Reply needed ..

Reply needed 1 Along with the numerous ad links that were provided upon executing the Google search, there seemed to be countless results related to conducting vulnerability and risk assessments, its importance, and the tools one could use. As such, I decided to focus my post on the assessment side of things and its part of the larger risk management process. To begin, vulnerability assessments do not have to be conducted network-wide, or even organization-wide in an all-encompassing aspect. Instead, these assessments can take place on individual systems or specifically used to validate the potential existence of a newly discovered security vulnerability based on Common Vulnerabilities and Exposures (CVE). Since a vulnerability boils down to some sort of flaw discovered in a system, which could be exploited for malicious purposes, a vulnerability assessment looks to uncover those opportunities before an attacker discovers it and/or utilizes it to their advantage. As such, an assessment of vulnerabilities requires goals, methods, and tools to provide information and analysis to those conducting (Corothers, 2002). Corothers further notes, “The goals of the assessment are determined by the security requirements of the company and target system, what will be assessed, and the depth of the assessment. A methodology for performing the assessment should be outlined to maximize the information used in determining the security posture” (2002). There is no one assessment methodology that fits every organization or every situation. Therefore, it requires a thorough review of the different approaches to determine the best fit.

Furthermore, despite the numerous methods one can choose to follow for conducting a vulnerability assessment there seems to be an underlying process that each would agree upon: Plan, Organize, Gather Information, Test, Analyze, and Report (Corothers, 2002). By utilizing a methodical kind of approach for evaluation one can expect careful consideration is given to the risk posed to valuable assets. Not only does this help contain security issues and protect data, but it can also have an impact on cost. Understanding which systems pose more risk or are more vulnerable presents an opportunity to evaluate the implemented countermeasures and take action to either increase protection or reduce if resources are being overused (Parks & Dominguez, 2013). This is interesting as one might overlook the additional benefits of performing vulnerability assessments on a regular basis with the primary focus placed on risk management. Lastly, undertaking regular assessments provide a way to maintain verification of compliance requirements depending on industry regulations and other mandated standards.

One interesting methodology is OCTAVE. The OCTAVE method was developed by the Software Engineering Institute (SEI) at Carnegie Mellon University and stands for Operationally Critical Threat, Asset, and Vulnerability Evaluation. The method was originally created to help organizations in the context of achieving operational and strategic goals by having a standardized way of assessing security risks. This has since evolved to what is now referred to as OCTAVE Allegro and according to a technical report outlining this improved process, “OCTAVE Allegro (like OCTAVE and OCTAVE-S) is focused on positioning risk assessment in the proper organizational context, but it offers an alternative approach that is specifically aimed at information assets and their resiliency” (Caralli et al., 2007). Version 1.0 of the OCTAVE Framework was originally released in September 1999 and through various iterations has now come to include OCTAVE Allegro as of June 2007. Version 1.0 was performed as a series of workshops conducted by analysis teams from different business units throughout the organization. The audience for this method of assessment focused on large organization containing 300 or more employees, with the following criteria:

· Have a multi-layered hierarchy,

· Maintain their own computing infrastructure,

· Have the ability to run vulnerability evaluation tools, and

· Have the ability to interpret the results of vulnerability evaluations (Caralli et al., 2007).

More importantly, the OCTAVE method provided flexibility in that it allowed an organization to customize the approach to fit their specific environment or use cases.

Additionally, the OCTAVE method has since been updated beyond Allegro to include the newest process, OCTAVE FORTE. A primary addition to FORTE includes a larger focus on gaining support from leadership in the early stages of the process. Likewise, it includes practices that are of focus in other standards such as NIST’s Risk Management Framework (RMF), SP 800-37 (Tucker, 2018). The motivation for updating and applying new approaches largely revolves around the ever-changing threat landscape and the knowledge acquired from using previous approaches. Allegro and FORTE focus more on approaching assessment from an information asset point-of-view, making their use more applicable today. Moreover, the most interesting aspect of OCTAVE Allegro, in particular, lending hand to its scalability in large networked environments, is its elimination of vulnerability testing. Instead, Allegro introduces what is known as the containerconcept for assessment. The technical report notes, “Instead of running vulnerability tools and using the results to seed threat identification, in OCTAVE Allegro users map an information asset to all of the containers in which it is stored, transported, or processed and consider threats to each of those containers” (Caralli et al., 2007). This increases the scalability by reducing the focus on using various tools that require specialized knowledge or training. The container approach also helps to ensure the scope of the assessment is considered by applying an “environment map,” which essentially defines the boundaries of an information asset (Caralli et al., 2007). Lastly, the inclusion of FORTE further enhances organizational fit through limited overhead, claiming to scale efficiently regardless of the size and strategy of an organization (Carnegie Mellon University, 2019). FORTE provides a framework that looks at the complete risk lifecycle aiding its adoption and reuse.

References

Caralli, R. A., Stevens, J. F., Young, L. R., & Wilson, W. R. (2007, May). Introducing OCTAVE Allegro: Improving the information security risk assessment process. Carnegie Mellon University, Software Engineering Institute. https://resources.sei.cmu.edu/asset_files/TechnicalReport/2007_005_001_14885.pdf.

Carnegie Mellon University. (2019). OCTAVE FORTE: Establish a more adaptable and robust risk program. Software Engineering Institute. https://resources.sei.cmu.edu/asset_files/FactSheet/2020_010_001_643960.pdf.

Corothers, N. N. (2002). Vulnerability assessments: Methodologies to perform a self-assessment. Global Information Assurance Certification. https://www.giac.org/paper/gsec/2022/vulnerability-assessments-methodologies-perform-self-assessment/103498.

Tucker, B. (2018, June 21). OCTAVE® FORTE and FAIR connect cyber risk practitioners with the boardroom. Carnegie Mellon University, Software Engineering Institute. https://insights.sei.cmu.edu/insider-threat/2018/06/octave-forte-and-fair-connect-cyber-risk-practitioners-with-the-boardroom.html.

Reply 2 Needed:

Burp Suite is a leading web application testing software developed by Portswigger, used by over 12,000 organizations.  It is offered in three editions:  professional, enterprise, and community.  The enterprise edition features three main capabilities:  scanning, integrating, and reporting.  Portswigger (n.d.) advertises the scanning features as being easy to set up, recurring, configured out-of-the-box, multifaceted, schedule automated, capacity to run concurrent scans, up-to-date vulnerability library, and custom configurations.  For integration, the enterprise edition can integrate with major CI/CD platforms such as Jenkins and TeamCity, can integrate with existing systems via REST API, can get configurations directly from the professional version, and allows for role-based access management.  Further, it can integrate with Jira to track issues and will soon have over one hundred extensions.  It is deployable both on premises and in the cloud.  For reporting, there is a graphical dashboard and the capacity to export HTML reports or have reports automatically emailed to your team.  It graphs your security posture and displays changes to it over time.  One can also review history and aggregate issues via a user-friendly user interface. (Portswigger, n.d.)

Burp Suite professional is designed for security testers.  It’s functionality includes manual penetration testing, advanced and automated penetration testing, automated vulnerability scanning, productivity tools, and extensions.  Of these, the testing features are most interesting.  The manual penetration testing tool allows you to intercept http/s communications, aggregate target data, test clickjacking attacks, proxy https traffic, test for out-of-band vulnerabilities, maintain a separate WebSocket history, and assess the size of target applications and token strength.  Advanced testing includes speedy brute forcing, the ability to query table-aggregated attack results, Cross-Site Request Forgery generation, display of unconfirmed bug results, and the ability to automatically modify HTTP messages. Automated scanning features include a built-in JavaScript analysis engine for client-side attacks, scan logic with generic bugs, fine-grained scanning and configuration controls, bug remediation advice, target identification based on content (in addition to URL), interactive application  security testing application, and better capacity for browser-driven scans. (Portswigger, n.d.)

Community licenses are free of charge and available with limited, manual capability.  Burp Suite is commercially available and scales well.  It is applicable to networked environments and supports both on-premise and cloud operations. Portswigger, n.d.)

With respect to reliability, the OWASP website did not endorse but pointed to a security tool review site by Chen (2017).  According to the review, Burp Suite is second only to Appspider in covering the greatest number of input delivery vectors (pictured), which allow it to identify vulnerabilities at the perimeter.  Also of interest was the number of detections versus false positives in a test of major commercial Dynamic Application Security Testing  products, wherein Burp Suite came in third after Netsparker and Appspider (also pictured).  While perhaps not the top rated in all reviewed categories, Burp Suite’s robust features and market leading role make it a product to consider for many use cases. (Chen, 2017)

Source:  Chen, 2017

Source:  Chen, 2017

References:

Chen, S. (2017, November 10). Security Tools Benchmarking. Retrieved September 09, 2020, from https://sectooladdict.blogspot.com/

Portswigger. (n.d.). Features – Burp Suite Professional. Retrieved September 09, 2020, from https://portswigger.net/burp/pro/features