Cybersecurity Vulnerability Assessment Flashcards
What is Risk?
How risk will be addressed?
Design: one form of mitigation is to change the design of the system so the risk is removed.
Reduce: risks can be decreased to an acceptable level through the implementation of countermeasures that reduce the likelihood or consequence of an attack.
Transfer: it may be possible to establish some sort of insurance or agreement that transfers some or all of the risk to a third entity.
Eliminate: a good risk assessment process will identify these types of controls that need to be addressed.
Accept: there is always an option to accept the risk, to see it as the cost of doing business.
Why conduct cybersecurity vulnerability assessment?
It defines, identifies, and classifies the security vulnerabilities in an industrial control system and its related network infrastructure.
Types of Cybersecurity Vulnerability Assessments?
High Level or GAP Assessment
- Assessment of an organization’s existing operational and technical cybersecurity practices
- Comparision to industry regulations, standars and best practices
- Feedback on performance relative to industry peers
Passive Assessment
-
Discover network devices using passive means such as:
1. Reviewing drawings
2. System walk throughs
3. Traffic analysis
4. ARP tables -
Discover vulnerabilities using passive means such as:
1. Capture and study actual network traffic
2. Collect data from devices (e.g. logs)
3. Review configurations
4. Research using vulnearability databases - Understand system and process
- Create or update documentation
Active Assessments
- Discover network devices and vulnerabilities using scanning tools and techniques:
- Nmap / Advanced IP Scanner, Superscan, Shodan, Nessus, Nexpose, Retina
- Understanding system and the process
- Create or update documentation
Penetration Testing
- Begins with an active cybersecurity vulnerability assessment
- Perspective of a potential attacker
- Attemps to exploit known and unknown security vulnerabilities using exploit tools and techniques
- Validate effectiveness of security countermeasures.
Conducting an IACS Gap Assessment
- Identify benchmark standards
- Gather information
- Compare performance with benchmark standards
- Document and report results
Benefit of CSET
- Repeatable and systematic approach for assessing an organizations cybersecurity posture
- Evaluation and comparision to existing industry standards and regulations
- Facilitates discussion and input from subjet matter experts throughout the organization
- Identifies potential vulnerabilities in the control system design and security policies
- Offers guidelines for IACS cybersecurity solutions and mitigation
CSET
Cyber Security Evaluation Tool
CSET Process
- Form Team
- Add Assessment Information
- Select Mode and Standards
- Determine Security Level
- Build Network Diagram
- Answer Questions
- Analyze Results
What are the different types of vulnerability assessments?
- High-level Gap
- Pasive Vulneravility
- Active Vulnerability
- Penetration Test
What is the difference between passive and active techniques?
Passive assessments: discover network devices and vulnerabilities using passive means such as reviewing drawings, system walk-throughs and data collection from devices.
Active assessments: discover network devices and vulnerabilities using network scanning tools and techniques such as Nmap and Nessus.
What is the difference between a vulnerability assessment and a penetration test?
Vulnerability Assessments
* Define, identify, and calssify security vulnerabilites
* Identify waknesses
* Report on discoveries
Penetration Testing
* Exploit vulnerabilities
* Attemp to gain non-authorized access
* Aggressive tools and techniques to attack and penetrate the system
