7.2 - Vulnerability Management Life Cycle

 7.2 - Vulnerability management life cycle 

Key Terms: 

• Vulnerability assessment – Testing the network for vulnerabilities. 
• Risk assessment – Evaluating the threat level of a vulnerability. 
• Remediation – Patching, hardening, and correcting a weakness. 
• Verification – Retesting the system to verify the patches were successful. 
• Monitoring – The systems are continuously monitored. 

 

Baseline Creation 

This is the first stage of the vulnerability management life cycle. The current security procedures are evaluated based on their effectiveness, establish risks by evaluating how the security procedures are enforced, and what vulnerabilities may have been overlooked. In this stage, documents such as a permission to test and a scope of work should be agreed upon by management and the ethical hacker. For the safety of the hacker, the correct people in the organisation must be briefed on what you will test, when you will test it, and how you will test it. 

 

Vulnerability Assessment 

This stage is when you assess vulnerabilities in the organisation’s systems and network. This phase is where penetration testing begins. It's important to decide when the best time to test is as you don’t want to be shutting systems down during peak business times. You must also choose the best tools to use for which system. Make sure you understand the tools you use as you can accidentally damage a system by mistake. This is the most important stage of penetration testing. 

 

Risk Assessment 

The vulnerabilities found in the penetration test must be analysed and ranked based on their access and sensitivity risks. A report should be created to explain to management the areas of sensitivity and create a plan of action to control the weaknesses, protect information, and harden systems. 

 

Remediation 

The steps taken to mitigate risks such as evaluating vulnerabilities, locating entry points, and designing responses for the vulnerabilities. The plan of action created in the risk assessment phase is consulted and implemented into the organisation’s infrastructure. The high-risk vulnerabilities should be fixed first. It is nearly impossible to identify and fix every vulnerability in a network which is why it is so important that the highest risk vulnerabilities are fixed first. 

 

Verification 

In this phase, systems are retested to verify whether a patch has been successful or not. Even if you are certain that a patch you have implemented has fixed a vulnerability, verification is still ideal as you can prove to management that you have done your job and protected their systems. 

 

Monitoring 

A hacker may recommend routine penetration tests and monitoring of vulnerabilities. This proactively protects the organisation from attacks that have been missed. It is natural for a business to feel secure after a penetration test however, new vulnerabilities are always found and used against organisations. 

 

Product-Based Solution 

A product-based solution is a method of implementing fixes for vulnerabilities. This is where a product is purchased and administered inside the network, so it is inside the firewall and inaccessible from the outside. 

 

Service-Based Solution 

This is when a professional is hired to provide a service to fix vulnerabilities. This happens from outside the network. 

 

Tree-Based Assessment 

This assessment contains a preset plan for the order of testing and scanning. Usually, lots of enumeration is required for this to be effective. 

 

Inference-Based Assessment 

In this approach, the hacker will test and gather information as they go and adjust their scan accordingly. 

 

Penetration Steps for Vulnerability Scanning 

• Live nodes must be identified. 
• Itemise each open port and service. 
• Test each port for vulnerabilities.