A vulnerability assessment is a critical part of any I.T. infrastructure.
It's not something that we do willy nilly you don't just go grab a copy iness and run a security scan
and look for stuff.
Normally this is going to be handled by management.
Management is going to authorize your department to perform vulnerability scans.
Now these can be done on an annual basis on a quarterly basis monthly.
In some organizations it's literally done perpetually.
They never ever turn it off.
So the most important thing that's going to happen with a vulnerability assessment is you're going to
get authorization.
I know in some organizations it's literally required for a manager to provide a signed piece of paper
before they get started with any of this stuff.
Now once you get that process going you certainly are going to be using your tools but you have a couple
of options here.
One of the big options is credentialed versus non credentialed a credentialed vulnerability assessment
basically means you've got user names and passwords of the stuff that's part of your assessment.
So it really gives you more of an insider's view of what's going to be taking place non credential you
don't have user names and passwords so you're more seeing it as an outsider.
So both of these assessments are very very powerful because you definitely see your infrastructure from
two very different ways.
Along with that you can do an intrusive or a non-intrusive almost all vulnerability assessments that
I run into our nonintrusive.
Basically we're looking at the vulnerabilities you're scanning the system you're gathering information
but you're not actually doing anything with that you're not actually going.
Ah here's a vulnerability in a sequel database let's corrupt the database because as you can imagine
that might cause trouble.
So generally when we're talking about vulnerability assessments we're talking about a non intrusive
type of event.
So as you're going through there.
Keep in mind with your jobs Arbi number one you're there to identify vulnerabilities.
And as we saw in other episodes there are nice tools out there that give you a good listing of what
those vulnerabilities are.
Also along with that you might want to consider the idea of misconfiguration.
A lot of times a misconfiguration will present a vulnerability in and of itself simply well for example
using default username and password would be a great misconfiguration example using default IP addresses
that type of thing.
The challenge you've got to watch out for in your vulnerability assessment more than anything else are
what are known as false positives a false positive is simply when a vulnerability assessment goes here's
a problem.
And the reality is it isn't a problem.
It is part and parcel of any good vulnerability assessment tool.
But the more false positives you have that you have to deal with the less time you have to deal with
real vulnerabilities.
And it's kind of a balancing act between turning your sensors up to the point where you get too many
false positives versus turning them down.
Were you miss real problems.
Just be aware of the term false positive the other interesting thing that takes place during a vulnerability
assessment really has nothing to do with the vulnerabilities what we're talking about is compliance.
We have all kinds of laws and organizations out there that different people have to deal with when it
comes to compliance.
Probably one of the biggest examples is PCI DSS.
These are the folks who monitor credit card usage and if you want to be a part of a credit card organization
if you want to use credit cards or if you want to sell machinery that uses credit cards you have to
go through their compliance rules.
Now it's actually not that big of a deal because a lot of tools in fact this is where Nessus in particular
does a great job.
You can take that same vulnerability scanner and you can plug in what's called a PCI DSS compliance
package.
So it's not looking at a national vulnerability database anymore.
Instead what it's looking at is a rule set for PCI DSS compliance and it can be a very very powerful
tool.
So when you're going to do a vulnerability assessment.
Just keep in mind that you've got a few basic tools and for crying out loud get authorized before you
start anything.