Practical Vulnerability Management: A Strategic Approach to Managing Cyber Risk

Description

Practical Vulnerability Management shows you how to weed out system security weaknesses and squash cyber threats in their tracks. Bugs: they're everywhere. Software, firmware, hardware -- they all have them. Bugs even live in the cloud. And when one of these bugs is leveraged to wreak havoc or steal sensitive information, a company's prized technology assets suddenly become serious liabilities. Fortunately, exploitable security weaknesses are entirely preventable; you just have to find them before the bad guys do. Practical Vulnerability Management will help you achieve this goal on a budget, with a proactive process for detecting bugs and squashing the threat they pose. The book starts by introducing the practice of vulnerability management, its tools and components, and detailing the ways it improves an enterprise's overall security posture. Then it's time to get your hands dirty! As the content shifts from conceptual to practical, you're guided through creating a vulnerability-management system from the ground up, using open-source software. Along the way, you'll learn how to:   •  Generate accurate and usable vulnerability intelligence   •  Scan your networked systems to identify and assess bugs and vulnerabilities   •  Prioritize and respond to various security risks   •  Automate scans, data analysis, reporting, and other repetitive tasks   •  Customize the provided scripts to adapt them to your own needs Playing whack-a-bug won't cut it against today's advanced adversaries. Use this book to set up, maintain, and enhance an effective vulnerability management system, and ensure your organization is always a step ahead of hacks and attacks. Brief Contents Contents in Detail Acknowledgments Introduction Who This Book Is For Back to Basics Vulnerability Management Is Not Patch Management Main Topics Covered How This Book Is Organized Outcomes Get the Code Important Disclaimer Part I: Vulnerability Management Basics Chapter 1: Basic Concepts The CIA Triad and Vulnerabilities What Is Vulnerability Management? Collecting Data Analyzing Data Applying Cull-Rank to a Real-World Example Making Recommendations Implementing Recommendations Vulnerability Management and Risk Management Summary Chapter 2: Sources of Information Asset Information Vulnerability Information Exploit Data Advanced Data Sources Summary Chapter 3: Vulnerability Scanners What Vulnerability Scanners Do How Vulnerability Scanners Work How to Deploy Vulnerability Scanners Ensuring the Scanner Has Access Choosing Your OS and Hardware Configuring Your Scanner Getting Results Summary Chapter 4: Automating Vulnerability Management Understanding the Automation Process Data Collection Automating Scans and Updates Exploiting Your System’s Vulnerabilities Summary Chapter 5: Dealing with Vulnerabilities Security Measures Patching Mitigation Systemic Measures Accept the Risk Defense in Depth Validating Controls Summary Chapter 6: Organizational Support and Office Politics Balancing Competing Priorities Gaining Support Empathy Involve Stakeholders Early Understand Office Politics Speak Their Language Find a Champion Argue for Risk Management Summary Part II: Hands-on Vulnerability Management Chapter 7: Setting Up Your Environment Setting Up the System Installing the OS and Packages Customize It Installing the Tools Setting Up OpenVAS Setting Up cve-search Setting Up Metasploit Customize It Keeping the System Updated Writing a Script for Automatic Updates Running the Script Automatically Customize It Summary Chapter 8: Using the Data Collection Tools An Introduction to the Tools Nmap OpenVAS cve-search Getting Started with Nmap Scanning Running a Basic Scan Using Nmap Flags Customize It Getting Started with OpenVAS Running a Basic OpenVAS Scan with the Web GUI Running a Basic Scan from the Command Line Customize It Getting Started with cve-search Searching for CVE IDs Finding Out More About a CVE Text Searching the CVE Database Customize It Summary Chapter 9: Creating an Asset and Vulnerability Database Preparing the Database Understanding the Database Structure Customize It Getting Nmap into the Database Defining the Requirements Building the Script Customize It Getting OpenVAS into the Database Defining the Requirements Mapping Vulnerabilities to Hosts Building the Script Customize It Summary Chapter 10: Maintaining the Database Defining Database Indexes Setting Indexes Testing Indexes Customize It Keeping the Data Fresh Determining the Cleanup Parameters Cleaning Up Your Database with Python Customize It Summary Chapter 11: Generating Asset and Vulnerability Reports Asset Reports Planning Your Report Getting the Data Script Listing Customize It Vulnerability Reports Planning Your Report Getting the Data Script Listing Customize It Summary Chapter 12: Automating Scans and Reporting Visualizing the Automation Process Collect Data Analyze Data Maintain the Database Planning the Script Assembling the Script Running Nmap and OpenVAS Scheduling the Script Script Listings Customize It Summary Chapter 13: Advanced Reporting Detailed Asset Reporting Planning the Script Script Listing Customize It Detailed Vulnerability Reporting Planning the Script Script Listing Customize It Exploitable Vulnerability Reporting Preparation Modifying the Old Script Customize It Summary Chapter 14: Advanced Topics Building a Simple REST API An Introduction to APIs and REST Designing the API Structure Implementing the API Getting the API Running Customize It Automating Vulnerability Exploitation Pros and Cons Automating Metasploit Bringing the System into the Cloud Cloud Architecture Cloud and Network Ranges Other Implementation Considerations Summary Chapter 15: Conclusion A Look Back Designing and Building Maintaining the System Commercial Vulnerability Management Products Commercial Scanners Commercial Vulnerability Management Systems An Incomplete List of Commercial Options Coming Trends in Information Security Clouds and Containers Revisited Zero-Trust Networking In Closing Index