Vulnerability Assessment
Comparing Approaches to Vulnerability Assessment
There are four types of vulnerability assessment solutions: product-based solutions, service-based solutions, tree-based assessment, and inference-based assessment.
Product-based Security solutions
Product-based Security solutions are installed in the organization’s internal network. They are installed either on a private or non-routable space or in the Internet-addressable portion of an organization’s network. If they are installed on a private network (behind the Firewall), they cannot always detect outside attacks.
Service-Based Security Solutions
Service-based solutions are offered by third parties, such as auditing or Security Consulting Firms. Some solutions are hosted inside the network, while others are hosted outside the network. A drawback of this solution is that attackers can perform network vulnerability scans from the Internet/external network.
Tree-based assessment
In a tree-based assessment, the auditor selects different strategies for each machine or component of the information system. For example, the administrator selects a Scanner for servers running Windows, Base, and web services but uses a different scanner for Linux servers. This approach relies on the administrator to provide a starting piece of intelligence, and then to start scanning continuously without incorporating any information found at the time of scanning.
Inference-based assessment
In an inference-based assessment, scanning starts by building an Inventory of the Protocol found on the machine. After finding a protocol, the scanning process starts to detect which Ports are attached to services, such as an email server, Webserver, or database server. After finding services, it selects vulnerabilities on each machine and starts to execute only those relevant tests.
Internet of Things (IoT) Vulnerability Assessment
IoT Vulnerability Assessment Process
Once attackers gather information about a target device, they search for the attack surfaces of a device (identify the vulnerabilities) that they can attack.
Attack Surface Identification
Vulnerability scanning allows an attacker to find the total number of vulnerabilities present in:
- Firmware
- Infrastructure
- System components of an IoT device that are accessible
Vulnerability Scanning Steps
After identifying the attack surface area, the attacker will:
- Scan for vulnerabilities in that area
- Identify an attack vector
- Perform further exploitation on the device
Common IoT Vulnerabilities
Vulnerability scanning helps identify IoT devices with weak configurations such as:
- Hidden exploits
- Firmware bugs
- Weak settings and passwords
- Poorly encrypted communications
Dual Purpose of Vulnerability Scanning
For Attackers:
- Identify IoT devices with weak configurations
For Security Professionals:
- Secure IoT devices in the network
- Determine security loopholes or vulnerabilities in current security mechanisms
- Address vulnerabilities before attackers can exploit them
IoT Vulnerability Assessment Tools
Listed below are some of the additional vulnerability scanners for IoT devices:
- Metasploit (https://www.rapid7.com)
- IoTsploit (https://iotsploit.co)
- IoTSeeker (https://www.rapid7.com)
- IoTVAS (https://firmalyzer.com)
- Enterprise IoT Security (https://www.paloaltonetworks.com)
Cloud Vulnerability Assessment
The vulnerability assessment phase involves identifying and evaluating security weaknesses within the cloud infrastructure. This includes the assessment of misconfigurations, unpatched software, and flaws in cloud-based networks, applications, and services. The primary purpose of this phase is to identify vulnerabilities that can be exploited to gain unauthorized access, escalate privileges, or disrupt cloud services. This phase is crucial for planning further exploitation strategies. Therefore, attackers can use both automated and manual techniques to identify vulnerabilities. Tools such as Tenable Nessus, openvas, and Qualys can be used to perform detailed scans and generate reports on the security posture of a cloud environment. The discovery of vulnerabilities provides attackers with potential entry points into the cloud environment, which can be leveraged to conduct further malicious activities.
Kubernetes Vulnerability Assessment
Container/Kubernetes Vulnerability Scanning
Container images consist of an operating system, application, runtime, etc. packaged together. These containers are reused widely and may contain open source frameworks with vulnerability issues. These vulnerabilities compromise the security not only of each container but of the entire container engine. Attackers use tools, such as Trivy Vulnerability Scanner, Anchore, Clair, Dadga, and synk container, to scan and identify vulnerabilities in the containers.
Additional Kubernetes Vulnerability Scanning Tools
Additional Kubernetes vulnerability scanning tools include the following: