Vulnerability Assessment: what it is (and what it is not)

Best practices for delivering a Vulnerability Assessment Report

Vulnerability Assessment (VA) refers to a series of actions that aim to identify the greatest possible number of cyber vulnerabilities, then analyze them to look for actual risks and determine, within certain limits, the real security level of an organization. This happens without validating vulnerabilities resulting from targeted attacks, or at least in the first place. This does not imply that a Vulnerability Assessment cannot cause downtime or disruptions, as will be explained.

Here a definition of “vulnerability” can be useful: [1] it refers to a weakness in an IT system, that is, a security procedure, an internal check or an implementation that could be exploited or triggered by a source of threats. To identify the existing vulnerabilities using a shared terminology, specific international frameworks come to our aid, first among everything the CVE Program [2], whose mission is “to identify, define and catalog publicly disclosed cybersecurity vulnerabilities”.

Each vulnerability is so provided with a unique CVE code (Common Vulnerability Exposure), an associated description and a 0 to 10 severity score CVSS (Common Vulnerability Scoring System), which provides a first indication of its severity and the subsequent priority that should be given to its mitigation.

Phases of a Vulnerability Assessment

Let us focus on VA, which can be divided in three distinct steps: planning, execution, analysis.

In the planning step the targeted assets are defined, as well as the tools used according to the specific type of VA.

During the execution, automated tools are usually employed to scan targets in search of possible vulnerabilities, generating afterwards a report that includes the identified CVE.

The last step, analysis, is at the same time the most important and the most overlooked one: one or more experts analyze the report generated by the automated tool, in order to manually validate the detected vulnerabilities, if necessary. This allows to define a mitigation plan, to remove all possible security leaks caused by the combination of certain vulnerabilities.

Targets and methodologies of a Vulnerability Assessment

A Vulnerability Assessment aims at analyzing the assets of an organization’s IT network, the existing links within the network and outwards.

In a VA powerful scanning programs come into action and detect active endpoints in the network as well as the related versions of operating systems, open doors and the services exposed by these. This process, which can last several hours in a network of great dimensions, generates network traffic towards all open doors on each host, so obtaining information on the active versions of the various communication protocols or services according to the answers received. From this information it is possible to trace back the presence of specific CVE. As we are usually dealing with real and actively used networks, the execution phase can cause slowdowns or disruption, due to the amount of traffic, even though this step does not include the real launch of an attack (exploit).

Therefore, it is necessary to schedule this activity outside critical working times and to take false alarms deriving from protection systems into account.

Furthermore, it is possible to install tools directly on a specific endpoint, to obtain even more detailed information about software use, protocols and services which are not updated or still vulnerable, as well as about non optimal settings. This expedient reduces the likelihood to cause disservices to other host in the network.

Vulnerability Assessment and Penetration Test

It often happens that VA activities (or rather only the planning and execution steps) are mistaken for Penetration Test (PT) related activities. Let us shed some light on the essential differences between these two activities:

• Vulnerability Validation: a VA only identifies vulnerabilities, mostly through indirect methods such as analysis of traffic exchanged with targets. Such vulnerabilities are, usually, only assumed, and must be validated in the manual analysis phase. On the contrary, in a PT vulnerabilities are actively exploited in real attack simulations. Therefore, there is not possibility of false positives, and all detected vulnerabilities are necessarily critical issues to be resolved.
• Automation: Today the execution of a VA can be easily automated, through vulnerabilities detection and scanning systems. On the other hand, a PT requires a lot of manual work by highly specialized staff, in order to correctly choose the targets and the attack configuration, as well as to avoid possible blockage of the network or even of the PT steps, due to the reaction of protection systems.
• Extent: A VA aims to detect the greatest possible number of vulnerabilities in the target assets and to generate an exhaustive report, providing a comprehensive picture, even though superficial, of the current security level. The price to pay is the large volume of data in the report, among which several vulnerabilities, which are not really exploitable during an attack, are included. A PT does not instead explore all possible vulnerabilities, but only those attack paths that allow to approach to the compromission of critical assets, generating a more limited report. Therefore it is useful to perform frequent PTs, as new attack paths are created due to the combination of new or hidden vulnerabilities, which were not previously considered risky.
• Realism: A VA does not claim to be realistic: it simply lists all vulnerabilities, producing a visible impact on network activity and making itself detectable by protection systems. On the contrary, a PT simulates a real attack scenario, by adopting bypass techniques to act unhindered. In certain cases, this allows to identify critical vulnerabilities that could elude a VA, as they are hidden deep down and detectable only thanks to an attack combination, carried out without causing suspects or blockages.
• Duration: the execution of a VA is a static scan of targets. Therefore, its has a predictable and limited duration, that is, a few hours at most. A PT, instead, needs to keep the volume of generated traffic low and, often, to track the working hours, both of client targets and of the pentester itself. So it usually lasts several days.