Vulnerability Analysis Dr. X

Computer system Design Implementation Maintenance Operation

What is a vulnerability?

Pen testing Red/tiger team attack Authorized attempt to violate specific contrants Tests Security Controls: procedural, operational, technical

Layers External, no access External, with access Internal, with access

Flaw hypothesis methodology Information gathering Flaw hypothesis Flaw testing Flaw generalization Flaw elimination

Vulnerability classification Intentional Time of flaw Location

Intentional

Time

Location

Pen test Port scan Vulnerability scan Why? Prevent data breach Test your security controls Ensure system security Get a baseline Compliance

Steps of pen test Establish goal Information gathering Reconnaissance Discovery Port scanning Vulnerability scanning Vulnerability analysis Taking control Exploitation Brute forcing Social engineering Pivoting Reporting Evidence collection Risk analysis Remediation

Steps 12 subcategories of the Web Application Penetration Testing Methodology: based on OWASP methodology 1.Introduction and Objectives 2.Information Gathering 3.Configuration and Deploy Management Testing 4.Identity Management Testing 5.Authentication Testing 6.Authorization Testing 7.Session Management Testing 8.Data Validation Testing 9.Error Handling 10.Cryptography 11.Business Logic Testing 12.Client Side Testing

Steps Step 1: Introduction and Objectives Step 2:Information gathering Step 3:Vulnerability analysis Step 4:Simulation (Penetrate the system to provide the proof) Step 5:Risk assessment Step 6:Recommendations for reduction or recovery and providing the report