Chapter 2 - Vulnerability Assessment 101

Abstract

This chapter focuses on vulnerability assessments (VA), traditional and alternative methods for discovering vulnerabilities; and the importance of seeking out vulnerabilities. It discusses the steps involved in conducting a vulnerability assessment: information gathering/discovery, enumeration, and detection. Information gathering and discovery is the process an individual or group performs to ascertain the breath/scope of an assessment. The purpose of this step is to identify and determine the total number of systems and applications that are to be assessed. Enumeration is the process used to determine the target operating system—a process called OS fingerprinting—and the applications that reside on it. Detection is the method used to determine whether a system or application is susceptible to attack (i.e., vulnerable). A vulnerability assessment can be done with the help of several tools such as Tenable Network Security's Nessus or eEye Digital Security's Retina. Traditional methods of vulnerability assessment provide the most accurate level of vulnerability information, because VA doesn't require administrative rights, is capable of detecting all hosts residing within our network, and most important, provides us with the hacker perspective of our devices. In today's environment, though, a hybrid approach to vulnerability assessment that leverages security, patch, and configuration technologies will provide the greatest gains with optimal efficiency.