You're reading an article by two of Ironhack's awesome Cybersecurity bootcamp students, Mag Mach and Carlos Ruiz de la Prada Garrigues, under the supervision of our Lead Instructor, Daute Delgado. If you want to join the ranks, check out Ironhack's Cybersecurity bootcamps!
With remote working becoming more common, companies have forgotten about the different entry vectors for cyber criminals to access sensitive company information. To mitigate this type of activity, cybersecurity professionals run periodic procedures called vulnerability management - which is one of the best ways to proactively manage security.
Did you know that there are professionals who charge $200,000 per vulnerability detected?
Here, we´ll go into vulnerability management, and cover how important it is for companies to understand their vulnerabilities, how to identify the doors through which an attack could happen, and how good vulnerability management keeps us safe in our daily work.
Are you a more visual learner? Catch up on this topic in our Vulnerability Management Workshop, available on demand.
What Is a Vulnerability?
In cybersecurity, a vulnerability is a weakness that can be exploited by cybercriminals to gain unauthorized access to a computer system. After exploiting a vulnerability, a cyberattack can run malicious code, install malware and even steal sensitive data.
To exploit a vulnerability, we need a system weakness can be a system misconfiguration, a lack of configuration in the network component; and out-of-date software, a software that is not maintenance and updated properly; and a zero-day attack, an attack against an application or system that aims at executing malicious code by exploiting vulnerabilities that are unknown to users and to the vendor.
In 1965: William D. Mathews from MIT, found a flaw in a Multics CTSS running on an IBM 7094, which disclosed the contents of the password file. That flaw is probably the first reported vulnerability in a computer system.
How Are Vulnerabilities Exploited?
Vulnerabilities can be exploited by a wide variety of methods including Broken Access Control, buffer overflows, SQL injection, cross-site scripting (XSS), and open-source automated software (exploit kits) that look for known vulnerabilities and security weaknesses in web applications.
An exploit is a program or piece of code intended to discover and take advantage of a security hole or vulnerability in a program or computer system, generally for criminal purposes such as installing malicious software. An exploit is not the malicious program itself, but rather the method cybercriminals employ to deliver it.
Hackers often deploy exploit attacks with code that can automatically spread over a network in search of a vulnerability, like the EternalBlue vulnerability.
There are two main types of exploits:
Known exploits:
As the name suggests, these exploits have already been reported to the developers of the impacted program; the vulnerability is frequently patched and released to users as security updates, making the exploit useless.
Unknown exploits:
Zero-day exploits, in contrast, haven’t yet been identified and reported on by cybersecurity experts because cybercriminals are the ones who created or discovered them. These are the most severe exploits since they occur when a software or a system has a significant security vulnerability that the supplier is unaware of, which means such attacks are highly likely to succeed.
What Is a Vulnerability Scan?
A vulnerability scan is an automated activity that scans infrastructure targets such as IP addresses for vulnerabilities that can be exploited by the criminals. It is an assessment of possible security vulnerabilities in computers, internal and external networks, and communications equipment.
Cyber criminals have long exploited vulnerabilities in computers, networks, and communications equipment. A vulnerability scan will analyze these target systems for security vulnerabilities. It is an automated process that scans IP addresses for known vulnerabilities.
The two types of vulnerability scans are: unauthenticated and authenticated scans. Unauthenticated scans find weaknesses in your perimeter security while authenticated scans find security weaknesses in your internal network.
It is imperative to conduct vulnerability scans regularly to ensure that vulnerabilities are identified and the appropriate actions are taken, such as applying patches to fix software vulnerabilities.
Vulnerability scanning is generally the responsibility of IT departments if they have the expertise and software to do so, or they may hire a third-party service provider.
Some popular vulnerability scanners are: Acunetix, Detectify, Intruder, and Tenable.
How Do Vulnerability Scans Help?
According to the various reports that have been published over the last few years, it has become clear that minimizing attack vectors and exposure of our assets requires a good vulnerability and patch management cycle.
That is why the different tools we find in the market, despite the fact that there is a great deal of competition, all of them must comply with the minimum requirements and all of them will do the same main job: discovering vulnerabilities in our infrastructure. Beyond this, there are different predefined configurations for more specific scanners: PCI, ISO, Web Apps, etc.
Another important factor depending on the size and budget of our company, for obvious reasons, is the price. Although we thought that they might all be in the same price range, this is not the case. And this is a good thing because it allows us a free choice depending on our needs.
Join The Resistance!
Having a vulnerability management policy in your company can help to minimize risks, since it helps to reduce many vectors thanks to a good patching policy. We will never be infallible to attacks, but with more cybersecurity professionals in the world, we can keep as many doors closed.
Ironhack’s Cybersecurity bootcamps prepare you for this and much much more. Close the doors on attackers, and open the doors to your new skillset and even your new career. Learn more and schedule your call with our admission team.
