Certified SOC Experts
Day 4: Vulnerability Management
Module 5 and 6
Trainer: Himanshu S
What is Vulnerability?
In cybersecurity, a vulnerability is a weakness in a system or application that can be
exploited by attackers to gain unauthorized access, run malicious code, or steal sensitive
data. Examples of vulnerabilities include SQL injection, buffer overflows, and cross-site
scripting (XSS). They can be found in various infrastructure such as software, network, and
even in physical facilities.
What is Vulnerability Analysis?
Vulnerability analysis is the process of defining, identifying, classifying, and prioritizing
vulnerabilities in computer systems, applications, and network infrastructures. It aims to
uncover weaknesses in a network and recommend appropriate mitigation or remediation
to reduce or remove the risks. Vulnerability assessments can be automated or manual and
often involve the use of automated testing tools, such as network security scanners. The
results of a vulnerability assessment are typically listed in a vulnerability assessment
report, which focuses on providing enterprises with a list of vulnerabilities that need to be
fixed.
Methods to discussed:
Overview:
Vulnerability analysis is an essential component of a comprehensive cybersecurity
strategy. It is the process of identifying, quantifying, and prioritizing vulnerabilities in an
organization's systems, networks, and applications. The overall goal of vulnerability
analysis is to help organizations manage and reduce risk by providing information about
potential threats and weaknesses that could be exploited by attackers.
The process of vulnerability analysis typically includes the following steps:
Asset identification: Identifying the systems, networks, and applications that need to be
protected.
Vulnerability scanning: Using automated tools to scan for known vulnerabilities in the
identified assets.
Vulnerability assessment: Evaluating the severity and potential impact of the identified
vulnerabilities.
Risk assessment: Determining the likelihood and potential impact of an attack on the
organization.
Different type of Vulnerability Issue:
Misconfigurations: These are errors in the configuration of systems, networks, or
applications that can be exploited by attackers. Misconfigured S3 buckets in the cloud are
a common example.
Unsecured APIs: Application programming interfaces (APIs) that are not properly secured
can provide an easy target for attackers to breach.
Unpatched software: Software vendors periodically release updates to patch known
vulnerabilities. Failure to apply these updates can make systems vulnerable to attack.
Zero-day vulnerabilities: These are vulnerabilities that are unknown to the software vendor
and for which there is no patch available.
Weak user credentials: Passwords that are weak, reused, or not changed regularly can be
easily guessed or brute-forced by attackers.
Overly permissive access: Granting employees more access and permissions than
necessary can increase the risk of identity-based threats.
Cloud-based vulnerabilities: Cloud networks follow the shared responsibility model,
meaning that the organization is responsible for securing the operating system,
applications, and data.
Importance of Vulnerability Assessment:
Vulnerability assessment is a crucial aspect of cybersecurity that involves the ongoing
process of identifying, assessing, reporting on, managing, and remediating cyber
vulnerabilities across endpoints, workloads, and systems. A strong vulnerability
management program uses threat intelligence and knowledge of IT and business
operations to prioritize risks and address vulnerabilities as quickly as possible.
The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that
many cybersecurity organizations use to assess and communicate the severity and
characteristics of software vulnerabilities. The CVSS Base Score ranges from 0.0 to 10.0, and
The National Vulnerability Database (NVD) adds a severity rating for CVSS scores. The
CVSS v3.0 scores and associated ratings are as follows:
0.0 - 3.9: Low
4.0 - 6.9: Medium
7.0 - 8.9: High
9.0 - 10.0: Critical
