raft of new appointees to handle oversight chores at multiple agencies.

  • Workforce
    coronavirus molecule (creativeneko/Shutterstock.com)

    OMB urges 'maximum telework flexibilities' for DC-area feds

    A Sunday evening memo ahead of a potentially chaotic commute urges agency heads to pivot to telework as much as possible.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.