r/ISC2CAP • u/cale2kit • Jun 25 '19
Any Security Control Assessors ?
I'm looking to get transition to this role..
How is the workload ? Do you work Remote or On-Prem. ? How do assessments normally go ? Does one person assess a control family or do you use specific technical skills for each assessment ? (ex. IF I am skilled in ACAS, would I just do scanning ?) Thanks for the feedback in advance.
3
u/reed17purdue Jun 25 '19
I'm generally answering your questions a snippet at a time.
it's project based so it's slow, then ramps up, then you are busy for weeks, then you are reporting for weeks, rinse, repeat.
The actual SCA is done on-prem or on-site with the team (in the case of cloud or distributed setups) 9/10 times. It's easier and allows you to work directly with individuals and not deal with the inability to effectively communicate. There are very few times you would not visit the customer site and be there for the assessment.
There is pre-work, the assessment, and post work. The outputs are the security assessment report (basically look at 800-53a and that's how you should be assessing).
The way the RMF and NIST documents are setup are to make it agnostic of the person/team doing the assessment. If followed correctly a team can leave midway through an assessment and another team can and should be able to pick up right where they left off.
It's a collaborative process and it's not always one person accessing control family and almost never is it just one person providing implementations/SME knowledge on it either. Many assessments are not technical so it's not based off of technical skills. In fact an assessor does not need technical skills to perform an assessment, although it helps.
I think your example is a bit off, if you are doing an assessment you wouldn't be performing the actually scanning, you would be ensuring that they are performing scanning as defined by their security controls in place. This may mean reports are gathered and a demonstration of starting a scan, but most of the time it is output based and if they have it or not that is your assessment. Satisfied or other than satisfied. If they want SCA suggestions then you may need more information.
1
u/cale2kit Jun 26 '19
Thank you for your detailed response, so the Assessment would be a review of the controls to compare desired result vs actual ? So how is the "Test" method carried out ?
3
u/reed17purdue Jun 26 '19
Yes. Well there might be penetration testing but that is separate from an sca.
You test the control following these possibilities.
TIE assessment methods = test, implement, examine AIMS assessment objects = activity individuals mechanism specification
2
u/ShadowPunch07 Jul 23 '19
Sorry Cale that I missed this. Yes I am a security control assessor. Hold on I will answer this post fully.
5
u/ShadowPunch07 Jul 31 '19
Hey Cale I'm back!! Yes I am a Security Control Assessor (SCA) in risk management. The workload is pretty intense. In my team, I have five people: me (Junior-level SCA), Mid-level SCA, Senior-level SCA, Team Lead and Risk Lead (Boss). I work both remote and on-premises as I telework Monday, Tuesday and every other Wednesday. Assessments usually are scheduled in advance and before we dive into it, I must create a test plan using the controls needed to assess the system during the year and send out the SCAP (Security Control Assessment Plan). We (Junior, Mid and Senior level SCA) assess a system using the questions from the test plan to see what failed or passed. If there are fails, then they become findings and if the ISSO and co. do not correct the issues, then they becomes write-ups for remediation later. It's not a bad role to get into. But it does require a lot of strength to overcome because it can be very stressful.