Systematic and ongoing process of identifying, evaluating, prioritizing, and mitigating vulnerabilities.

Identifying Vulnerabilities

Systematic practice of spotting and categorizing weaknesses in a system, network, or application that could potentially be exploited.

• Vulnerability Scanning: Automated method of probing networks, systems, and applications to discover potential vulnerabilities. (e.g., Nessus, OpenVAS).
• Application Security: Used to safeguard software from being manipulated during its lifecycle.
  • Static Analysis: Used to analysis source code.
  • Dynamic Analysis: Evaluate an application as it runs to find vulnerabilities.
  • Package Monitoring: Ensures libraries and dependencies are secure and up-to-date.
• Penetration Testing: Simulate real-world attack to evaluate its security posture.
• System and Process Audits: Process that involves conducting a comprehensive review of the information systems, security policies, and procedures.

Four-Step Process:

1. Planning: Plan to track vulnerabilities and deploy fixes.
2. Testing: Evaluating patches in a controlled environment.
3. Implementing: Deploy patches across devices and applications.
4. Auditing: Audit to verify effective patch implementation and any post-implementation issues.

Threat Intelligence

Continual process used to understand threats faced by an organization. About sourcing information from many sources to get context, mechanisms, indicators, implications, and actionable information about a given threat.

Threat Intelligence Feed: Continuous stream of data related to potential or current threats to an organization’s security.

• Gives information like new malware signatures, indicators of compromise, malicious IP addresses, urls, etc.
• Sources: Open-source intelligence (OSINT), Proprietary or third-party feeds, Information-sharing organizations, The dark web.

Responsible Disclosure

Ethical practice where a security researcher discloses information about vulnerabilities in a software, hardware, or online service.

Bug Bounty Program: Program that encourages cybersecurity researchers to find and report vulnerabilities with monetary rewards. (e.g., HackerOne, Bugcrowd, Synack).

Analyzing Vulnerabilities

Confirmation

While vulnerability scanning, you will have to categorize results as:

• True Positive: The vulnerability genuinely exists and the alert correctly fired.
• False Positive: The tool indicates a vulnerability, but it does not actually exist.
• True Negative: No vulnerability exists, and no alert fired.
• False Negative: A vulnerability genuinely exists, but the tool failed to detect it.

Prioritization

Rank vulnerabilities by severity and impact on the organization. Factors to think about: Ease of exploitation, Magnitude of potential damage, Importance of affected system.

Categorization

Common Vulnerabilities and Exposures (CVE): System that provides a standardized way to uniquely identify and reference known vulnerabilities in software and hardware.

Exposure Factor

Exposure Factor (EF): Quantifiable metric to help a cybersecurity professional understand the exact percentage of an asset likely to be damaged or affected if a particular vulnerability is exploited. Required for qualitative risk management.

Risk Tolerance

Level of risk an organization is willing to accept in pursuit of its objectives before action is deemed necessary.

Vulnerability Response and Remediation

Strategies that identify, assess, and address vulnerabilities in a system/network to strength an organization’s security posture.

Response Remediation Options:

1. Patching: Applying software updates to fix software vulnerabilities.
2. Cybersecurity Insurance Policies: Procuring insurance policies to mitigate financial loss from cyber incidents.
3. Network Segmentation: Dividing a network into smaller segments for improved security and performance.
4. Compensating Controls: Alternative security measures used for situations where standard controls are not effective.
5. Grant Exception or Exemption: Exception temporarily relaxes security controls for operational business needs; Exemption permanently waives controls for specific reasons.

Validating Vulnerability Remediation

1. Rescans: Rescan the targeted system. Checks that vulnerability was actually fixed without introducing new vulnerabilities.
2. Audits: Process of reviewing logs, configurations, and patches.
3. Verification: Final checkpoint testing we have desired effect.

Vulnerability Reporting

Process of documenting and communicating details about security weakness identified in software or systems to individuals or organizations responsible for addressing the issue.

• Should use clear language.
• Should be confidential.

Internal Reporting: Involves the identifying, documentation, and communication of the organization’s vulnerabilities within the organization structure of the organization. External Reporting: Involves discussions with vendors, partners, customers or public at large. Responsible Disclosure Reporting: Art of disclosing vulnerabilities ethically and judiciously to the affected stakeholders before making the announcement to the public at large. Allows vendors a grace period to fix the vulnerability.