Why would your Business need VAPT?
It is very necessary to conduct a network security audit periodically to ensure the firm gains stability, scalable on its network health as well as to secure IT network infrastructure.
If there is a regular security audit, it would be easier for an organization to identify flaws or security holes in their network security before the attackers able to launch an attack. Mostly VAPT is conducted by an external team so that they can find network components that are open to known vulnerabilities without actually compromising the systems.
The Network Vulnerability Assessment and Penetration Testing (VAPT), is a methodological process. These assessment procedures were done by security experts on the network end to identify vulnerabilities that attackers may exploit. This would allow you to manage a list of identified vulnerabilities in your network and understand how to fix them so that you are ensured to be one step ahead of possible attackers.
Key Terms:
VAPT – Vulnerability Assessment and Penetration Testing
Vulnerability is a potential risk for the system. The attacker uses these vulnerabilities to exploit the system and get unauthorized access and information.
A threat is a condition or circumstance which causes damage to the system or asset.
The attack is a purposefully made action to cause damage to the system to get unauthorized access.
An exploit is software or a piece of code that aims to take control of computers or steal network data.
Vulnerability Assessment
Vulnerability assessment is the process of scanning to find out the flaws and loopholes in a system or software or network. These flaws can provide a backdoor to the attacker to launch the attack. A system may have access to control vulnerability, Boundary condition vulnerability, Input validation vulnerability, Authentication Vulnerabilities, Configuration Weakness Vulnerabilities, and Exception Handling Vulnerabilities, etc. In the corporate world, the focus of threats may vary with the implementation of strong defense solutions in different perimeters. These include firewalls, IDS, content filtering, and two-factor authentication.
Nowadays most of companies are concentrating in their internal security and a rapidly growing number of simple methods. These methods can enable legitimate users to create a back door into the company’s network.
The next step to vulnerability assessment is Penetration testing.
Penetration Testing
Also known as a pen test or ethical hacking.
The goal of a penetration test is to improve network security as well as protection for the entire network. This is to identify exploitable vulnerabilities in network components (systems, hosts, routers, switches, etc.) before hackers are able to find and exploit them in an authorized manner. In pen testing, the tester can intently exploit the system and find out possible exploits.
Pen tests involve a variety of step by step procedures that are designed to explore a network to identify potential vulnerabilities and test to ensure the vulnerabilities are real. It is recommended to fix all the issues within the network, which were discovered during the pen test, in order to avoid future attacks.
VAPT includes the following tests:
1. Network Penetration Test:
-
detection of network and system-level vulnerabilities
-
identification of incorrect configurations and settings
-
identify the vulnerability of the wireless network
-
fraudulent services
-
lack of strong passwords and the presence of weak protocols
2. Application Penetration Test:
-
identification of application-level deficiencies
-
fake requests
-
the use of malicious scripts
-
violation of session management
3. Physical Penetration Test:
-
breaking physical barriers
-
checking and breaking locks
-
malfunctions and sensor bypass
-
disabling CCTV cameras
4. Device Penetration Testing (IoT):
-
detection of hardware and software deficiencies of devices
-
brute force weak passwords
-
identifying insecure protocols, APIs, and communication channels
-
configuration violation and more
Who conducts VAPT?
A security specialist of the organization who knows the system from the inside, its strengths and weaknesses. If a pen test is carried out by a specialist with a minimum level of knowledge about the constructed protection system, he is more likely to find out the flaws missed by developers while building and organizing protection levels.
The other choice for this role is the third-party contractors specializing in this field, ethical hackers. This because they have a lot of experiences which is used for good intentions and with the aim of improving security.
Steps of VAPT
-
Collecting information - gathering information about the organization and employees in open sources, social media networks, forums, and blogs.
-
Collect technical information - identifying the existing resources, applications, and hardware for the enterprise.
-
Vulnerabilities and threats analysis – vulnerabilities detection in security systems and applications using a set of tools and utilities.
-
Operation and data processing - imitation of a real attack to collect the information about any vulnerabilities with further analysis.
-
Documentation – designing, drafting, and presenting the findings made during the pentest with suggestions for improving the existing security system.
Vulnerability Assessment and Penetration Testing has a 9 steps. The steps are:
Scope -> Reconnaissance -> vulnerability Detection -> Information Analysis and Planning -> Penetration testing -> Privilege Escalation -> Result Analysis -> Reporting -> Clean-up
The tester has to decide the scope of the assignment (Black/grey/white box). Then tester gathers information about the operating system, network, and IP address in reconnaissance step. Once this has done, the tester use various vulnerability assessment technique on the testing object to find out vulnerabilities. Then tester analyses the founded vulnerability and make plan for pentest to penetrate the victim’s system. After penetrating the system, tester increases the privilege in the system. In the next step, the tester analyses the all results and devise recommendation to resolve the vulnerability from the system. All these activities are documented and sent to management to take suitable action. After these all step, the victim’s system and its program get affected and altered. In cleanup step we restore the system in previous state as it was before VAPT process was started.
PenTest Techniques
Black Box Testing (Blind Test)
Here, the tester do not provide any relevant information about the network architecture or systems of the testing network. But they have some basic data for a general understanding of the company. This test is performed from external network to internal network. Tester have to use his expertise and skills to perform this testing.
White Box Testing
In this test, the Tester have a little or complete information of the network configuration as well as the system configuration of the implemented security structure of the organization. Usually this testing is perform from the internal network.
Grey Box Testing
In this technique, the tester have some knowledge of the testing network. But they do not have knowledge of complete network architecture. This testing is a combination of both the black and white techniques. This can be perform either from internal or external network.
Hidden Pentest (double-blind)
Only 1-2 staff from the organization including IT specialists and security specialists who will respond to attacks do not have information about the existing verification can conduct this pentest. For this type of test, it is necessary for the testers to have the detailed document to avoid problems with law enforcement agencies in the event of a proper response from the security service.
External Pentest
It is an attack by an ethical hacker, which is carried out against external servers or devices of the organization, such as their website and network servers. The goal is to determine whether an attacker can launch an attack remotely to the system of network infrastructure and how far if the attacker can move on.
Internal Pentest
This is an imitation of an attack which is carried out by a legitimate user with standard access rights. This helps to determine how much damage an employee who has some personal accounts with respect to the management can do.
Vulnerability Assessment Techniques
Static Analysis
In this technique, we are analyzing the code structure and contents of the system. With this technique we can find out about all type of vulnerabilities. Here we are not exploiting the system, so there won’t be any bad effect of this testing on the system. The demerit of this technique is that it is quite slow and time consuming.
Manual Testing
Here the tester uses his own knowledge and experience to find out the vulnerabilities in the system. That is, it doesn’t require any tool or any software to find out vulnerabilities. This testing can be perform either with well-prepared test plan or without any test plan. Since we do not need to buy any vulnerability assessment tool for this technique, this technique is much cheaper than the others.
Automated Testing
In this testing technique we are using automated vulnerability testing tools to identify the vulnerabilities in the system. These tools execute all the test cases to identify the vulnerabilities. As a result this reduces the time required to perform testing and seems to be very easy. Automated testing provides more accuracy than the other techniques offers. A single tool is not capable to find out all type of vulnerabilities, this increases the total cost to perform this assessment.
Fuzz Testing
Also known as fuzzing. Here, we are looking for crashes and failure by giving invalid inputs or any Random Data into system. This is similar to robustness testing. Very less human interaction is required for this technique. This technique can be used to identify the zero day vulnerability.
VAPT Report
Once a penetration test has been completed, the report shows a list of all network vulnerabilities that were discovered during the test. Mostly the report will also provide suggestions on how to fix the issues.
Pen test deliverables include a series of reports that reveal how security issues were identified and confirmed during the test to determine how the issues should be fixed.
A typical penetration testing report includes a detailed review of the project, the techniques and methodologies that are used during the test, security risk levels based on priority, recommendations for fixing the issues, and suggestions for improving the network security as a whole.
There is also a report with simple terminologies (non-technical terms) which explains how the risks can affect business continuity and potential financial losses that can be incurred as the result of a breach. This can be used for the presentation infront of the management. This part of the report may also include the IT investments which may be necessary to improve network security.
Importance of VAPT
Penetration testing reveals the actual view of the existing security threat and identifies an organization’s vulnerabilities to manual attacks. Pentesting on a regular basis will allow defining technical resources, infrastructure containing weak aspects that require development and improvement. Penetration testing is an element necessary to ensure the security of your organization.
How can we make vulnerability analysis as a cyber-defence technology?
Usually attacker collects the victim’s network and gather information about victim’s network. Once getting the information, the attacker perform vulnerability assessment on the victim’s network/system to make the vulnerability list.
The attacker make a plan for the possible attacks, after getting the vulnerability list of the victim. The attacker starts exploit the victim’s network or system and compromise system security and information with the help of that list. If Victim removes all those vulnerabilities from his system, the attacker won’t be able to exploit the victim’s network/system.
Using the VAPT techniques, users can identify the vulnerabilities those can result in various major attacks such as DDoS attack, RA flooding, ARP poisoning ans so on. After identifying the vulnerabilities user can apply countermeasures against them.
To remove the vulnerabilities, Administrator should identify all the vulnerabilities in his own system/network and apply complete VAPT cycle on the system/network. When the administrator gets the vulnerability list of the system, he must remove those vulnerabilities. To make the system vulnerability free, the administrator should apply the necessary patches, updates, install necessary software and other requisite.
Now even if the attacker try to do vulnerability assessment of the victim’s system/network, he won’t get any open vulnerability in the victim’s system/network. Since no open vulnerabilities in the system, the attacker can’t exploit victim’s system/network. So by using VAPT as a cyber- defence technology, the administrator can be able to save his resources and critical information and can achieve proactive cyber defence.
