Overview

A vulnerability assessment is a testing process used to identify and assign severity levels to as many security defects as possible in a given timeframe. This process may involve automated and manual techniques with varying degrees of rigor and an emphasis on comprehensive coverage. Conducting vulnerability assessments help organizations identify vulnerabilities in their software and supporting infrastructure before a compromise can take place. But, what exactly is a software vulnerability

A vulnerability can be defined in two ways

• A bug in code or a flaw in software design that can be exploited to cause harm. Exploitation may occur via an authenticated or unauthenticated attacker
• A gap in security procedures or a weakness in internal controls that when exploited results in a security breach

Objective

• Identify vulnerabilities ranging from critical design flaws to simple misconfigurations
• Document the vulnerabilities so that developers can easily identify and reproduce the findings.
• Create guidance to assist developers with remediating the identified vulnerabilities

Steps to Assess Your Application Security

• Identify and understand the way your business is organized and operates
• Locate the applications and data that are used during the business process
• Search for hidden data sources that may allow easy access to secure information
• Identify both virtual and physical servers that run applications necessary for your business operations
• Keep track of what security measures are already in place
• Scan your network for vulnerability

How can I tell if my organization requires a vulnerability assessment

• Conduct a vulnerability assessment to verify that security initiatives performed earlier in the SDLC are effective. For example, an organization that properly trains developers in secure coding and performs reviews of security architecture and source code will most likely have fewer vulnerabilities than an organization that does not conduct those activities.
• Whether your organization develops applications or uses third-party applications, conducting a vulnerability assessment at least annually, or after significant changes to the applications or application environments are implemented, is critical to ensure a rock-solid security initiative.