4.1 Vulnerability management
📘CompTIA Security+ (SY0-701)
Vulnerability Management: Identification
Purpose:
The goal of vulnerability management is to find weaknesses in your IT environment before attackers do. Identification is the first step: knowing what vulnerabilities exist so you can fix them.
1. Scans
Definition: Scanning is using automated tools to check your systems, networks, and applications for weaknesses.
Types of scans:
- Network Vulnerability Scans:
- Look for open ports, outdated software, weak configurations, and missing patches.
- Tools: Nessus, OpenVAS, Qualys.
- Host-based Scans:
- Check individual servers or workstations for vulnerabilities in software, OS, or settings.
- Example: A Windows server missing the latest security patch.
- Application Scans:
- Test web apps or mobile apps for known vulnerabilities like SQL injection or cross-site scripting (XSS).
- Tools: Burp Suite, OWASP ZAP.
Why important: Scans provide a list of known vulnerabilities and are repeatable to track progress over time.
2. Static and Dynamic Analysis
These are methods of analyzing code to find vulnerabilities in applications.
- Static Application Security Testing (SAST):
- Examines source code without running the program.
- Finds vulnerabilities like hardcoded passwords, buffer overflows, or insecure functions.
- Tools: SonarQube, Fortify.
- Example: Detecting a function that allows attackers to access admin privileges.
- Dynamic Application Security Testing (DAST):
- Tests the application while it’s running.
- Finds issues like authentication bypasses, runtime errors, or input validation flaws.
- Tools: OWASP ZAP, Burp Suite.
- Example: Sending malicious input to see if the app exposes sensitive data.
Why important: Static checks catch code problems early; dynamic tests show real-world exploitable weaknesses.
3. Threat Feeds
Threat feeds are sources of information about current security threats and vulnerabilities. They help organizations stay aware of risks.
Types of threat feeds:
- OSINT (Open Source Intelligence):
- Publicly available information about vulnerabilities.
- Sources: Security blogs, mailing lists, forums, and vulnerability databases like CVE.
- Proprietary Feeds:
- Paid feeds from security vendors that provide curated threat intelligence.
- Examples: FireEye, Palo Alto Networks Threat Intelligence.
- Dark Web Feeds:
- Information from hacker forums and illegal marketplaces.
- Shows emerging threats before they are widely exploited.
Why important: Helps prioritize which vulnerabilities are most critical and likely to be attacked.
4. Penetration Testing (Pen Testing)
Definition: Ethical hackers simulate real attacks to find weaknesses.
How it works:
- Testers try to exploit vulnerabilities in networks, servers, or apps.
- They provide a report with findings and recommendations.
Tools used: Metasploit, Nmap, Kali Linux tools.
Why important: Pen testing goes beyond automated scans, showing real attack paths.
5. Bug Bounties
Definition: Programs where external security researchers are rewarded for reporting vulnerabilities.
Key points:
- Companies invite ethical hackers to test their software.
- Rewards depend on severity of the vulnerability.
- Example: A researcher finds a critical bug in a web application and reports it for a monetary reward.
Why important: Bug bounties provide continuous external testing and uncover issues internal teams might miss.
6. Audits
Definition: Formal review of systems, configurations, and policies to ensure compliance and security.
Types of audits:
- Internal audits: Conducted by in-house IT or security teams.
- External audits: Conducted by third-party organizations.
- Compliance audits: Check if the organization meets standards like PCI-DSS, ISO 27001, HIPAA.
Why important: Audits can reveal policy violations, misconfigurations, and missing patches that automated tools might not detect.
Summary Table: Identification Methods
| Method | What it Does | Example Tools | Why Important |
|---|---|---|---|
| Scans | Automates checking for known vulnerabilities | Nessus, OpenVAS | Quickly identifies outdated software, open ports, and misconfigurations |
| Static Analysis | Checks source code for weaknesses | SonarQube, Fortify | Detects coding mistakes before software runs |
| Dynamic Analysis | Tests running applications | OWASP ZAP, Burp Suite | Finds vulnerabilities visible during execution |
| Threat Feeds | Provides intelligence on current threats | CVE, FireEye, dark web feeds | Helps prioritize vulnerabilities based on real-world attacks |
| Penetration Testing | Simulates attacks | Metasploit, Nmap | Reveals exploitable vulnerabilities and attack paths |
| Bug Bounties | Rewards external testers for finding bugs | HackerOne, Bugcrowd | Provides continuous external testing |
| Audits | Reviews systems for compliance/security | Internal & external auditors | Detects misconfigurations, policy violations, and gaps |
Exam Tips:
- Know the difference between SAST and DAST.
- Remember that scans are automated, while pen tests simulate real attacks.
- Understand threat feeds types: OSINT (public), proprietary (paid), dark web (hidden).
- Audits and bug bounties are more manual but provide unique insights.
