A newly joined employee. Janet, has been allocated an existing system used by a previous employee. Before issuing the system to Janet, it was…

The assessment performed by Martin is a host-based assessment. This type of assessment focuses on the security posture of a single machine (a host). It involves analyzing the system's internal configuration, including user directories, registry settings, file system permissions, and installed software configurations, to identify vulnerabilities. The specific issues Martin identified, such as incorrect permissions and configuration errors, are characteristic findings of a detailed examination of an individual host's operating system and applications.

A. Credentialed assessment: This describes the method of scanning (i.e., using valid credentials to log in) rather than the target of the assessment. While a host-based assessment is often credentialed, the primary type is defined by its focus on the host.

B. Database assessment: This is a specialized assessment that focuses exclusively on identifying vulnerabilities within database management systems (e.g., SQL injection, weak credentials, misconfigurations), which is not what was described.

D. Distributed assessment: This type of assessment is used for evaluating security across multiple, often geographically separate, systems in a network, whereas Martin's task was focused on a single, standalone system.

1. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment: Section 4.3.2

"Host-Based Scanners

" states

"Host-based scanners are installed on the host system to be reviewed... They can often provide even more information than network-based scanners by reviewing system configuration files

password files

and system logs." The vulnerabilities Martin found (registries

file permissions

configuration errors) align directly with this definition.

2. Purdue University

CS 42600 - Computer Security Courseware: In lectures on "Vulnerability Analysis

" host-based vulnerability analysis is defined as the process of examining a specific host for security weaknesses. This includes checking for misconfigurations

insecure file permissions

and outdated software

which directly corresponds to the activities performed by the administrator in the scenario.

3. Kim

D.

& Solomon

M. G. (2016). Fundamentals of information systems security (3rd ed.). Jones & Bartlett Learning. Chapter 7

"Security Operations

" describes host-based vulnerability scanning as a method to "identify vulnerabilities on an internal system" by examining its configuration

patch levels

and local security settings. This aligns with the assessment of an existing system's parameters

registries

and permissions.