Without companies and users being aware of it, parts of their IT environments regularly contain vulnerabilities. Fortunately, most firms have taken measures to contain them and little impact is felt in practice. One of those measures is to deploy automated security scans. These enable vulnerabilities to be detected quickly and enable the system administrator to take appropriate measures, possibly with the help of security experts. In order to know which vulnerabilities occur most frequently, we have listed the 4 vulnerabilities we encounter most often in practice.
1. Services that are unnecessarily accessible
As a result of incorrectly configured firewalls, services can be accessible via the internet when they shouldn't be. For example, a server that is supposed to be operating as a web server but also has its file sharing service or remote management port open to the internet. Sometimes this can be a small risk, in other cases it can allow sensitive data to be accessed directly. In any event, the problem can be resolved by deploying a firewall on the server itself or, for example, by routing all the traffic from the internet through a dedicated firewall so that all your traffic is protected. This firewall decides which ports should and should not be accessible from the internet.
2. Security patches not installed
Many software packages regularly receive updates (patches) in which vulnerabilities are resolved. If you don't install those patches, you are unnecessarily putting your systems at risk. How great that risk is varies from one patch to another: one vulnerability may be negligible in its impact whereas another can directly expose your data to significant risk. You can establish whether a particular patch has already been installed using a simple test, but of course it's also a good idea to set up an update policy. That way, you know for sure that updates are regularly implemented and you avoid publicly known vulnerabilities in your software being exploited.
3. Defects in SSL/TLS configurations
Setting up a secure communication channel between a user and your server is generally done by means of SSL SSL (Secure Sockets Layer) or TLS (Transport Layer Security). Within these methods there are many different possibilities for exchanging data and cryptographic protocols that can be used. Some of those options have publicly known vulnerabilities with popular names such as Beast, Crime, Breach, Poodle, Sweet32 and others. But other types of vulnerabilities can also be exploited as a result of certain configuration options. These vulnerabilities enable unauthorised parties to eavesdrop on the traffic between your user and your server and so access sensitive data. The solution is to modify the configuration of the software facilitating the SSL/TLS traffic. See https://cipherli.st for example configuration files for commonly used software.
4. Unknown vulnerabilities
Besides checking for publicly known vulnerabilities for which security patches already exist, there are also tests for vulnerabilities which are not yet known. A publicly known vulnerability in software A may also exploitable in software B without this being known. By using a scanning tool this vulnerability will come to the surface. It can then be resolved as quickly as possible with the help of an update.
Automated security scans, yes or no?
Do you work for a company that regularly conducts security tests but does not yet use a vulnerability scanning tool? Are you interested in automated security scans, but are you still unsure whether that is the best security measure for your company? Perhaps information about the pros and cons of a vulnerability scanning tool can help you decide.
Our security specialists are also available to answer your questions or talk to you about which security measures are appropriate for your company. Contact us via info@computest.nl or call +31(0)88-7331337.
