Letter: Vendors can't solve all vulnerabilities, so use multiple assessment tools

Regarding "FAR Council issues final security configuration rule," a reader writes: It is virtually impossible for a vendor to ensure that all computer vulnerabilities are removed. However, the following is a guide which contract officers could use in contracts:

"The contractor shall ensure that all well-known vulnerabilities removed or mitigated prior to system testing and acceptance."

Vulnerability assessment tools such as the Real Secure Internet Security Scanner, Nessus, and The Harris STAT scanner are excellent tools which could be used to evaluate and assess software systems. It is recommend that multiple scanning tools be used since they are on different
production lines and different discovery methods.


Anonymous



What do you think? Paste a comment in the box below (registration required), or send your comment to letters@fcw.com (subject line: Blog comment) and we'll post it.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.