Letter: Vendors can't solve all vulnerabilities, so use multiple assessment tools

Regarding "FAR Council issues final security configuration rule," a reader writes: It is virtually impossible for a vendor to ensure that all computer vulnerabilities are removed. However, the following is a guide which contract officers could use in contracts:

"The contractor shall ensure that all well-known vulnerabilities removed or mitigated prior to system testing and acceptance."

Vulnerability assessment tools such as the Real Secure Internet Security Scanner, Nessus, and The Harris STAT scanner are excellent tools which could be used to evaluate and assess software systems. It is recommend that multiple scanning tools be used since they are on different
production lines and different discovery methods.


Anonymous



What do you think? Paste a comment in the box below (registration required), or send your comment to [email protected] (subject line: Blog comment) and we'll post it.

Featured

  • Workforce
    online collaboration (elenabsl/Shutterstock.com)

    Federal employee job satisfaction climbed during pandemic

    The survey documents the rapid change to teleworking postures in government under the COVID-19 pandemic.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    OPM nominee plans focus on telework, IT, retirement

    Kiran Ahuja, a veteran of the Office of Personnel Management, told lawmakers that she thinks that the lack of consistent leadership in the top position at OPM has taken a toll on the ability of the agency to complete longer term IT modernization projects.

Stay Connected