Overview
Vulnerability Assessment and Penetration Testing (VAPT) these are two types of vulnerability testing mechanism. They are having different strength areas. These are often acts together to do effective vulnerability analysis. It basically designed to perform two different tasks, to achieve different goals, within the same area of focus.
Vulnerability Assessment and Penetration Testing (VAPT):
It is the process of evaluating the security vulnerabilities in a system. It attempts to evaluate the vulnerabilities in a system to determine if any unauthorized access or other malicious activity can be possible and identified.
Vulnerability assessment tools are designer to evaluate the vulnerabilities that are present, but can’t recognize between exploitable ones and those which aren’t. Vulnerability scanners help the companies to identify the flaws along with their exact location.
Penetration tests are designed to exploit the vulnerabilities to evaluate if any breach or other malicious activity is possible or not, and which threat can be dangerous to the different applications. Penetration tests find exploitable flaws and measure the severity of each. A penetration test is designed to evaluate the degree of damage of a threat. Together, these two tests can provide a wholesome picture of the vulnerability that exists in the system.
Outcomes of VAPT:
Executive Report – A high level report for identified issues, risk ratings and action items.
Technical Report – A detailed analysis of issue identified, step-by-step POCs for each issue, code and configuration.
Real-Time Online Dashboard – A portal for evaluating the real time audit progress to take immediate actions for high risk issues, track fixes and closure status etc.
Best VAPT tools:
- Cloud based netsparker Security Scanner editor’s decision Mechanized weakness filtering and penetration testing device accessible from the cloud or for establishment on windows.
- Acunetix web weakness scanner: It is a site weakness scanner and penetration testing framework.
- Intruder: It is a cloud-based weakness scanner for human penetration testing.
- Manage Motor weakness oversees: A weakness scanner and computerized frameworks to fix found vulnerabilities.
- Metasploit: It is an open-source penetration testing structure, available free of charge or in paid form. It can be introduced on windows, windows server, RHEL, and Ubuntu.
- NMAP: A free of cost organization weakness scanner consists of a front end, called Zenmap. It can be introduce on Windows, Linux, UNIX, and Mac operating system.
- Wireshark: It is a mainstream bundle sniffer for wired and remote organizations. It can be introduced on windows, Linux, Unix, and Mac operating system.
- John the Ripper: It is a free of cost, open-source secret key wafer, and hash type indicator. It can be introduced on UNIX, macOS, Windows, DOS, BeOS, and OpenVMS.
- Nessus Application: It is a weakness assessor available in free of cost or in paid forms. It can be introduces on windows, windows server, Linux, Mac operating system, and Free BSD.
- Aircrack-ng: It is a notable remote organization bundle sniffer that runs on Linux.
Compliance standards for VAPT:
ISO 27002 / ISO 27001
PCI DSS – Payment Card Industry Data Security Standard
SOX – Sarbans-Oxley Act
HIPAA – Health Insurance Portability and Accountability Act
TRAI – Telecom Regulatory Authority of India
DOT – Department of Telecommunication
CERT-In – Cyber Emergency Response Team of India
GLBA – The Gramm–Leach–Bliley Act
FISMA – The Federal Information Security Management Act
NIST – National Institute of Standards and Technology
SAS 70 – Statement on Auditing Standards
COBIT – Control Objectives for Information and Related Technology
Different types of vulnerability assessments:
- Host assessment– The assessment of critical servers.
- Network and wireless assessment– The evaluation of policies and practices to prevent the breach to private or public networks and accessible resources.
- Database assessment– The analysis of databases for vulnerabilities, loop holes, misconfigurations, classifying sensitive data across the infrastructure.
- Application scans – The identification of vulnerabilities in the source code of the web applications.
Vulnerability assessment process
Vulnerability identification (testing):
In this step the list of the vulnerabilities is being documented. Security analysts evaluates the security system condition of applications, servers or other systems by automatic tools or manually.
Vulnerability analysis:
This step involves the identification of system components that are responsible for vulnerability, or the root cause of it.
Risk assessment:
The objective of this step is to assess the priorities of the vulnerabilities. The rank of the vulnerability, are based on the f factors as:
Affected system.
Vulnerable data.
Vulnerable business functions.
Scope of attack.
Degree of an attack.
Possible potential damage.
Remediation
Here the security gaps are being closed. It’s an effort made by security staff, development and operations teams to determine the most effective path for remediation of each vulnerability.
Remediation steps:
Introduction of new security measures.
The update of operational changes.
Implementation of vulnerability patches.
Vulnerability assessment tools:
Web applications are being scanned to simulate known attack patterns.
Protocol to evaluate the vulnerable protocols, ports and network services.
Network scanners to visualize networks and trigger warning signals for different threats.
Objective of Penetration Testing:
Internal/outside framework testing
Mobile application testing
Web application testing
Social designing testing
Wireless organization testing
Build and arrangement survey testing
NeuraLegion Israel :
It has revolutionized the perspective of application security testing, by combining Machine Learning Algorithms and an offensive approach to application security testing (AST).It eliminates the usage for complex integration and usage.
Application security platform NeuraLegion , Israel is an enterprise-focused investment firm, based in Tel Aviv, Israel, NeuraLegion having branch in San Francisco, London and Mostar, Bosnia.
Where NeuraLegion is different from other application security solutions in the aspect that it was created specifically developers, quality assurance and DevOps workers, but can also be used by security professionals. It allows scans in much earlier time in the development process in a cost effective way.
NeuraLegion is now used by the developers worldwide .With the release of its self-serve, community product it becomes more accessible to developers, as they can now sign up on their own, run their first scans and get results within few minutes.
It consists of next-generation platform to introduce a new way of conducting robust testing. It helps to improve application security in a cost effective way
Application:
Business organizations
