Q. You are asked to set up a vulnerability management system (ongoing vulnerabil
ID: 3823685 • Letter: Q
Question
Q. You are asked to set up a vulnerability management system (ongoing vulnerability scanning and remediation) for an Extranet containing approximately 1200 devices (aka nodes). The machines are spread across an entire class B network which has been divided into subnets using the mask 255.255.255.0. All subnets are not being used. The customer has given you a list of assets and IPs, but many domains are dynamic or virtual or contain laptops and other nomadic/mobile devices.
a. The customer has given you an asset list and feels that this is good enough for you to work off of, what do you tell them? What are the challenges with discovery on this network and how do you overcome them?
b. Not having much detail about their network architecture, but knowing there are firewalls, proxies and load balancers in place, what issues should you be aware of, and what general principles would you strive to obey.
c. Further, what questions would you ask before deciding on a solution and architecture?
Explanation / Answer
Vulnerability management is that the method during which vulnerabilities in IT are known and therefore the risks of those vulnerabilities are evaluated.
This analysis ends up in correcting the vulnerabilities and removing the chance or a proper risk acceptance by the management of a company.
The term vulnerability management is usually confused with vulnerability scanning. Despite the very fact each are connected, there's a crucial distinction between the 2. Vulnerability scanning consists of employing a Trojan horse to spot vulnerabilities in networks, pc infrastructure or applications. Vulnerability management is that the method encompassing vulnerability scanning, additionally taking under consideration different aspects like risk acceptance, correction etc.
The increasing growth of cyber-crime and therefore the associated risks are forcing most organizations to focus a lot of attention on info security.
A vulnerability management method ought to be a part of AN organization’s effort to regulate info security risks.
This method can enable a company to get endless summary of vulnerabilities in their IT surroundings and therefore the risks related to them.
Solely by distinctive and mitigating vulnerabilities within the IT surroundings will a company stop attackers from penetrating their networks and stealing info.
There’s some risk committed vulnerability management or a lot of specifically, vulnerability scanning. Since vulnerability scanning usually involves causing an outsized variety of packets to systems, they could generally trigger uncommon effects like – as an example - disrupting network instrumentality. However, since vulnerability scanning is principally restricted to scanning and not exploiting, risks ar lowest.
So as to hide these risks, it’s forever vital to tell numerous stakeholders inside your organization once vulnerability scanning is going down.
Agent-based observation ensures that each device on that the agent is put in reports its standing, configurations, vulnerabilities, and wants for patches. Agents additionally build it potential for organizations to put in and manage patches for every plus.
Intermittently connected devices report once hooked up to the network, even through VPN or a web affiliation.
Devices that are forever on and connected report on a given schedule, reducing network information measure consumption. AN integrated resolution that comes with each network- and agent-based scans and assessments offers the simplest of each world.
Network scanning takes snapshots of the state of all connected assets, whereas agents monitor individual assets for vulnerabilities and configuration problems also as manage installation of patches for each on-line and mobile device.
Such a unified system helps organizations avoid the prices of desegregation and correlating databases and schemas from multiple security vendors, whereas creating it potential to form a worldwide report of assets and vulnerabilities.
Finally, it eliminates the requirement for multiple securities and operational IT groups, creating the answer easier to deploy with a shorter learning curve for IT.
The quantity of servers, desktops, laptops, phones and private devices accessing network information is consistently growing.
The quantity of applications in use grows nearly exponentially. And as illustrious vulnerabilities grew in variety, IT managers found that ancient vulnerability management solutions may simply realize a lot of issues than might be fastened.
One resolution has been to consider building higher walls round the network to stay attackers from accessing the weaknesses. Vulnerabilities are addressed once and if there are resources offered.
Other solutions are to scan simply the foremost vital network resources, or to range the vulnerabilities in order that restricted resources might be applied to fixing simply those who were possibly to be mis-used.
None of those solutions are operating okay. Even random and unfocused attackers ar habitually bypassing antivirus, firewall and IPS to seek out and exploit the vulnerabilities on secondary systems or that were left unrepaired as a result of they weren't high risk.
The overwhelming majority of self-made attacks are on the foremost accepted, serious, simply discovered and simply exploited vulnerabilities.
Most attackers study abreast of a particular vulnerability then search broadly speaking for any network that has that weakness then they exploit it to achieve access. From that beachhead they expand their management through the network then rummage around for the precious information they'll steal while not being discovered.
Vulnerability management is that the "cyclical apply of distinctive, classifying, remediating, and mitigating vulnerabilities", particularly in software system and computer code. Vulnerability management is integral to pc security and network security.
Vulnerabilities is discovered with a vulnerability scanner, that analyzes a ADPS in search of illustrious vulnerabilities, like open ports, insecure software system configuration, and condition to malware. Unknown vulnerabilities, like a zero-day attack could also be found with fuzz testing, which may determine bound varieties of vulnerabilities, like a buffer overflow exploit with relevant check cases. Such analysis is expedited by check automation.
Additionally, antivirus software system capable of heuristic analysis could discover unsupported malware if it finds software system behaving suspiciously.
Correcting vulnerabilities could multifariously involve the installation of a patch, a amendment in network security policy, reconfiguration of software system , or educating users concerning social engineering.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.