Security+ Guide to Network

Security Fundamentals,

Fourth Edition

Chapter 4

Vulnerability Assessment

and Mitigating Attacks

Security+ Guide to Network Security Fundamentals, Fourth Edition

Objectives

• Define vulnerability assessment and explain why it is important

• List vulnerability assessment techniques and tools

• Explain the differences between vulnerability scanning and penetration testing

• List techniques for mitigating and deterring attacks

2

Security+ Guide to Network Security Fundamentals, Fourth Edition

Vulnerability Assessment

• Systematic evaluation of asset exposure

– Attackers

– Forces of nature

– Any potentially harmful entity

• Aspects of vulnerability assessment

– Asset identification

– Threat evaluation

– Vulnerability appraisal

– Risk assessment

– Risk mitigation

3

Security+ Guide to Network Security Fundamentals, Fourth Edition

Vulnerability Assessment (cont’d.)

• Asset identification

– Process of inventorying items with economic value

• Common assets

– People

– Physical assets

– Data

– Hardware

– Software

4

Security+ Guide to Network Security Fundamentals, Fourth Edition

Vulnerability Assessment (cont’d.)

• Determine each item’s relative value

– Asset’s criticality to organization’s goals

– How much revenue asset generates

– How difficult to replace asset

– Impact of asset unavailability to the organization

• Could rank using a number scale

5

Security+ Guide to Network Security Fundamentals, Fourth Edition

Vulnerability Assessment (cont’d.)

• Threat evaluation

– List potential threats

• Threat modeling

– Goal: understand attackers and their methods

– Often done by constructing scenarios

• Attack tree

– Provides visual representation of potential attacks

– Inverted tree structure

6

Security+ Guide to Network Security Fundamentals, Fourth Edition 7

Table 4-1 Common threat agents

Security+ Guide to Network Security Fundamentals, Fourth Edition 8

Figure 4-1 Attack tree for stealing a car stereo© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 9

Figure 4-2 Attack tree for breaking into grading system© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition

Vulnerability Assessment (cont’d.)

• Vulnerability appraisal

– Determine current weaknesses

• Snapshot of current organization security

– Every asset should be viewed in light of each threat

– Catalog each vulnerability

• Risk assessment

– Determine damage resulting from attack

– Assess likelihood that vulnerability is a risk to

organization

10