Software Industry and security of MBSA
The needs of regular management of network vulnerabilities were often ignored at the onset of a vulnerability remediation project. Yet with increased vulnerabilities that are being identified every day and such vulnerabilities being reintroduced by the users into their environments, the remediation strategy needs to be repeated frequently. Organizations’ security administrators should perform sufficient testing and implementation of more automated solutions, which will enable them to remediate their network, not just every quarter, but in certain circumstances, it will have to be performed monthly. As a result, this step must be taken into consideration during the early project planning stages. So far, there has been no bullet that can eliminate the growing list of vulnerabilities. However, IT security professionals can address their existing vulnerability exposures and prepare enough defense. Vulnerabilities Causes and Threats. Vulnerabilities can be defined as weaknesses or falls that present a system to the risk of attack. As we know Vulnerabilities may exist from outside sources such as natural calamities, climate change or they can be controlled by the organization such as network, data, hardware, software. They could on top come from people, such as displeased employees or dishonest managers. Methodology Used in Vulnerability Assessment and Recommendations.
Vulnerability assessment is a test of weaknesses that can possibly exist within a system. Here are four-step processes for assessing vulnerability are. Scope The first step is to control which systems will be assessed. Focus After the scope has been determined, an appropriate time to conduct the assessment should be determined. We should know that vulnerability assessment should be unperformed within the production environment, as it may harmfully affect standard business operations. Assess Next, the systems are tested for vulnerabilities. Finding system vulnerabilities is not inescapably a bad thing, especially if the organization was unaware that the vulnerabilities existed prior to the assessment. This type of situation permits the company to involve another step to secure its systems. Respond The vulnerability assessment report forms the basis for any corrective measures, empowering management to decide the next action to take to the systems. Vulnerability Tasting Technique Network Scanning This technique uses port scanners to fingerprint systems, which provide information like the name of the computer being scanned, open ports, and the operating system it is running. This information can be leveraged by hackers to launch a targeted attack. Vulnerability Scanning This method analyzes the automatic data processing system and installed applications to establish if any recognized, vulnerabilities exist. Password Strength Passwords on the system are tested with various password-cracking tools to see if secure passwords have been used.
Analyzing system logs is another method of tracking vulnerabilities, log review is a significant part of the security management process and is used widely for determining a system breach. Integrity Checking Integrity checks are used to examine the reliability of data in an organization’s systems and establish the damage caused to the data by malware infestation. Antivirus Measures Scanning for viruses is one of the most valuable methods of detecting and preventing the virus from e-mails, websites, and other sources. War Dialing. This is a method of operating a computer’s modem to dial thousands of numbers in an effort to connect to other computer modems, which can provide unauthorized access to networks. WarDriving. WarDriving involves an individual driving around with a laptop trying to connect to open wireless connections. For instance, an individual could park in a company’s lot to see if the company maintains an unencrypted network. Managing this network, the individual could next see if there was a way to connect to the encrypted network or utilize any corporate resources on the network. Penetration Testing This method will test the physical, social, and technical barriers of a company to control how vulnerable a company is to threats. Social Engineering We can say it is a approach of practicing social skills to convince people to perform actions, which they should not. Many tools are convenient for testing the vulnerability and penetrability of a network. NMap. This tool scans a network for open ports on a system and creates a visual network map. Nessus. This is one of the most popular vulnerability scanners and is widely used in industry. Microsoft Baseline Security Analyzer (MBSA).
It is Microsoft Software tool that resolves whether systems on a network are missing security updates or have insufficient security settings for Microsoft applications, like the Windows operating system or SQL server. Ettercap. This tool offers the ability to intercept network connections on and manipulate traffic. This is a network that analysis tool that can scan for open ports, fingerprint operating systems craft raw TCP/IP packets. If all organizations simply will fallow al this recommendations’ the numbers of cybercrime will be lower. Windows and Linux As we know, many organizations are using Windows and Linux, education management department should make sure that each employee is properly trained in both of these systems. According to the well-liked idea that Linux may have fewer risk factors, organizations until now should know that Linux has security risks, which if not addressed, can lead to a number of malicious attacks on our system. The Linux systems, that organizations come across, tend to be just as vulnerable as their Windows counterparts. The weaknesses of Linux are not essentially the fault of the operating systems (OS), but more due to the oversights by Linux administrators. Unusually, these represent the oversights related to default installations, which require a more constant maintenance, and systems need to be tested strict enough with proper tools to determine such weaknesses. Recommendations the most common Linux vulnerabilities General lack of patch management for the OS: Outdated third-party applications: General lack of system hardening: Lack of password enforcement/Lack of backups. Security weakness with Linux systems is connected to data backups. In many cases, these vulnerabilities are connected to Windows-focused admins that do not know how to supervise Linux systems. Organizations need to make it a priority to test Linux-based systems for vulnerabilities on a periodic and consistent basis. Companies never know when they are going to be exploited; that is why it is very important to have well trained IT specialists for both systems.
Recommendations for organizations Mandatory education for each employee; Follow all policies of the organization; Keep information safe; Always have back up; Unluckily, many employees are sharing very sensitive data outside the workplace; Updating system; Do not use work email as personal; No matter how much confidence we are about company’s success, there is always a possibility that something might go wrong. Things that may go wrong are called project risk. The companies’ sensible project manager can recognize all the project risks from the beginning and take some actions before even starting the project. However, there are rules, and if we clearly follow them, we can be capable to manage risks. Accepting Risk; Avoiding/Eliminating Risk; Transferring Risk; Mitigating Risk; Accepting the risk means that while we have recognized it and entered it in our risk management software, companies are not taking any actions. Organizations are accepting the fact, which may happen, and we decide to deal with it if it does.
