ABC Security consulting provides security consulting services to a wide range on businesses, individuals, schools and organizations. Because of its reputation and increasing demand for its services, ABC has partnered with a local school to hire students close to graduation to assist them on specific projects. This not only helps ABC with their projects but also provides real world experience to students who are interested in the security field. Rozenboom Real Estate (RRE) buys and sells high-end residential and commercial real estate across a multistate region. One of the tools that RRE offers is a sophisticated online website that allows potential buyers to take a virtual tour of properties. However, RREs site was recently compromised by attackers who defaced the site with malicious messages, causing several customers to threaten to withdraw their listings. RREs senior management has demanded a top-to-bottom review of their security by an independent third party. ABC has been hired to perform the review, and they have contracted with you to work on this project.

1. The first task is to perform a vulnerability assessment of RRE. Create a report for the president and his staff about the steps in vulnerability assessment. List in detail the actions under each step and what RRE should expect in the assessment.

2. One of the activities recommended by ABC is to perform a penetration test. However, the IT staff is very resistant to the idea and has tried to convince RREs senior management that it is too risky and that a vulnerability scan would serve the same purpose. RRE has asked you for your opinion of performing a penetration test or vulnerability scan. Create a memo that outlines the differences and what your recommendation would be.