Assessment Function

The Cyber Security Assessment Team was established as a specialized team within the Central Bank of Jordan's FinCERT Unit. Its core mission is to safeguard entities under the supervision and control of the Central Bank of Jordan from escalating cyber threats and to ensure their preparedness in responding to potential cyberattacks. The team employs a multi-layered approach to cybersecurity, conducting thorough and precise security assessments using state-of-the-art technologies and advanced methodologies. Additionally, it conducts comprehensive testing on systems and networks at multiple levels. The primary objective is to identify security vulnerabilities and cyber risks—whether internal or external—that attackers could exploit, while ensuring full compliance with the security standards and controls mandated by the FinCERT Unit. The team also aligns its practices with national and international cybersecurity frameworks and best practices. The Cyber Security Assessment Team's scope of work includes four key areas:

External Vulnerability Assessment and Penetration Testing: This includes examining systems, networks, and applications accessible from outside the entity to identify and exploit vulnerabilities that external attackers could potentially target. The assessment includes an extensive intelligence-gathering phase to collect information on the entity’s public-facing assets, which is then used to simulate external attack scenarios. The goal is to identify and mitigate potential risks, while verifying the effectiveness of external security defences in protecting sensitive data and assets from external threats.

Internal Vulnerability Assessment and Penetration Testing: This includes identifying weaknesses within the entity's internal systems, networks, and applications. By simulating internal attack scenarios, the team uncovers risks that could be exploited by malicious actors within the entity. This process also ensures the robustness of internal security measures and validates compliance with industry-standard cybersecurity best practices, particularly in defending against insider threats.

Network and Infrastructure Security Assessment: This includes a thorough security audit of the entity's network architecture, infrastructure, systems, and applications, including an evaluation of network design and operational processes. The assessment aims to identify misconfigurations or gaps in the protection system settings that could expose the network to cyber threats. Ensuring optimal configuration and adherence to the highest security standards protects against a wide range of attacks, including those targeting network infrastructure.

Governance, Risk Management, and Compliance (GRC): This includes reviewing the entity’s security policies, procedures, and compliance frameworks to ensure they are up-to-date and effectively implemented. This involves performing detailed risk analysis to ensure the entity's alignment with national and international cybersecurity best practices. Additionally, this ensures that critical governance principles—such as segregation of duties and the appropriate distribution of roles and responsibilities—are in place, mitigating conflicts of interest and enhancing the security of internal processes. Through these comprehensive efforts, the FinCERT Unit aims to provide robust protection to the financial sector entities under its supervision. By identifying and mitigating vulnerabilities and ensuring adherence to the latest cybersecurity standards, the team enhances the sector's resilience against evolving digital threats in an ever-advancing technological landscape.