The above audits can be clubbed together in a single package as Technology Audit or can be individually done and taken up in a phased manner as per the business requirement.
The capstone of Technology Audit is the Audit Findings Report which includes gap analysis, recommendations pertaining to technology upgrade / downgrade, training requirements and plan of action.
Technology Audit recommendation sets the direction for organizations to optimize Return of Investment on IT.
Vulnerability Assessment services are a series of tests performed on a system to identify the vulnerability of the system. This is a Security Assessment conducted to understand the vulnerabilities and by this process the vulnerabilities are identified and exposed to the security experts who in turn are able to quantify and priorities such vulnerabilities.
Basically, a vulnerability of any system refers to the inability of the system to withstand a hostile threat to its environment and the effects that may be caused by this hostile attack.
Vulnerability assessment has many things in common with risk assessment. Wiki states that assessments are typically performed according to the following steps:
- Cataloguing assets and capabilities (resources) in a system
- Assigning a quantifiable value (or at least rank order) and importance to those resources
- Identifying the vulnerabilities or potential threats to each resource
- Mitigating or eliminating the most serious vulnerabilities for the most valuable.
- Resources
- Host Based
- Identifies the issues in the host or the system.
- The process is carried out by using host-based scanners and diagnose the vulnerabilities.
- The host-based tools will load a mediator software onto the target system; it will trace the event and report it to the security analyst.
- Network-Based
- It will detect the open port, and identify the unknown services running on these ports. Then it will disclose possible vulnerabilities associated with these services.
- This process is done by using Network-based Scanners.
- Database-Based
- It will identify the security exposure in the database systems using tools and techniques to prevent from SQL Injections. (SQL Injections: – Injecting SQL statements into the database by the malicious users, which can read the sensitive data’s from a database and can update the data in the Database.)
- Advantages of Vulnerability Assessment
- Open Source tools are available.
- Identifies almost all vulnerabilities
- Automated for Scanning.
- Easy to run on a regular basis.
- Disadvantages of Vulnerability Assessment.
- High false positive rate.
- Can easily detect by Intrusion Detection System Firewall.
- Often fail to notice the latest vulnerabilities.