Letter: Vendors can't solve all vulnerabilities, so use multiple assessment tools

Regarding "FAR Council issues final security configuration rule," a reader writes: It is virtually impossible for a vendor to ensure that all computer vulnerabilities are removed. However, the following is a guide which contract officers could use in contracts:

"The contractor shall ensure that all well-known vulnerabilities removed or mitigated prior to system testing and acceptance."

Vulnerability assessment tools such as the Real Secure Internet Security Scanner, Nessus, and The Harris STAT scanner are excellent tools which could be used to evaluate and assess software systems. It is recommend that multiple scanning tools be used since they are on different
production lines and different discovery methods.


Anonymous



What do you think? Paste a comment in the box below (registration required), or send your comment to [email protected] (subject line: Blog comment) and we'll post it.

Featured

  • Comment
    Diverse Workforce (Image: Shutterstock)

    Who cares if you wear a hoodie or a suit? It’s the mission that matters most

    Responding to Steve Kelman's recent blog post, Alan Thomas shares the inside story on 18F's evolution.

  • Cybersecurity
    enterprise security (Omelchenko/Shutterstock.com)

    Does Einstein need a post-SolarWinds makeover?

    A marquee program designed to protect the government against cybersecurity threats is facing new scrutiny in the wake of Solar Winds Orion breach, but analysts say the program was unlikely to have ever stopped the hacking campaign.

Stay Connected