Understand What is Vulnerability Assessment, Types, and Processes - invesroc

Vulnerability Assessment or often abbreviated as VA, refers to the process of identifying risks and vulnerabilities that exist in computer networks, systems, applications, or other parts of the IT ecosystem.

In a digital environment where there are various cyber threats, conducting regular vulnerability assessments is the right choice to protect your business. In this way, sensitive company data can be well preserved and protected from the bad effects of cyber attacks.

You need to know, there are several reasons why hackers continue to target sensitive company data. Some of them are:

1. To ask for a ransom like in the case of the WannaCry Ransomware that happened in 2017.
2. Hackers want to steal and use victim's personal information such as name, address, username, password, and many more.
3. With a variety of data obtained, hackers can use it to store and host applications using your infrastructure.

Seeing some of the reasons above, of course you want company data to be stored safely. Moreover, if your company has a lot of customer data in it. If hackers get into your system, the company could face fines and loss of customer trust.

What is a Vulnerability Assessment?

Vulnerability Assessment is a process to identify, evaluate, and classify the severity of security vulnerabilities that exist in a computer network, system, application, or other part of the IT ecosystem based on the risks that can be caused by your company.

A Vulnerability Assessment can provide insights to companies about what vulnerabilities are more likely to be exploited by hackers. That way, you can quickly patch the vulnerabilities or weaknesses most at risk before hackers exploit them.

What is the difference between Vulnerability Assessment and Penetration Testing?

After reading the definition of VA above, you may be wondering what is the difference between penetration testing. Often times, Vulnerability Assessment and penetration testing confuse most people because the two processes both aim to detect weaknesses in a system in the company.

Vulnerability assessment will look for vulnerabilities and report potential existing exposures. Meanwhile, penetration testing is a test that is done by exploiting system weaknesses or vulnerabilities and then determining the extent to which attackers can gain unauthorized access to your assets.

If likened, this Vulnerability Assessment is like someone walking to the door of a house and checking whether the door is locked. Meanwhile, penetration testing is like someone walking to the door of a house, checking if the door is locked, and trying to open the door and enter the house.

Why is Vulnerability Assessment Needed by All Companies?

This vulnerability assessment can provide various information about security weaknesses in your company's IT environment. Vulnerability assessments can also provide guidance on ways to remedy or mitigate the problem before the vulnerability can be exploited by hackers.

This process will help you understand your IT infrastructure well and see the weaknesses and overall security risks. Thus, you can improve the security of your company's IT environment to avoid cyber criminals targeting unauthorized access.

Broadly speaking, there are several reasons why it is important for a VA to be done routinely in a company. Some of these reasons include:

• You can identify system security threats or weaknesses in advance before the breach occurs.
• You can understand the vulnerabilities that were found based on priority, urgency, and the impact that could be caused.
• Protects data breaches and other unauthorized access.
• Helping companies to avoid fines or lawsuits if data breaches occur.

Types of Vulnerability Assessment

1. Network-based scans

Network-based scans are security assessments to identify possible attacks on network security. This scan can also detect vulnerable systems on wired or wireless networks.

2. Host-based scans

Host-based scans are performed to find and identify vulnerabilities that exist in servers, workstations, or other network hosts. Normally when this scan is done, the team will check for services and ports that may also appear in network-based scans.

3. Wireless network scans

Wireless network scans are used to scan corporate wifi networks which will typically focus on points of attack on the wireless network infrastructure. This type of scan can also help your company to validate that the network is configured securely.

4. Application scans

Application scans are used to identify security vulnerabilities and incorrect configurations in the web application and source code used. Usually scanning will be done using automatic scanning tools in the front-end or static / dynamic source code analysis section.

5. Database scans

Database scans are performed to identify weak points in the database. In database scans, big data databases and systems will be scanned for vulnerabilities and misconfigurations, identify malicious databases, and classify sensitive data for enhanced security. This is done to prevent malicious attacks such as SQL injection or other attacks that can cause data breaches.

What are the Vulnerability Assessment Process?

The process for conducting a Vulnerability Assessment is broadly carried out in 5 steps, namely:

1. Identification of vulnerabilities 

Vulnerability identification is the process of finding and creating a comprehensive list of security vulnerabilities that exist in your company's IT infrastructure. This process is usually performed using automatic vulnerability scanning as well as manual penetration testing.

Vulnerability testing can be run through authenticated scans or unauthenticated scans.

• Authenticated scan: this vulnerability testing will allow the scanner to access networked resources using administrative protocols and authenticate using provided system credentials. The advantage of authenticated scan is the access to low level data such as configuration details, accurate information about the operating system, installed software, configuration issues, access control, security controls, and so on. 
• Unauthenticated scans: these vulnerability testing does not provide access to networked resources and can therefore yield less reliable information about the operating system and installed software. This type of scan is commonly used by cyber attackers and IT security analysts to determine the security posture of system assets externally and to spot potential data leaks.

You need to understand that when conducting a Vulnerability Assessment, companies usually also need penetration testing so that security vulnerability scanning can be more perfect. 

2. Analyze vulnerabilities

After the vulnerability is identified, the next step is to analyze which component is responsible for each vulnerability that appears and which component is the root cause of the security weakness.

3. Risk assessment

Risk assessment is conducted to determine the priority of vulnerability (High, Medium, Low). When conducting this assessment, the team will usually use a vulnerability assessment tool that can help rank the severity of each vulnerability found.

Each risk assessment report will generally consider several additional factors such as:

• what systems are affected
• what kinds of sensitive data are stored on the system
• are there any business components that depend on the system
• the level of ease of attack that can be obtained
• how big the impact will be if the vulnerability is successfully exploited, and many more

4. Remediation or remediation

Remediation refers to fixing and addressing security vulnerabilities. With this remediation, you can protect your business from various suspicious activities that can threaten the security of your data, such as malware attacks, ransomware, phishing, and others. If the vulnerabilities found are not resolved immediately, the vulnerability can expand and increase the chances of being hacked by cyber hackers.

When doing this remediation, usually the team will be assisted with various vulnerability management systems which will recommend remediation techniques for common vulnerabilities. However, the remediation steps that will be taken will vary depending on the type of vulnerability found.

5. Mitigation

It is important to note that there are several types of vulnerabilities that cannot be fixed. Therefore, mitigation is needed.

Basically, mitigation is the process of reducing the possibility or impact of vulnerability being exploited. The steps taken are also very diverse, here are some of them:

• Replacing new software or hardware
• Perform the encryption process
• Introducing new security controls
• Carry out continuous security monitoring, etc.

By conducting a vulnerability assessment that is equipped with regular penetration testing, you can protect the company and its sensitive data from various types of cyber attacks. There have been many large companies in Indonesia that have experienced data leakage cases that have resulted in losses for their business. 

Conclusion

The best way to keep company data secure is to carry out regular security testing. You must be able to consistently ensure that all the systems you use have a good level of security so that there are no loopholes that can be broken into by irresponsible parties. To do this, you can work with the right partner to monitor and improve security in the IT environment in your company.