Skip links
Services

RedRays Vulnerability assessment services

Vulnerability assessment

Web aplications

Our Team provides penetration testing of WEB applications regardless of the platform and programming language.

Network

Hub IT allows your business and technology computers to store, transmit, analyze, and manipulate big data.Our Team simulates real-world attacks to provide a point-in-time assessment of vulnerabilities and threats to your internal and external network infrastructure.

Host

Our Team provides penetration testing of Hosts regardless of the platform.

Vulnerability assessment roadmap
Initial assessment
Identify the assets and define the risk and critical value for each device (based on the client input), such as a security assessment vulnerability scanner. It’s important to identify at least the importance of the device that you have on your network or at least the devices that you’ll test. It’s also important to understand if the device (or devices) can be accessed by any member of your company (such as a public computer or a kiosk) or just administrators and authorized users.

Understand the strategic factors and have a clear understanding of details, including:

Risk appetite
Risk tolerance level
Risk mitigation practices and policies for each device
Residual risk treatment
Countermeasures for each device or service (if the service is correlated with the device)
Business impact analysis
Perform a vulnerability scan
Third, Use the right policy on your scanner to accomplish the desired results. Prior to starting the vulnerability scan, look for any compliance requirements based on your company’s posture and business, and know the best time and date to perform the scan. It’s important to recognize the client industry context and determine if the scan can be performed all at once or if a segmentation is needed. An important step is to re-define and get the approval of the policy for the vulnerability scan to be performed.

For the best results, use related tools and plug-ins on the vulnerability assessment platform, such as:

Best scan (i.e., popular ports)
CMS web scan (Joomla, WordPress, Drupal, general CMS, etc.)
Quick scan
Most common ports best scan (i.e., 65,535 ports)
Firewall scan
Stealth scan
Aggressive scan
Full scan, exploits and distributed denial-of-service (DDoS) attacks
Open Web Application Security Project (OWASP) Top 10 Scan, OWASP Checks
Payment Card Industry Data Security Standard (PCI DSS) preparation for web applications
Health Insurance Portability and Accountability Act (HIPAA) policy scan for compliance
In case you need to perform a manual scan for the critical assets to ensure the best results, be sure to configure the credentials on the scanner configuration to perform a better and deeper vulnerability assessment (if the credentials are shared with the team)

Vulnerability assessment report creation
The fourth and most important step is the report creation. Pay attention to the details and try to add extra value on the recommendations phase. To get real value from the final report, add recommendations based on the initial assessment goals.

Also, add risk mitigation techniques based on the criticalness of the assets and results. Add findings related to any possible gap between the results and the system baseline definition (deviations in any misconfiguration and discoveries made), and recommendations to correct the deviations and mitigate possible vulnerabilities. Findings on the vulnerability assessment are normally very useful and are ordered in a way to ensure the understanding of the finding.

However, it’s important to keep the following details in mind and realize that high and medium vulnerabilities should have a detailed report that may include:

The name of vulnerability
The date of discovery
The score, based on Common Vulnerabilities and Exposures (CVE) databases
A detailed description of the vulnerability
Details regarding the affected systems
Details regarding the process to correct the vulnerability
A proof of concept (PoC) of the vulnerability for the system (if possible)
A blank field for the owner of the vulnerability, the time it took to correct, the next revision and countermeasures between the final solution
Armed with this basic list when performing a vulnerability assessment, the recommendations phase will reflect a complete understanding of the security posture in all the different aspects of the process. It will also deliver a better outcome for something that, in most cases, is a just a compliance tool.

Contact us to secure your IT needs.