Cyber Vulnerability Investigations
Why every business needs to know the risks
Vulnerability is a cyber-security term that refers to a flaw in a system that can leave it open to malicious attack or susceptible to inadvertent risk to confidentiality, integrity or availability. It can mean any type of weakness in a computer system itself, the personnel using or maintaining the system, the operating procedures for the system, or in anything else that leaves the information security of the system exposed to a threat.
Companies are often unaware of their vulnerabilities until it is too late. Cyber Vulnerability Investigations (CVI) are vital as they identify areas of risk to a business so they can be successfully managed.
Five of the most dangerous cyber security vulnerabilities exploited by hackers include:
1/ Buffer Overflow
In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffer overflow is quite common yet difficult to detect. In a buffer overflow attack, an application that stores data in more space than its buffer allocation is exploited into manipulating and misusing other buffer addresses.
The manipulation includes overwriting the data on those other buffer addresses as well as damage and deletion of the data.
Although this can be difficult to carry out, if the hacker knows the buffer allocation mechanism of the system, they can easily exploit this by sending an application more data than it can store in the buffer prescribed for it. This allows the hacker to either disrupt the operation of the system by pushing random data into the overflowed memory locations or to accomplish a specific task such as open a command shell with administrator privileges or insert malicious executable code into the system memory.
This vulnerability in the source code of applications and operating systems can be managed as a consumer by ensuring patching is up to date as this will protect against any identified and resolved vulnerabilities. As a producer of software, correct software design and coding practices and procedures combined with thorough testing can minimise these vulnerabilities in the first place.
2/ Injection Vulnerabilities
Injection flaws occur when an application sends untrusted data to an interpreter allowing nefarious commands to be inserted into an entry field for execution. SQL and XML parsers and program arguments are the common targets of such an attack.
Code injection, for example, is the exploitation of a computer bug that is caused by processing invalid data. If carried out successfully, injection vulnerability attacks can easily result in loss and damage of data. Injection attacks allow hackers to spoof identities, alter existing data or facilitate the authorised disclosure of stored data.
This vulnerability in the source code of applications can be managed as a consumer by ensuring patching is up to date as this will protect against any identified and resolved vulnerabilities. As a producer of software, injection vulnerabilities can be minimised through data validity checks. The impact of the exploitation of the vulnerability can be minimised by using access controls to limit permissions on a need to know basis.
3/ Exposure of Sensitive Data
Arguably the most dangerous, yet most common vulnerability.
Exposure of sensitive data can result in catastrophic loss for any organisation. Attackers use this vulnerability to inflict as much damage as possible.
Sensitive data can be stolen when it is resting in the system, in an exchange transit or in a backup store.
This vulnerability can be managed as a consumer by ensuring sensitive data is encrypted with an appropriate algorithm both at rest and in transit using cryptographic keys that are adequately controlled and protected.
4/ Broken Session Management and Authentication
When authentication functions related to the application are not implemented correctly, it allows hackers to compromise passwords and IDs.
Hackers take advantage of weak spots in session management as well as connection authentication between two systems. Employing sufficient encryption techniques is essential.
This vulnerability can be managed as a consumer by ensuring passwords are of a sufficient strength and are managed appropriately. Passwords and session IDs must be adequately protected in transit and at rest.
5/ Security Misconfiguration
A common vulnerability which helps an attacker gain access to the system, often with the owner of the system being unaware that the compromise has occurred. This allows the hacker to compromise the system over time, stealing information or using the compromised system to launch further attacks.
This vulnerability is typically exploited by a hacker accessing unchanged default accounts, accounts with weak security controls or exploiting known but unpatched flaws in the system.
This vulnerability can be managed as a consumer by ensuring applications and operating systems are correctly configured with security locked down to an appropriate level. All default passwords must be changed and must be of a sufficient strength and managed appropriately. Policies to enforce a minimum password strength should be considered.
Amethyst offers a range of services to help you identify, reduce and manage risk
- Penetration Testing and Vulnerability Assessment - Penetration testing and vulnerability assessment of IT infrastructure and applications by certified testers. The assessment will identify technical vulnerabilities, determine the business risks and make cost effective recommendations to treat them.
Risk Assessment – Risk assessment of the information system including threat analysis, asset identification, business impact assessment, vulnerability identification and prioritisation of risks
Gap Analysis – Analysis of the business information security management system against industry standards including but not limited to ISO/IEC 27001, Cyber Essentials, SANS Top 20, 10 Steps to Cyber Security, COBIT. The gap analysis report will include recommendations and a remediation plan
Supplier Assurance – Risk assessment and review of the business supply chain in order to identify and minimise business risk.
Based on the five cyber article cyber security vulnerabilities article originally published at:
Open Web Application Security Project (OWASP) current Top 10: https://www.owasp.org/index.php/Top10#OWASP_Top_10_for_2013