NetSec Vulnerability Assessment
A vulnerability assessment is a systematic process of identifying, classifying, and prioritizing security weaknesses in a network, system, or application. Unlike penetration testing, a vulnerability assessment does not exploit the vulnerabilities it finds — it catalogs them so they can be remediated before an attacker exploits them. Regular vulnerability assessments are a foundation of proactive security management.
Why Vulnerability Assessments Are Necessary
Without regular assessment: New vulnerability published → Attacker finds it in your systems → Breach (You never knew the vulnerability existed) With regular assessment: New vulnerability published → Your scanner finds it next week → You patch it before any attacker reaches it → Attack surface continuously shrinking
Types of Vulnerabilities Found
Category | Examples ------------------------|---------------------------------------------- Missing patches | Unpatched OS, unpatched applications Default credentials | Admin:admin, root:root, or vendor defaults Misconfigurations | Open admin interfaces, unnecessary open ports Weak cryptography | MD5 hashes, SSL 3.0, RC4 cipher, weak keys Insecure services | Telnet, FTP, unencrypted SNMP v1/v2 Unnecessary services | Open ports for services the system doesn't use Exposed sensitive data | Passwords in config files, keys in code repositories Known CVEs | Publicly documented vulnerabilities in specific versions
The CVE System
CVE stands for Common Vulnerabilities and Exposures. Every publicly known vulnerability gets a unique identifier: CVE-YEAR-NUMBER. Security scanners match software versions against CVE databases to determine which known vulnerabilities apply to each system.
CVE Example: CVE-2021-44228 (Log4Shell) Affected Software: Apache Log4j versions 2.0 to 2.14.1 Severity: CRITICAL (CVSS Score: 10.0) Description: Remote code execution via crafted log messages Impact: Attacker can run any command on the affected server Affected systems: Any Java application using Log4j (millions globally) Scanner finds Apache Log4j 2.12.0 on your server → Reports CVE-2021-44228 as CRITICAL → Remediation: Update to Log4j 2.17.1 or later
CVSS — Scoring Severity
The Common Vulnerability Scoring System (CVSS) provides a numerical score from 0 to 10 for each vulnerability, reflecting how severe it is. The score considers how easy it is to exploit, whether the attacker needs authentication, how much impact a successful exploit has, and whether user interaction is required.
CVSS Score Ranges: 0.0 | None 0.1 – 3.9 | Low 4.0 – 6.9 | Medium 7.0 – 8.9 | High 9.0 – 10.0| Critical CVSS Scoring Factors: Attack Vector: Network / Adjacent / Local / Physical Attack Complexity: Low / High Privileges Required: None / Low / High User Interaction: None / Required Confidentiality: None / Low / High Integrity Impact: None / Low / High Availability Impact: None / Low / High
Vulnerability Scanning Process
Step 1 — Asset Discovery
Before scanning for vulnerabilities, you must know what systems exist. Many organizations have unknown devices connected to their network — old servers, forgotten test systems, employee-connected devices. Discover everything on the network before assessing it.
Step 2 — Authenticated vs Unauthenticated Scanning
An unauthenticated scan probes systems from the outside, identifying open ports and visible banners. An authenticated scan logs into each system with a service account and examines installed software versions, patch levels, and configuration settings from the inside. Authenticated scans find far more vulnerabilities.
Unauthenticated Scan Finds: Open ports, service banners, obvious misconfigurations Authenticated Scan Additionally Finds: All installed software versions and patch levels Local configuration settings Security policy violations (passwords, account lockout settings) File system permissions Running services and startup items Installed certificates and their expiry dates
Step 3 — Scanning and Analysis
The scanner connects to each asset and tests for known vulnerabilities, comparing installed software versions against the CVE database, checking configuration settings against security benchmarks, and testing for default credentials.
Step 4 — Risk Prioritization
A large network produces thousands of vulnerability findings. Not all require immediate action. Risk prioritization considers the CVSS score, the importance of the affected system, whether the system is internet-facing, whether exploits are publicly available, and whether compensating controls reduce the risk.
Risk Prioritization Matrix: ┌──────────────────┬────────────────┬──────────────────────────┐ │ Severity │ Asset Priority │ Remediation Timeline │ ├──────────────────┼────────────────┼──────────────────────────┤ │ Critical │ Any │ Immediately (hours) │ │ High │ Internet-facing│ 24-48 hours │ │ High │ Internal only │ 7 days │ │ Medium │ Critical system│ 30 days │ │ Medium │ Standard system│ 60-90 days │ │ Low │ Any │ Next maintenance window │ └──────────────────┴────────────────┴──────────────────────────┘
Step 5 — Remediation and Verification
Remediation includes applying patches, fixing misconfigurations, removing unnecessary services, and changing default credentials. After remediation, rescan the affected systems to verify the vulnerability is resolved — not just marked as fixed in a tracking system.
Vulnerability Assessment Frequency
Assessment Type | Recommended Frequency -----------------------------|--------------------------- Full network scan | Monthly (minimum) Critical system scan | Weekly New system before production | Before deployment (mandatory) After major changes | Within 72 hours of change External attack surface scan | Weekly (continuous preferred) Compliance-driven assessment | As required by standard (annual for many)
Vulnerability assessment is not a one-time project — it is an ongoing process. New vulnerabilities are published daily. Systems change constantly. An assessment performed six months ago describes a network that no longer exists. Organizations that treat vulnerability management as a continuous process maintain a dramatically smaller attack surface than those who run annual point-in-time assessments.