I've got almost everyone's report material and I'm making an effort to
get this report draft finalized in the next couple of days. I will send
out the report draft when it is ready and will give you guys about 36 -
48 hours to review it before I forward it on to Weber. I may muck
around with wording and structure in the write-ups you have all given me
for consistency in voice and what not. If I completely mung up what you
intended to convey to Weber let me know and we can re-work things.
A couple of things related to the report that I need some feedback from
you on:
1. Jake has suggested we put some high-level recommendations drawn from
the rest of the report directly in the executive summary. We haven't
really done this in the past, just summarized what the format of the
rest of the report would be. If we start doing this, it should be
really concise in my thinking, but could be something along the lines of
recommending Two-factor authentication, seperate administrative
accounts, banning of all wireless devices, etc. Let me know what you
think should be in that section.
2. In the past, we have included verbatim from the SANS controls the
"How attackers take advantage of the lack of these controls" and the
SANS recommendations "How to Implement, Automate, and Measure the
Effectiveness of this Control" as part of our write-ups on each SANS
control. I'm toying with the idea of dropping this practice of directly
quoting all the SANS stuff and moving it to the references section.
This would require us to beef up our own recommendations and make sure
we mention that they should review the references to the SANS material.
Thoughts?
Lastly, does anybody have a PDF copy of the 2012ish SANS controls laying
around? They are up to version 4.1 and I know there are some
differences in the versions I want to review. I haven't scoured the
internet looking for the older version yet, will do if one of you can't
bail me out.
Thanks,
Andrew
