Security teams deal today with a barrage of new, rapidly evolving threats. An effective vulnerability management program is essential if an enterprise is going to survive in the modern threat landscape. This guide offers information and advice on topics -- like risk assessment, penetration testing, and patch and configuration management -- that security professionals need to know to craft an effective vulnerability management program.
Vulnerability risk assessment
Making a vulnerability management program effective means first knowing its purpose -- that is, know what it needs to accomplish. In this module, learn how to both identify and rank your system's security weaknesses, so your program focuses on the most significant threats first. A thorough assessment includes first making sure your system meets the security controls required by law and by industry regulations. Even then, though, there are likely to be gaps, or "residual risks." You'll need to know what these are and how to handle them in order to fine-tune your program.
Risk management programs produce piles of data on your network's security vulnerabilities. Here's now to rank the risks so you can prioritize remediation. Continue Reading
How can a university hospital or an auto parts manufacturer identify their data security weaknesses? Information security architect Nick Lewis offers an effective process. Continue Reading
Even after an organization applies security controls to comply with laws and regulations for their industry, data management gaps inevitably remain. But there are five steps you can take to identify and offset them. Continue Reading
As malware gets smarter and more dangerous, vendors are upgrading defensive products essential to stopping it. Continue Reading
There's a barrage of threats coming for your system, so an effective vulnerability management program is a must. Here are five ways to make yours even better. Continue Reading
A vulnerability management program that's effective is one that's been thoroughly tested. Penetration testing is the search for security vulnerabilities in a system, network or application. The idea is to locate the weaknesses before an attacker does and eliminate them. In this portion of the guide, you'll get advice from several experts on what works best when it comes to organizing and carrying out a penetration test. There are risks involved, as with any security effort, but also new enhancements to pen testing to consider, like the use of social engineering methods.
Network penetration testing can reveal alternate routes to sensitive data. Learn how to secure your data from every angle. Continue Reading
You can minimize the risk associated with pen testing by limiting the test's scope, our expert says. Continue Reading
Social engineering techniques can be used to increase security. Learn four ways to add it to your pen tests. Continue Reading
If your budget's tight, what’s the best approach to Web application security testing? Michael Cobb compares penetration tests and code reviews. Continue Reading
While pen testing is essential for security, there are right and wrong ways to go about it. A concept called "hacking back" has become popular but is still being developed, as well as debated. What's clear so far is that to "ethically" hack a system, you need to establish both policy and processes. The experts here weigh in on how to do both. Still, it's worth noting that some industry heavyweights, like Gary McGraw, argue that hacking back is the wrong way to think about the problem of system and app security. In this segment of our guide, you'll learn about the concept and the ongoing arguments in this still-evolving area of security.
Is offensive security, known as "hacking back," an acceptable enterprise defense tactic? At a recent RSA Conference, experts struggled just to define the term. Continue Reading
In this chapter from Hacking for Dummies, author Kevin Beaver explores how to hack ethically, glean info about your organization from the Internet, scan your network and look for vulnerabilities. For more from Beaver, see his presentation in the video section below. Continue Reading
Hacking back ain't no way to win a cyberwar, says Gary McGraw. It's far better to build software and systems with fewer vulnerabilities. Continue Reading
Testing a system inevitably reveals security gaps that must then be addressed. In this segment, learn the risks involved in patching in an era of zero-day exploits. Even without external threats, patching can be tough, and some are tougher than others. Read on and you'll come away better equipped to tackle particularly challenging fixes, and you'll also learn how to do so with a minimum of expense.
Is it better to risk exposure and test zero-day patches or risk business disruption and patch without testing. Michael Cobb considers the conundrum. Continue Reading
Creating a vulnerability management program from the ground up requires first understanding where your security gaps are, devising a plan to fill them and then deciding how to make the fixes. That means acquiring the tools. The links here lead you to informative presentations about a range of security vulnerability tools.
In this video demo, learn how to use XSSer, open source penetration testing tools for detecting various Web application flaws and exploiting cross-site scripting (XSS) vulnerabilities against applications. Continue Reading
More from the Dummies author on vulnerability assessment
The preceding segments of this guide address a range of issues related to managing system vulnerabilities. But as expert Kevin Beaver knows, a huge part of maintaining security is remaining flexible and adapting to changing technology and attack methodologies. In this segment Beaver relates his on-the-ground experiences in coping with the changing threat landscape.
In this webcast, the author of Hacking for Dummies explains how to improve vulnerability assessments with better planning, tools and respect for the process.
Defining the terms
The information security field is loaded with sometimes confusing terminology and acronyms; the subfield of vulnerability management is no different. But here we've gathered a concise glossary for easy reference.