Vulnerabilities

in the ICT environment and their management

We know what vulnerability is in general, everyone is vulnerable, for example to viruses, accidents, but not only humans are vulnerable. Vulnerabilities are also present in inanimate objects, such as a building, an office (missing lock on the door, no fence around the building) – and all these vulnerabilities increase the risk of something happening to us or our property. Simply put, a vulnerability is a weakness, a deficiency that can be exploited by an attacker.

more

Not only software can have bugs

From the viewpoint of ICT products, this is usually a bug in the program code itself that arose either during development or during updates. We can encounter them almost everywhere. Program developers try to make sure not to introduce bugs unintentionally during development, but no product is so perfect that it doesn’t need updates during its lifetime.

However, vulnerabilities do not have to be just software bugs. They can involve misconfigurations such as default settings, old or weak passwords, open ports, unauthorized or unexpected installations of software, services, systems, unknown devices in the network, deviations or non-compliance with internal regulations, etc.

There are over a trillion malware patterns and they keep coming. There are now about 170,000 known vulnerabilities, but the vulnerabilities most commonly used in exploits of specific malware are only about 800. By finding and removing a few vulnerabilities in the network, we can cover a huge number of potential risks from malware attacks.

Videos – Vulnerabilities

Check our videos we have prepared for you on the topic of Vulnerabilities.

Vulnerabilities – In general and specifically

Vulnerabilities – Why you need to know them and what the legislation says

Vulnerabilities – In general and specifically

Vulnerabilities – Why you need to know them and what the legislation says

Stay one step ahead of the attackers:

Every company should manage risks, whether for legislative reasons (ISO, GDPR, ZKB) or, let’s say, out of an instinct for self-preservation. IT security is not a state, it is a dynamic process, and vulnerability management is part of it. Only if you know what your weaknesses are can you do something about them.

DETAILED DESCRIPTION

Vulnerability Testing

Risk management should start with a risk analysis. Knowing our assets and their vulnerabilities and threats is an essential part of this process.

Vulnerability testing can be divided into two similar yet distinct processes. They differ significantly in the vulnerability identification part.

Vulnerability Assessment

testing

is a one-time testing and comparison of found vulnerabilities against a database of known vulnerabilities. In the case of VA, we create an inventory list of the devices we have in the network and compare it with the available list of vulnerabilities. In most VA systems, there is no real vulnerability testing and, thus, no determination is made whether or not a particular vulnerability affects me, or how susceptible we are to a particular vulnerability. As a result, we have a large number of vulnerabilities to address, regardless of whether we are actually susceptible to a particular vulnerability. The problem with penetration testing can also be the frequency, with larger organizations performing these tests in the order of units of tests per year and sometimes less. Which is insufficient considering the number of new vulnerabilities during the year.

Vulnerability Management

management

in contrast to VA, not only performs vulnerability testing, but integrates it into a complete and iterative process. The process begins with preparation, where we determine the scope and plan the entire vulnerability management process. Next, we identify/recognize devices and systems in the network while classifying specific vulnerabilities in specific systems and devices. We then prioritize these vulnerabilities by severity and assign specific vulnerabilities to people who are responsible for mitigating and remediating them. We store the results so that we can return to them later for purposes such as difference reports. This entire process is iterated and refined regularly, which is the goal of proper vulnerability management.

OTHER DETAILED DESCRIPTION INFORMATION

Vulnerability database and assessment

Vulnerability database

For better orientation and overview of vulnerabilities, there is the so-called National Vulnerability Database (NVD). This database is a repository of vulnerability data based on Security Content Automation Protocol (SCAP) standards and protocols. The information in the database enables automation of vulnerability management, security measurement and compliance. NVD includes security checklist databases, security-related software bugs, incorrect configurations, product names, and impact metrics.

NVD performs analysis based on information from published vulnerabilities, so-called CVEs.

Vulnerability assessment

The information from the description of vulnerabilities and any additional data that can be obtained at the given time results in, among other things, the Common Vulnerability Scoring System (CVSS). CVSS is a standard that defines a system for calculating vulnerability severity scores based on system and environment characteristics. The severity of a particular vulnerability can be expressed verbally or by a score from 0 to 10.

Rating	CVVS Score
None	0.0
Low	0.1 – 3.9
Medium	4.0 – 6.9
High	7.0 – 8.9
Critical	9.0 – 10.0

THE SOLUTION AND ITS OBJECTIVES

Vulnerability Management

The basis of a VM solution is usually an operating system, a web-based user interface, an administrative interface, a scanning application, and a test suite that is regularly updated and supplemented. The number of tests themselves may not be crucial, as one test may reveal several vulnerabilities, and conversely, several tests may be available for a single vulnerability.

Such a solution is aimed at

Making it more difficult to attack IT infrastructure and ensuring its resilience
Replacing a one-time penetration test scan with a vulnerability management process
Detecting bottlenecks and prioritizing them will improve the effectiveness of antivirus systems, firewalls and other security tools

System Parameters

Security status updates several times a day
Latest insights from security experts around the world
Perspective of the access from the viewpoint of the attacker from the outer layers inwards
Multi-level process quality assurance
Encrypted transmission of information
Integration with other security tools
Vulnerability tests via network access both without connection to the tested devices and with user access

Alternativa řešení

Testing as a service

It is also possible to use vulnerability testing as a service. Compared to an on-premise solution, you don’t have to own the hardware or VA platform. Just access the web interface of the main application.

The advantages of such a solution are:

The service is provided on a monthly basis and is very flexible in terms of the number of test devices or the length of use.
Speed of deployment, flexibility
Scalability
Faster response to evolving Cybersecurity threats and trends
Once the service is implemented, you can add new scan areas and run the first tests in a few steps

For download :

One-time analysis –

Datasheet (12,5 kb)