> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/analysis-and-exploration-of-vulnerabilities/vulnerability-assessment-of-networked-systems/vulnerability-management-life-cycle.md). # Vulnerability Management Life Cycle
## Establish a Baseline **Select the assets** to be assessed and **define priorities**. * Some assets may be excluded due to potential impact or cost. **Characterize the systems**/software state. Determine **what is known and what must be assessed**. * Known vulnerabilities may be ignored from the assessment. ## Vulnerability Assessment Assess the entities for vulnerabilities. * Takes into consideration priorities. * Takes into consideration scope. Construct a detailed report with: * What vulnerability was found? * What are the affected entities? * What are the recommendations to handle it? **Assessment usually doesn’t exploit the vulnerability or build an exploit chain.** * It’s not a penetration test. ### Assessment Methods A subject close to software testing but with a **focus on security-related impact**. * Extensively studied in the Robust Software course. **Highly dependent on the scope** of the assessment. * Application: Static, Dynamic, or Component Analysis. * Network entity: Protocol, message, authentication, authorization analysis. * Processes/Companies: OSINT, Social Engineering. ### Assessment Strategies #### Black Box Researchers have **no information about internal aspects and are presented with a publicly available view**. * No source code, no documentation. * Assumes an actor with a specific set of resources. * Script kiddie, a researcher, competitor, a crowd-based effort. Aims to mimic assessments from outside attackers. * Finds what can be explored by intruders with no access. * Usually finds vulnerabilities easier to exploit. * May find alternative paths and use cases (which may present vulnerabilities). Limited on the impact of the assessment. * Existing vulnerabilities with remedies (e.g. Firewall) may not be detected. #### White Box Researchers are given **full documentation and access to systems**. * A replica of the production system. * The production system with a limited scope. * The source code and infrastructure code. Aims to find faults and bugs in all scoped domains. * Assumes an actor at any location (insider and outsider). * Finds what can be exploited by: outsiders, insiders, outsiders with lateral movement. * May mimic specific users and roles. Extensive (and expensive) analysis of the domains. * Remedies are known and considered, but vulnerability may still be found. #### Gray Box Some information is provided to researchers. * Documentation about the application or systems. * A specific set of credentials. Aims to find faults and bugs in a limited set of scoped domains. * Can mimic a specific user. ## Risk Assessment The company takes into consideration the report and assesses the risk. * For every asset with vulnerabilities. * Assign risk indicators (3-4 levels). Risk assessment may take into consideration all vulnerabilities found. * Individual vulnerabilities may be combined in an exploit chain with higher impact. ### Documentation Researchers should carefully document assessments. * Describe the rationale for the assessment, the strategy, and the findings. * Essential in cooperation between teams. Important to understand how vulnerability was explored, and what the impact may be. * Wrong attitude: we found this, you are not doing your job. * Correct attitude: we found this, which may be caused by that, this is the impact, you may fix it by doing X. * Clients may not understand the vulnerability, the reason, or the impact. ## Remediation The company implements methods to increase the security of its assets. May fix the vulnerability. * Correct software bugs or flaws. * Implement specific configurations. * Update software/firmware. * This capability is not always present. May reduce the impact of a successful exploitation. * Implement mechanisms that reduce impact to a smaller domain. * Implement redundancy and fail recovery. This may increase the cost of exploiting the vulnerability. * Deploy firewalls or change its rules. * Increase isolation so that assets are not available in a domain. ## Verification Verifies the effectiveness of the remediation. Involves assessing the existence and risk of the vulnerabilities found. * Using the same scope! * Vulnerability risk may be similar if explored from other perspectives. * E.g. External vs Internal actor. ## Monitoring Deploys mechanism to detect the vulnerability being explored. * May consider variations. Involves configuring Firewalls, log analysis systems, IDS/NIDS/HIDS, profillers.