Vulnerability Assessment — Find Weaknesses Before Attackers Do

Table of Contents

1. What is a Vulnerability Assessment?
2. VA vs. Penetration Testing
3. Types of Vulnerability Assessments
4. The VA Process
   • Planning & Discovery
   • Vulnerability Scanning
   • Analysis & Validation
   • Risk Prioritization
   • Reporting
5. Common Vulnerability Categories
6. Tools Comparison
7. Scheduling & Frequency
8. Compliance Mapping
9. Common Challenges & Limitations

1. What is a Vulnerability Assessment?

A Vulnerability Assessment (VA) is the systematic process of identifying, classifying, and prioritizing security vulnerabilities in computer systems, networks, and applications.

Unlike a penetration test, a vulnerability assessment does not exploit vulnerabilities — it identifies and measures them.

Think of it this way: A vulnerability assessment tells you every unlocked door and open window in your house. A penetration test actually opens one to see if someone could get in.

The Vulnerability Management Lifecycle

Vulnerability assessment is NOT a one-time activity — it's part of an ongoing lifecycle:

            ┌─────────────────────────────┐
            │        Discovery            │
            │  (Identify vulnerabilities) │
            └─────────────┬───────────────┘
                          │
                          ▼
            ┌─────────────────────────────┐
            │     Prioritization          │
            │   (Score & classify risks)  │
            └─────────────┬───────────────┘
                          │
                          ▼
            ┌─────────────────────────────┐
            │      Remediation            │
            │   (Patch, mitigate, accept) │
            └─────────────┬───────────────┘
                          │
                          ▼
            ┌─────────────────────────────┐
            │       Verification          │
            │  (Confirm fixes worked)     │
            └─────────────┬───────────────┘
                          │
                          └─────── Cycle repeats ──────►

2. Vulnerability Assessment vs. Penetration Testing

Analogy:

• VA = Census — count every person in the city
• PT = Undercover investigation — follow one suspect to see what they can actually do

3. Types of Vulnerability Assessments

A. Network-Based Assessment

Scans internal and external network infrastructure to find open ports, running services, and missing patches.

B. Host-Based Assessment

Scans individual machines for OS-level issues, misconfigurations, and missing patches.

C. Web Application Assessment

Checks for OWASP Top 10 vulnerabilities, authentication flaws, and business logic issues.

D. Database Assessment

Checks for weak authentication, SQL injection points, unencrypted sensitive data.

E. Cloud Infrastructure Assessment

Reviews cloud configurations against best practices (CIS Benchmarks).

F. Container & Kubernetes Assessment

4. The Vulnerability Assessment Process (Detailed)

Phase 1: Planning & Discovery

"Define the scope and gather intelligence."

Key activities:

• Determine what assets are in scope (IP ranges, domains, application URLs, cloud accounts)
• Define assessment depth:
  • Non-credentialed scan — external view, like an attacker
  • Credentialed scan — logged in, can see installed software, missing patches, registry
• Get written authorization (scope document signed)
• Gather asset inventory: network diagrams, IP lists, server lists

Non-Credentialed vs. Credentialed Scan:

Phase 2: Vulnerability Scanning

"Run the automated scanners."

Technical Process:

1. Host Discovery
   nmap -sn 10.0.0.0/24          → Which hosts are alive?
   
2. Port Scanning
   nmap -sS -sV 10.0.0.0/24      → What ports/services are open?
   
3. Vulnerability Scan
   nessuscli scan --target 10.0.0.10   → What CVEs apply?
   
4. Configuration Audit
   lynis audit system              → What CIS checks fail?

Complete Nessus Scan Output Example:

Host: 10.0.0.10 (Web Server)
────────────────────────────────────────────────────────────────────
CRITICAL: CVE-2021-41773 (CVSS 9.8)
  Plugin: 153159 — Apache HTTP Server 2.4.49 Path Traversal
  Info:   https://tenable.com/plugins/153159
  Output: nmap confirms Apache 2.4.49 running
  Risk:   Remote code execution without authentication

HIGH: CVE-2023-XXXX (CVSS 8.1)
  Plugin: 167342 — OpenSSH < 8.9p1 Weak Key Exchange Algorithm
  Output: Diffie-Hellman moduli found with < 2048 bits
  Risk:   Man-in-the-middle attack

MEDIUM: Missing HTTP Security Headers
  Plugin: 70567 — Web Server Transmits Clear Text Creds
  Output: No Strict-Transport-Security header
  Risk:   Session hijacking via SSL stripping

LOW: SSL Certificate Expires in 30 Days
  Plugin: 51192 — SSL Certificate Expiry
  Output: Expires 2026-08-20
  Risk:   Service disruption

Phase 3: Vulnerability Analysis & Validation

"Remove noise. Confirm real issues."

Automated scanners produce false positives. Industry averages suggest 20-40% of scanner findings are false positives. Every finding must be validated.

False Positive Validation Process

                    ┌──────────────────────┐
                    │ Scanner Found Issue   │
                    └──────────┬───────────┘
                               │
                    ┌──────────▼───────────┐
                    │  Is the service/     │
                    │  version confirmed?  │  ◄── nmap -sV or manual check
                    └──────────┬───────────┘
                               │
              ┌────────────────┼────────────────┐
              │                │                │
              ▼                ▼                ▼
         Confirmed        Needs manual     False positive
         vulnerability    verification     → REMOVE from report
              │                │
              ▼                ▼
        CVSS Scoring    Manual PoC test
        + Impact        (is it really
        assessment      exploitable?)
              │                │
              └────────────────┘
                       │
                       ▼
              ┌──────────────────────┐
              │  Add to Report       │
              └──────────────────────┘

CVSS v3.1 Scoring Deep Dive

The Common Vulnerability Scoring System (CVSS) provides a numerical score (0-10) for vulnerabilities.

CVSS Vector Example:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Detailed Breakdown:

AV:N = Network (exploitable remotely, no physical access needed)
AC:L = Low complexity (no special conditions)
PR:N = No privileges required
UI:N = No user interaction needed
S:U = Scope unchanged
C:H = Complete confidentiality loss
I:H = Complete integrity loss
A:H = Complete availability loss

Result: 9.8 (CRITICAL)

CVSS Score Table:

Context-Based Risk Adjustment

CVSS gives a technical score. Real-world risk requires context:

Phase 4: Risk Prioritization

"Not all vulnerabilities are equally dangerous."

Risk = Likelihood × Impact

Prioritization Framework

Practical Prioritization Scenarios

Scenario A: Critical CVSS, No Exploit, Internal
────────────────────────────────────────────────
CVE-2024-XXXX (CVSS 9.3) in Apache on internal server
No public exploit exists
Server has no customer data
Result: Schedule patch within 30 days (not emergency)

Scenario B: High CVSS, Exploit Available, Internet-Facing
─────────────────────────────────────────────────────────
CVE-2023-YYYY (CVSS 7.5) in OpenVPN on perimeter firewall
Metasploit module available (easy exploitation)
Firewall provides access to internal network
Result: Patch IMMEDIATELY (same day)

Phase 5: Reporting

"Clear communication is the real value."

A professional vulnerability assessment report contains:

1. Executive Summary — 1-2 pages for management

   • Total vulnerabilities: Critical/High/Medium/Low
   • Overall risk rating
   • Top 3 risks to prioritize
   • Business impact narrative

2. Scope & Methodology — What was tested and how

   • Tools and versions used
   • Scan dates and configurations
   • Credentialed vs non-credentialed

3. Critical & High Findings — Detailed table

4. Detailed Findings — Per vulnerability (repeated for each):

   • Finding name & CVE ID
   • CVSS score + vector string
   • Affected systems (IP, hostname, application)
   • Technical description
   • Business impact
   • Proof of concept (screenshot, request/response)
   • Remediation steps (specific, actionable)
   • Reference links (OWASP, CVE details)

5. Remediation Plan — Priority-ordered action plan:

   • Immediate (24h-7d): Critical fixes
   • Short-term (7-30d): High fixes
   • Medium-term (30-90d): Medium fixes
   • Long-term (90d+): Low fixes and hardening

6. Appendix — Raw scan data with false positives removed

5. Common Vulnerability Categories

OWASP Top 10 (2021) — Web Applications

CWE Top 25 (2023) — Most Dangerous Software Weaknesses

6. Vulnerability Assessment Tools — Detailed Comparison

7. Scheduling & Frequency

8. Compliance Mapping

Different regulations require vulnerability assessments:

9. Common Challenges & Limitations

False Positives

• Problem: Scanners report issues that aren't real
• Mitigation: Manual validation of every finding before inclusion in the report
• Industry Rate: 20-40% of automated findings are false positives

False Negatives

• Problem: Scanners miss new or complex vulnerabilities (zero-days, business logic flaws)
• Mitigation: Combine automated scanning with manual expert testing
• Reality: No scanner catches 100% of vulnerabilities

Scan Fatigue

• Problem: Too many low-severity findings causes "alert blindness"
• Mitigation: Remediate or accept low findings — don't let them accumulate
• Best Practice: Track accepted risks with a formal exception process

Network Impact

• Problem: Aggressive scanning can crash fragile systems (legacy equipment, ICS/SCADA)
• Mitigation: Start with slow/throttled scans; test on non-production first
• Worst Case: A masscan default rate of 100,000 packets/sec has crashed production routers

Credentialed vs. Non-Credentialed

• Problem: Non-credentialed scans miss deep issues (patch level, registry settings, software inventory)
• Solution: Always use credentialed scanning where possible — it catches 3-5x more issues
• Trade-off: Requires domain admin credentials or local admin rights

Limited Scope

• Problem: A vulnerability assessment cannot prove or disprove overall security posture
• Why: It only finds known vulnerabilities; cannot chain exploits or test detection/response