Introduction to Vulnerability Assessment

During this article, we will cover an introduction to the basic definitions of Vulnerability assessment and the related techniques and technologies. On the other hand, will cover hands-on experience to manage these vulnerabilities and minimize the related risks

Basic Definitions

In the security world and to understand the risks and importance of security, it is important to understand the concepts and phrases listed below:

Assets: is something of value to the organization/personal and it could be tangible or intangible value.

Below some examples for the assets:

• Information Assets
• Physical Assets
• People
• Image and Reputation
• Services

Threats: any action that can exploit a vulnerability, intentionally or accidentally, and obtain, damage or destroy an asset. This is divided into Human threats as weak security policy, competitors or even unclassified employees. Or Natural Threats as floods, fires or another environmental event.

Vulnerability: these are weaknesses or gaps in a system that can be exploited by threats and will cause a negative impact, so basically, these are not harming but these are set of conditions that may allow threats to cause harm to our assets

The vulnerabilities can take different types and forms such as weak passwords, Non-secure internet connections, lack of anti-virus, lack of firewalls, or even lack of security awareness.

Risks: it is the possibility to lose assets due to a threat exploiting a specific vulnerability

The risk treatment can be Accept, avoid, transfer or reduce 

Vulnerability Assessment (VA):  it is a process of identifying and analyzing the security weaknesses and gaps in the system, and this is the first part of Vulnerability Management (VM).

Vulnerability management (VM): it is a continuous process and practice of identifying clarifying and mitigating vulnerabilities through regulated usage of security tools, controls, and procedures.

Benefits of VA and VM

• Identifying potential weaknesses and gaps in IT system
• Recommendation solutions and improvement methods provided by experienced IT specialists
• Evidence on the effectiveness of security controls implemented
• Preventions of attacks
• Create/update the information security policy
• Compliance with security standards
• Conduct training

The methodology of VA that commonly used is using the following sequence: Pre Assessment, During Assessment and Post Assessment

And in the section below we will illustrate the types of VA scans performed usually

VA Scan Types

The types of VA scan are detailed below:

Vertical Scan: which means scan one system or a single type of systems for all possible vulnerabilities

Horizontal Scan: which is scan different types of hosts or applications for the same vulnerability

Vulnerability Management Technologies

VM is the approach used to manage and control the vulnerabilities by using hardware appliances as a scanner for internal equipment

The common way of doing it is through SaaS that allows delivering applications over the Internet instead of installing and maintaining software

Best Practices of VM

• Discover Network Assets
• Classify Assets
• Run Comprehensive Scans
• Generate Technical Reports
• Generate Management Reports
• Track remediation Progress
• Repeat the VM process on a Regular Basis

As a summary, the VA and VM is actually a process and concept that should be considered in any organization in order to sustain the level of protection and security for the assets