Letter: Vendors can't solve all vulnerabilities, so use multiple assessment tools

Regarding "FAR Council issues final security configuration rule," a reader writes: It is virtually impossible for a vendor to ensure that all computer vulnerabilities are removed. However, the following is a guide which contract officers could use in contracts:

"The contractor shall ensure that all well-known vulnerabilities removed or mitigated prior to system testing and acceptance."

Vulnerability assessment tools such as the Real Secure Internet Security Scanner, Nessus, and The Harris STAT scanner are excellent tools which could be used to evaluate and assess software systems. It is recommend that multiple scanning tools be used since they are on different
production lines and different discovery methods.


Anonymous



What do you think? Paste a comment in the box below (registration required), or send your comment to [email protected] (subject line: Blog comment) and we'll post it.

Featured

  • Management
    shutterstock image By enzozo; photo ID: 319763930

    Where does the TMF Board go from here?

    With a $1 billion cash infusion, relaxed repayment guidelines and a surge in proposals from federal agencies, questions have been raised about whether the board overseeing the Technology Modernization Fund has been scaled to cope with its newfound popularity.

  • IT Modernization
    shutterstock image By enzozo; photo ID: 319763930

    OMB provides key guidance for TMF proposals amid surge in submissions

    Deputy Federal CIO Maria Roat details what makes for a winning Technology Modernization Fund proposal as agencies continue to submit major IT projects for potential funding.

Stay Connected