Security and Privacy Control Technical Testing Sample Clauses

Security and Privacy Control Technical Testing. To conduct security technical testing, the state grants assessor staff user access to the application or system. The state system administrator establishes application-specific user accounts for the assessor that reflect the different user types and roles. Through this access and these accounts, 5 Available at: xxxxx://xxxx.xxxx.xxx/publications/detail/sp/800-53a/rev-4/final. Centers for Medicare & Medicaid Services the assessor can perform a thorough assessment of the application or system and test application and system security controls that might otherwise not be tested. The assessor should not be given a user account with a role that would allow access to PHI/PII in any application or database. The assessor should attempt to expose vulnerabilities associated with gaining unauthorized access to the application or system resources by selecting and employing tools and techniques that simulate vulnerabilities, such as buffer overflows and password compromises. The assessor must use caution to ensure against any inadvertent alteration of important settings that may disable or degrade essential security or business functions. Because many automated testing utilities mimic signs of attack and/or exploit vulnerabilities, the assessor must identify in the SAP all proposed tools that pose a risk to the computing environment. Furthermore, any testing that could potentially expose PHI/PII must be performed under the direct supervision of an authorized individual who is responsible for the data and can monitor the assessor’s actions and take appropriate measures to protect any data that is vulnerable to exposure.