Assessing Vulnerabilities
What is a Vulnerability?
A vulnerability is a weakness or flaw in a computer
system, network, or software that can be exploited
by an attacker to gain unauthorized access or
cause damage
Common Types of Vulnerabilities
Software bugs: Errors in software code that can be
exploited.
Configuration errors: Incorrect settings that expose systems
to risks.
Weak passwords: Easily guessable passwords that can be
cracked.
Outdated software: Systems without the latest security
patches.
Social engineering: Manipulating people to divulge sensitive
information.
Vulnerability Assessment
Classification (Based on Scope)
Network-based Vulnerability Assessment: This involves
scanning the network for vulnerabilities like open ports, weak
passwords, and outdated software.
Host-based Vulnerability Assessment: This focuses on
individual systems, such as servers and workstations, to
identify vulnerabilities in operating systems, applications, and
configurations.
Application Vulnerability Assessment: This specifically
targets web applications to find vulnerabilities like SQL
injection, cross-site scripting (XSS), and others.
Database Vulnerability Assessment: This evaluates the
security of databases to identify weaknesses in database
configurations, access controls, and data protection.
Wireless Network Vulnerability Assessment: This
examines wireless networks for vulnerabilities in access
points, encryption, and authentication.
Cloud-based Vulnerability Assessment: This focuses on
identifying vulnerabilities in cloud infrastructure and
applications, such as misconfigurations, access controls, and
data exposure.
Vulnerability Assessment -
Methodology
Vulnerability Assessment can be classified into two main
types based on methodology
Manual Vulnerability Assessment
Automated Vulnerability Assessment
What is Manual Vulnerability
Assessment?
Manual vulnerability assessment is a crucial component of a
comprehensive security assessment.
While automated tools provide a good starting point, human
expertise is essential to identify subtle vulnerabilities and
understand the potential impact of threats
Manual Vulnerability Assessment Process -
Breakdown
Asset Management
Asset Identification and Prioritization:
Identify critical systems: Determine which systems and
applications are most important to the organization.
Prioritize assets: Rank assets based on their value and
sensitivity.
Threat Modeling
Identify potential threats: Determine the types of threats that could target your organization
(e.g., internal, external, natural).
Analyse attack vectors: Consider how an attacker might gain access to your systems.
Assess impact: Evaluate the potential consequences of a successful attack.
Manual Code Review:
Examine code for vulnerabilities: Scrutinize code for common vulnerabilities like SQL injection,
cross-site scripting (XSS), buffer overflows, and others.
Follow coding standards: Ensure code adheres to secure coding practices.
Peer review: Conduct code reviews with other developers.
Configuration Review
Check system settings: Verify that systems are configured according to
security best practices.
Review access controls: Ensure that access to systems and data is
restricted to authorized personnel.
Verify encryption: Check that sensitive data is encrypted at rest and in
transit.
Vulnerability Management: Utilize vulnerability databases for
information on software vulnerabilities and mitigation strategies:
US CERT Vulnerability Database (Link to US CERT): The US CERT
Vulnerability Notes Database is a valuable resource for information
on software vulnerabilities. Operated by the CERT Division of
Carnegie Mellon University, it provides detailed analyses and
recommendations for mitigating vulnerabilities.
National Vulnerability Database (NVD) (Link to NVD database): The
National Vulnerability Database (NVD) maintained by NIST provides
standardized vulnerability information, including CVSS scores, which
can be used for risk assessment.
Social Engineering and Physical Security
Social Engineering Assessment:
Evaluate employee awareness: Assess how well employees understand social
engineering tactics.
Conduct phishing simulations: Test employees' ability to identify and respond to
phishing attacks.
Physical Security Assessment:
Inspect facilities: Evaluate physical security measures like access controls,
surveillance, and environmental protection.
Identify vulnerabilities: Look for weaknesses in physical security that could lead to
unauthorized access.