Untitled

• Vulnerability assessment is a process to identify, quantify, and prioritize vulnerabilities
• It aims to uncover weaknesses that malicious actors could exploit to compromise information integrity, confidentiality, or availability
• Vulnerability assessments can be performed on various layers of an organization's infrastructure like hardware, software, network configurations, and human interactions
• Conducting vulnerability assessments is primarily needed to identify potential risks before they are exploited by attackers

Importance and Reasons

• Prevents data breaches by helping to detect weaknesses and patch them before they can be exploited, protecting sensitive data
• Compliance requirements in industries like HIPAA, GDPR, and PCI-DSS require regular vulnerability assessments
• These assessments ensure organizations meet the industry standards and avoid legal consequences
• Enables a proactive approach to cybersecurity, preventing attacks and saving time, money, and reputation
• Minimizes the attack surface by reducing the exploitable entry points for attackers
• Facilitates risk management by evaluating the risk level of each vulnerability and prioritizing remediation based on severity, exploitability, and potential impact

Types of Vulnerability Assessment

• Methods and tools exist to perform vulnerability assessments, each suited to specific purposes
• Network vulnerability assessments identify unsecured ports, misconfigurations, outdated protocols, and weak passwords in network infrastructure
• Focuses on web applications that might be exposed to the internet
• Identifies vulnerabilities like SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF) in websites and web services
• Host-based vulnerability assessment scans individual devices for outdated software, missing patches, and misconfigurations that are exploitable
• Database vulnerability assessment identifies weaknesses in database configurations, access controls, and security settings
• Wireless network vulnerability assessment checks for weak encryption (WEP/WPA), poor configuration, and unauthorized access points

Vulnerability Assessment Process

• Planning and scoping involves defining the scope of the assessment and determining which systems, applications, and networks need to be assessed
• Automated tools scan the network, servers, databases, or web applications to detect vulnerabilities
• Examples include Nessus, OpenVAS, and Qualys
• Vulnerability identification involves identifying known vulnerabilities such as outdated software, system errors, weaknesses in encryption protocols, and cross-referencing findings with threat intelligence databases (CVEs)
• Risk evaluation analyzes how likely an exploit could happen and the potential impact
• Critical vulnerabilities that allow remote code execution are more severe than informational disclosures
• Create a report that includes a list of identified vulnerabilities, risk levels, remediation recommendations, suggested patches, configurations, or updates, and proposed timelines for addressing issues
• Corrective actions can include installing patches, reconfiguring systems, improving access controls, or tightening network security
• Ensure fixes were effective and that no new vulnerabilities have been introduced

Benefits

• Vulnerability assessments identify weaknesses before attackers can exploit them
• Fixing vulnerabilities early is more cost-effective than dealing with the aftermath of a successful attack, including legal costs, reputational damage, and fines
• Regular assessments assist organizations in continuously monitoring and improving their security posture
• Customers and stakeholders trust organizations that demonstrate strong security practices

Challenges

• Vulnerability scans can sometimes generate false alarms, making it difficult to determine urgent issues
• Can be especially time-consuming within large environments with complex infrastructures
• Requires skilled security professionals to analyze results and interpret the findings correctly
• New vulnerabilities are discovered regularly, requiring continuous monitoring and assessments to stay up-to-date

Risk Prevention in Cybersecurity

• Involves identifying potential risks, assessing their impact, and applying security measures to mitigate those risks before they lead to a breach

Risk Assessment Component

• Risk assessment identifies potential vulnerabilities in systems and evaluates the possible threats they pose, including external threats like hackers or internal threats like employee negligence
• Risk assessment tools and frameworks (e.g., NIST Cybersecurity Framework and ISO/IEC 27001) help identify, assess, and prioritize risks
• Vulnerability management involves identifying, classifying, prioritizing, and mitigating vulnerabilities in software, hardware, and systems
• Vulnerability scanners like Nessus, OpenVAS, or Qualys are often used for automated scanning and reporting
• Key aspects of vulnerability management include patching software regularly and ensuring security configurations are up to date

Network Security Measures

• Involves firewalls, intrusion detection/prevention systems (IDS/IPS), and encryption with technologies like VPNs or SSL/TLS
• Segmentation and the principle of least privilege (limiting network access based on role) can help reduce risks by limiting exposure

Security Awareness Training

• A critical preventive measure in which employees get regular training on phishing attacks, social engineering, safe practices, and understanding policies to minimize human error-related risks
• Simulated phishing exercises train staff and evaluate their ability to recognize threats

Multi Factor Authentication (MFA)

• Adds an extra layer of protection by requiring multiple verification methods (e.g., a password, biometric scan, and a one-time code) to access systems
• Significantly reduces the risk of unauthorized access from compromised credentials

Incident Response Plan

• Enables an organization to quickly contain and mitigate the threat
• Includes having an emergency team, clear communication channels, and procedures for data recovery and forensic analysis

Backups and Disaster Recovery

• Regular data backup ensures the organization can recover data and continue operations with ease in case of a cyberattack
• A disaster recovery plan outlines steps for restoring operations to normal after an attack, such as system restoration, data integrity checks, and system hardening

Encryption

• Keeps data safe even if attackers manage to breach a network
• Encryption methods like AES (Advanced Encryption Standard) or RSA ensure that data is unreadable without the proper decryption keys

Compliance Requirements in Cybersecurity

• Refers to adhering to established guidelines, regulations, and industry benchmarks by which organizations handle data, privacy, and security
• Non-compliance will lead to legal issues, financial penalties, and damage to an organization's reputation
• Aim to protect sensitive data and ensure transparency
• Common Cybersecurity Compliance Frameworks and Regulations include General Data Protection Regulation, Health Insurance Portability and Accountability Act, Payment Card Industry Data Security Standard, ISO/IEC 27001

General Data Protection Regulation (GDPR)

• Protects the privacy and personal data of EU citizens, applying to any organization that processes or stores said data
• Key GDPR requirements include data subject rights, the right to access data, data portability, and mandatory data breach notifications
• Non-compliance can result in fines of up to €20 million or 4% of annual global revenue, whichever is higher

Health Insurance Portability and Accountability Act (HIPAA)

• Governs protection of sensitive health information in the U.S.
• Ensures protection of patient data (PHI) from unauthorized access or disclosure, requiring safeguards
• Non-compliance can result in fines and legal action

Payment Card Industry Data Security Standard (PCI DSS)

• Designed to protect credit card and payment card information for organizations who store, process, or transmit card information
• Mandates strong encryption for cardholder data, secure authentication practices, and regular vulnerability assessments
• Violations can lead to fines, reputational damage, and the potential loss of the ability to process credit card payments

ISO/IEC 27001: Information Security Management Systems (ISMS)

• It provides a framework for establishing, implementing, maintaining, and continuously improving an ISMS
• Compliance with ISO 27001 helps organizations systematically manage sensitive company information, ensuring that it remains secure
• Importance: Risk Reduction, Customer Trust, Avoiding Legal and Financial Penalties, Competitive Advantage, Incident Handling and Data Breach Notification

Life Cycles of Vulnerability Assessment and Penetration Testing (VAPT)

• Security weaknesses inside of a system are identified in both these crucial processed
• Processes follow a detailed and structured lifecycle, which helps organizations understand and mitigate security risks
• Vulnerability assessment focuses on identifying and evaluating vulnerabilities
• Penetration testing simulates real-world attacks to exploit those vulnerabilities

Scoping: Most important step in Assessments and Penetration Testing

• Defining the goal is to clarify testing to systems, networks, and applications, and the level of testing (eg black box, white box testing)
• Consider - scope, determine assets, systems, and network segments
• Consider - Exclusions, clearly state systems out of scope for no evaluation
• Consider -Engagement Rules, defines types of testing like Denial of Service (Dos), limited testing times and which can't be used
• Consider - Testing types define internal or external, or social engineering techniques

Information gathering

• Collecting data about the target system for both assessments and penetration testing
• Identifies attack surface and potential vulnerabilities
• Includes active and passive types

Active Information Gathering

• Involves direct interaction with the target system
• Port scanning can discover open ports running through Nmap that performs port scanning and service discovery
• Masscan is an alternative to Nmap for large scale scanning
• Identifying the version of services on open ports from requests and response analysis through Banner Grabbing
• Discover the system architecture of subdomains, and IP addresses connected through DNS Interrogation

Passive Information Gathering

• Collecting data about the target system from public resources and not directly connected with the target system
• Find domain name, registration, and contact information through WHOIS Lookup
• Searching google for sensitive data through Google Dorking
• Collecting information about employees and the the company via Social Media
• Collecting data from code snippets and documentation that may expose API keys and configurations (Github, Stack Overflow)

Vulnerability Scanning

• Scan a target system for known vulnerabilities
• Automated system detects weaknesses
• Detect software issues in configurations, and network setups that attackers may exploit
• Tools for Scanning include:
  • Nessus : To identify critical OS vulnerabilities on networks and applications
• OpenVAS : Open source scanner for network vulnerabilities
• Qualys : Cloud based vulnerability management tool

Types of Scans

• Finding network weakenesses through network scanning
• Finding vulnerabilities with with SQL injection, cross-site scripting , and request forgery

False Positive Analysis

• Post scanning when scanners incorrectly flag non virtual issues
• Requires security professionals to review flagged vulnerabilities to assess real risk and prioritise remediation efforts
• Burp Suite helps test web applications and is used when testers manually verify findings
• Wireshark can confirm issues when capturing and analysing network traffic

Vulnerability Exploitation (Penetration Testing)

• Testing security to potentially access or preform unauthorised and malicious behavior
• Assess the impact of a potential damage after vulnerabilities are exploited with real world attacks
• Testers will attempt use custom scripts to break into a system during Exploitation
• Once the tester gains initial access they will elevate their access from a normal user to administrator during Privilege Escalation
• A tester will preform Post-Exploitation to gain additional sensitive data
• Generate report with security weakness and vulnerabilitie

Report Generation

• Final step is documenting and presenting a report of finding outlining the vulnerabilities and security weaknesses discovered during the process
• Purpose is to serve as documentation for vulnerabilities, impact and recommendations
• Key Elements of Report
• Executive Summary is high level overview of findings and risk
• Detailed Findings will include evidence of exploitation, and impact
• Guidance on how to fix, (eg enhancement)
• Proof of Exploitation is evidence of succes when applicable
• Prioritisation of vulnerabilities based on risk

Scan Perquisites

• Require admin assess to comprehensive testing
• Ensure no firewall blocks between the scanning tool and the system
• Schedule a scan within a given time window for minimal operation disruption
• Back Up all systems

Scan Policy

• Customise to based on the target systems OS application, and network
• Parameters focus on target systems.
• Check compliance with policy settings

Social Engineering Attacks include, phishing, pretexting, baiting.

• The attacks help test the human element of security

Scanning Tools

• Nmap helps identify open ports and scanning target systems
• Port Scan vital to ID services and potential attack vectors