Vulnerability Assessment
Vulnerabilities in an organization’s systems provide malicious actors with a foothold in the network. By gaining an understanding of what vulnerabilities exist with a Vulnerability Assessment, these security risks can be analyzed and mitigated. Whether performed from an external, internet facing perspective or from the perspective of an internal actor such as a malicious insider to the organization or an external actor that has already gained access to the network and is looking to expand their access, Vulnerability Assessments give detailed insight into the attack surface.
This Assessment consists of three main phases:
Scope Determination and Timing
In-scope targets are identified and confirmed for scanning. Open source intelligence gathering is performed for external tests to identify any hosts which are externally facing that may not have been known to the organization. Scan time windows are confirmed to ensure no disruption to organizational functioning occurs.
Scanning and Documentation
Scans are performed and the results are captured and documented. Scanning may be performed remotely or onsite depending on the type of assessment and organization preference.
Analysis and Reporting
The results of the scan are identified and put into context for the organization. Impact and likelihood of different risks are determined as well as qualitative analysis for management and technical personnel. Analysis and recommendations for remediation are provided in a report and walked through with organizational personnel.