As a newbie to the world of Information security, we are often bowled by the various security definitions that we encounter in various security posts. We will see the various security terms followed by an in-depth explanation of Vulnerability in this post.
Vulnerability:
A “vulnerability” is a weakness in the software or hardware. This vulnerability can be exploited by hackers to cause physical and personal damages. Browser vulnerabilities, OS vulnerabilities, unpatched software are some examples of vulnerabilities. Any software or hardware is guaranteed to have a “vulnerability”. Understanding the vulnerabilities and the reports is part of vulnerability assessment tools. Let us consider some examples of vulnerabilities which were reported recently:
1. There was a recent whisper about Whatsapp backdoor vulnerability which was firmly denied by Open Whisper Systems on Jan 13, 2017. (There is no WhatsApp ‘backdoor’)
2. Another prevalent vulnerability is “browser vulnerability”. Browsers like Chrome, Safari, Mozilla Firefox lead in the list found to have browser vulnerabilities. According to the Vulnerability report of 2016 by Flexara Software, “There has been a 44% increase in the number of vulnerabilities discovered in the most popular browsers: Google Chrome, Mozilla Firefox, Internet Explorer, Opera and Safari” (Vulnerability Review 2016: Browser Security)
Some examples of vulnerability scanners are Nessus and OpenVAS which scan for vulnerabilities and reports them before hackers use them for malicious purposes. We will be discussing the ‘Nessus vulnerability scanner’ by ‘Tenable Network Security’ in the section below:
Nessus Vulnerability scanner:
The ‘Nessus Home’ can be used in a personalized home environment and can be used to scan our personal home network alone. It can be downloaded from https://www.tenable.com/products/nessus-home and it can be used to scan 16 IP addresses.
The Nessus vulnerability scanner is used to “identify policy violating configurations and vulnerabilities” (Nessus) which might be exploited by hackers. The Nessus scanner has three important parts:
a. create policies as per scan requirement
b. perform the scanning
c. generate reports
The following is a screen shot of the policies screen.
Once the policy has been created, a scan is launched to list the vulnerabilities.
Reports are generated which can be exported onto PDF, HTML, CSV or other formats. Having seen vulnerabilities and how to detect them, let us move onto other security parlance.
Risk:
A vulnerability that is exploited by threat agents is “risk”. While risk cannot be entirely avoided, it can be mitigated to some extent. Risk assessments are done to evaluate the situation and work accordingly. There are two types of risk assessment – qualitative risk assessment and quantitative risk assessment.
Risk management is an important aspect of Information security programs.
Threat:
Threat is perceived as the entity that exploits the vulnerability. A threat agent is the actual trigger that exploits the vulnerability. For example, an earthquake is the threat agent that exploits earthquake prone zones and destroys its facilities. Other examples of threats include administrative threats like genuine or careless omissions by employees, disgruntled former employees who might be looking for ways to cause damage to an organization.
Countermeasure:
A countermeasure is the safeguard that is applied to secure physical and monetary assets and reduce risks. Anti-virus definitions, firewalls, anti-spyware are all examples of countermeasures to thwart threats and reduce risks.
We saw the popular terms in the InfoSec world. Join me as we embark on another exciting post in the security domain.
Bibliography
Nessus. (n.d.). Retrieved from Tenable Network Security: https://www.tenable.com/products/nessus-vulnerability-scanner
There is no WhatsApp ‘backdoor’. (n.d.). Retrieved from Open Whisper Systems: https://whispersystems.org/blog/there-is-no-whatsapp-backdoor/
Vulnerability Review 2016: Browser Security. (n.d.). Retrieved from Flexara Software: https://www.flexerasoftware.com/enterprise/resources/research/vulnerability-review/tab/browser-security