Studies have shown that nearly 60% of organizations that suffer a data breach cite a known unpatched vulnerability as the culprit.
One of the best ways to identify exploitation opportunities for cybercriminals is by conducting a vulnerability assessment as part of a comprehensive vulnerability management program.
This article explores what a vulnerability assessment is and the importance of having a thorough analysis of addressing these weak links that are applicable to your organization.
At the highest level, a vulnerability assessment tests the level of hygiene present within the environment. More specifically, this is a thorough evaluation used to identify existing and potential threats in the software throughout your organization’s systems and networks.
A vulnerability assessment is designed to identify unpatched and exploitable vulnerabilities, giving the organization the opportunity to remediate these deficiencies before they are discovered by a bad actor.
Since a vulnerability assessment is designed to identify to help to correct the flaws in software that an attacker can exploit, any organization that uses computers and the Internet - and who doesn’t these days? - can benefit from such an analysis; however, large enterprises and those subject to ongoing attacks such as retail will benefit most.
While not all the vulnerabilities identified will be exploited, locating and prioritizing remediation can be complex. For instance, the average web application contains over 1,000 dependencies, all of which can contain vulnerabilities that impact the organization’s web security. Of these 1,000 dependencies, the average web app contains 22 vulnerabilities. Keep in mind, web applications represent only a fraction of an organization’s exploitable attack surface.
A vulnerability assessment begins with a vulnerability scanning test. Vulnerability scanning is designed to be user-friendly, so anyone within the organization’s IT or security team can perform this level of assessment themselves.
This type of software has a list of known vulnerabilities and systematically tests a target system to see if any weaknesses are present. At the end of the scan, the software produces a report outlining the vulnerabilities detected and their severities, and, potentially, the steps required to remediate them.
The next step is where the value of an assessment lies: a professional analysis of both the vulnerability scanner’s results and the design and implementation of the target system. This step should be conducted by a cybersecurity expert and provides a more tailored and in-depth view of the cybersecurity risks posed by vulnerabilities within an organization’s network.
Related Reading: 3 Reasons Why You Need a Human-Run Penetration Test
In this phase, the expert reviews the scan report with an understanding of current active threats, as well as the network environment in order to make targeted recommendations as to which vulnerabilities to fix first. This prioritized plan is based on factors including severity of the vulnerabilities as well preexisting conditions in the environment.
For instance, compensating controls in an environment like a network segmentation may reduce the risk of vulnerability. An example is a vulnerability shows as a 10, the highest risk level possible, but the device where the vulnerability resides is only reachable by one device over a specific port. This makes the actual risk of exploitation much lower.
A vulnerability assessment cannot be conducted in a vacuum; the results themselves must be made relevant to the organization in order for it to be actionable in any way.
Most vulnerabilities can be managed by updating and patching software.
Patches are typically issued after an exploitable vulnerability has been discovered by the community or disclosed by the originating vendor for a piece of software or firmware. However, the sheer volume of vulnerabilities that exist can make it difficult to keep up. In 2019 alone, over 22,000 new vulnerabilities were discovered and publicly reported.
In addition, for many organizations, updating unpatched software may not be as simple a resolution as it sounds. Lack of or over-burdened technical staff or updates that cause performance issues or impact stability and operability may cause smaller companies to avoid updating.
Even large well-funded organizations with dedicated IT staff struggle with patching when dealing with areas such as legacy systems or third-party applications (most notably web browser plug-ins).
By developing a sound strategy that enables a timely and sustainable patch management process across an environment, an organization can minimize the probability of a data breach or regulatory non-compliance due to unpatched software.
Related Reading: Why Patch / Vulnerability Management is Important for Cyber Security
A vulnerability assessment should be thorough and not limited to running a tool and receiving a report containing the raw results. When selecting an assessment provider, look for one that gives you the benefit of their expertise when planning, executing and interpreting the results of the test.
Avertium offers an array of vulnerability assessment services, including:
These services can also be combined with penetration testing to provide a comprehensive assessment of an organization’s digital security.
Rising Ransomware Attacks, the Advent of XDR, and What it Means for the Future of Threat Detection and Response