Introducing Vulnerability Analysis (Vulnerability Assessment)
Vulnerability analysis, also known as vulnerability assessment, is a process that defines, identifies, and classifies the security holes (vulnerabilities) in a computer, network, or communications infrastructure.
Vulnerability assessment has many things in common with risk assessment. Assessments are typically performed according
to the following steps:
- Cataloging assets and capabilities (resources) in a system.
- Assigning quantifiable value (or at least rank order) and importance to those resources.
- Identifying the vulnerabilities or potential threats to each resource.
- Mitigating or eliminating the most serious vulnerabilities for the most valuable resources.
Features and Benefits
- Covers all WASC, OWASP Top 10, CVE / NVDB / SANS Top 20 vulnerabilities including data-in-motion leakages
- Coverage of all attack paths through loophole correlation
- Threat Modelling and expert validation along with automated exploitation
- Automated/Manual Testing
- Transparent, monthly/quarterly charges
- Research driven delivery
- Comprehensive Testing for Applications and Networks
- Identifies the weakest link in the chain
- Eliminates false positives and prioritizes real threats
- Detection of attack paths missed through manual testing.
- Facilitates regular and frequent scans
- Access to zero-day vulnerability research
Introducing to Penetration Testing
A penetration test, occasionally pentest, is a method of evaluating the security of a computer system or network by simulating an attack from malicious outsiders (who do not have an authorized means of accessing the organization’s systems) and malicious insiders (who have some level of authorized access). The process involves an active analysis of the system for any potential vulnerabilities that could result from poor or improper system configuration, both known and unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This analysis is carried out from the position of a potential attacker and can involve active exploitation of security vulnerabilities.
Security issues uncovered through the penetration test are presented to the system’s owner. Effective penetration tests will couple this information with an accurate assessment of the potential impacts to the organization and outline a range of technical and procedural countermeasures to reduce risks.
Penetration tests are valuable for several reasons:
- Determining the feasibility of a particular set of attack vectors
- Identifying higher-risk vulnerabilities that result from a combination of lower-risk vulnerabilities exploited in a particular sequence
- Identifying vulnerabilities that may be difficult or impossible to detect with automated network or application vulnerability scanning software
- Assessing the magnitude of potential business and operational impacts of successful attacks
- Testing the ability of network defenders to successfully detect and respond to the attacks
- Providing evidence to support increased investments in security personnel and technology
Penetration tests are a component of a full security audit. For example, the Payment Card Industry Data Security Standard (PCI DSS), and security and auditing standard, requires both annual and ongoing penetration testing (after system changes).
Please Contact us for your project needs and your valuable feedback.