All right, in the last lecture, we talked about the different vulnerability domes and different cybersecurity
terms that you should be aware of in this lecture.
We're going to talk about a very common term that most of you must have heard, and that is vulnerability
assessment.
A vulnerability assessment did a systematic review of the security weaknesses in an information system,
it evaluates if the system is susceptible to any known vulnerabilities and assigns the security levels
to those vulnerabilities and then recommends the remediation or mitigation, whatever is necessary.
In simple words, it is a process of identifying, quantifying and prioritizing the vulnerabilities
in a.
Now, why you need to do a vulnerability assessment, so examples of threat, let's say, that can be
prevented by doing such assessment, can be a good indication or cross site scripting or code injection
attacks.
If you are completely new to the Stones, I would say do not worry, because in the later part of the
schools, we are going to see all of these students again.
If there are any threats related to escalation of privileges due to faulty authentication mechanisms,
even that can be identified with the help of a vulnerability assessment.
So vulnerability assessments are typically performed in the following steps.
First, the vulnerability assessor, now who is a vulnerability assessor, obviously the person who
has a good knowledge of hacking.
So he is a hacker, right.
But is he or she a bad hacker?
No, the person who performs an assessment is known as a penetration tester or ethical hacker.
So Faust is cataloging the assets and capabilities in a system.
What other resources are present in the system?
Which resources are more vulnerable to the outside world?
All these things are first noted down.
Then the vulnerability assessor assigns quantifiable value and importance to those resources.
For example, identities of users is top most important, right?
Whereas a file which can which can be obtained, let's say a free period file which can be obtained
through three or four travels on the website, is not that important because it is already available
on the Internet for free.
So in such cases, the quantifiable value is assigned to various resources.
The next step is the penetration tester or the ethical hacker identifies the vulnerabilities or the
potential threats to each of the resources.
Now, the security scanning process consists of four basic steps.
First is testing.
Second is analysis, third assessment, and fourth is remediation.
That is mitigating or eliminating the most serious vulnerabilities for the most valuable resources first.
Now, when it comes to vulnerability identification, the objective of this step is to draft a comprehensive
list of all the applications security vulnerabilities.
Now security analysts test the security health of the applications, servers or other systems by scanning
them with the automated tools that are already available in the market.
Next is vulnerability analysis.
The objective of vulnerability analysis step is to identify the source and the root cause of vulnerabilities.
For example, if you do not eliminate a cause from its root, obviously there are going to be consequences
even after removing some part of the vulnerability.
And the third step is risk assessment.
So the objective of risk assessment is to prioritize the vulnerabilities.
As I said, assigning the quantifiable value comes under risk assessment.
The next step is remediation, which is the fourth step here.
The objective of this step is the closing of security gaps.
It's typically a joint effort by the security staff of the organization, the development and the operations
team who determine the most effective part for the remediation and mitigation of each vulnerability.
It can include the introduction of new security procedures, implementing new security measures, and
introducing the staff to the new security tools in the market.
It can also include abduction of all the operational packages and patches and development and implementation
of a patch vulnerability.
So vulnerability assessment cannot be one of activity, so it's like you cannot do the activity once
in a year and the rest of the year is your risk.
It's not like that.
Organizations who really care about their assets carry out vulnerability assessments at least once in
a month.
Now, there are some organizations which have inside a vulnerability assessment and there are some organizations
who hire people to do the job for them.
For example, let's say you are is a company whose main focus is to provide I.T. service management
facilities like devlopment and, you know, developing more applications, databases, etc..
Now, for them, it is not necessary to have an inbuilt penetration testing or a vulnerability assessment
stuff.
So what do they do is they hire ethical hackers and carry out the vulnerability assessment either for
the clients or for their own database.
But if a company is large enough, let's say, like Amazon or even Oracle, they have their own security
department in which these analysts are working day and night to prevent such vulnerabilities.
So in this case, it is the process of identifying the risks and the computers in the network vulnerabilities
and other parts of the IT ecosystem.
Now, one of the most important question is why these assessments are important, or should organizations
really focus much time on these assessments?
The answer to this question is obviously yes.
Early and consistent identification of the threats and the weaknesses in that security will obviously
help the organization in patching those vulnerabilities instead of getting it exploited.
And most cybersecurity compliance and regular regulatory needs satisfied when the tests are assessments.
Ahmed.
In this way, validity liberty assessments are carried out, and even during security audits, the auditors
ask for this report.
So if you are working in an organization in the security department, make sure that the organizations
carry out liberty assessments and take this very seriously.
Now, the reason behind most of the data breaches is many organizations ignore the monthly vulnerability
assessments.
Either some organizations do it by yearly, that is two times in a year or quarterly.
But according to many security consultants and expert, vulnerability assessment is a regular process.
It is not a one time process.
So every month there must be at least one vulnerability assessment of the organization.
So on this note, we'll end this lecture in the next lecture, we'll talk about the importance of vulnerability
assessment, although I have explained to you the importance of vulnerability assessment in this lecture,
in next lecture.
We'll see in much more detail.
All right.
Keep the momentum going.
I will see you in the next lecture.