Vulnerability Assessment Service

Our Vulnerability Assessment Methodology

As a CREST and OSCP-approved provider, every vulnerability assessment we conduct follows a stringent and systematic methodology based on best practices.

Each assessment adheres to the following framework, which we work through in chronological order:

Phase 1: Identify

Scans to identify vulnerabilities in IT systems and networks. Our security experts will test the health of applications, systems and servers using automated tools or manual testing.

Phase 2: Analyse

Distinguishing the cause of the vulnerability by identifying the system components responsible for each one. By finding the source and cause of the vulnerability, this step then provides our security experts with a clear path for remediation.

Phase 3: Prioritise

This step involves assigning severity levels to each vulnerability found through scans and tests. Our security experts will prioritise vulnerabilities for remediation based on risk. For example, which data is at risk, which systems have been impacted, potential damage & the ease or severity of a potential attack.

Phase 4: Remediate

The process of mitigating each vulnerability. Our security experts and operational staff will perform updates and introduce new security tools and procedures. Where necessary, the development of a vulnerability patch could be required. Having regular vulnerability assessments and scans is an effective way to keep on top of remediation actions.

Vulnerability Assessments Vs. Penetration Testing

Although vulnerability assessments and penetration testing services are closely linked – in the fact that they aim to assess exploitable vulnerabilities in your systems – they actually serve distinct purposes in protecting your organisation from cyber threats.

A vulnerability assessment is an assessment – often using automated technology – that scans for potential vulnerabilities in your systems. A penetration test is a manual examination by a cyber security specialist that aims to mimic a real cyber attack by attempting to ethically hack into your systems.

Penetration tests are often carried out once per year to provide a thorough hands-on assessment of your networks, while vulnerability assessments are performed more regularly to continuously identify and remediate vulnerabilities.

Vulnerability Assessment:

Penetration Test:

• Performed at regular intervals
• Reports on potential vulnerabilities in your systems
• Cost-effective

• Usually performed once per-year
• Hands-on simulation of a cyber attack conducted by a cyber security expert
• Provides detailed advice for remediation of identified vulnerabilities

Vulnerability Assessment Tools

Vulnerability Assessment tools automatically scan for existing and new threats that can target your organisation. The different types of tools include:

1. Protocol Scanning – Scans for vulnerable protocols, network services and ports.

2. Web Application Scanning – Testing known attack patterns.

3. Network Scanning – Discovering stray IP addresses and suspicious packet generation from a single IP address.

Regular and automated scans of IT systems will feed into the organisations ongoing vulnerability assessment process.

Benefits of a Vulnerability Assessment

• Identify IT security threats and weaknesses early and consistently.
• Security teams can perform remediation actions to protect sensitive information.
• Meeting Cyber Security compliance and regulations for areas such as PCI DSS; FCA and PRA.
• Preventing unauthorised access into IT systems and networks; preventing data breaches from:

– SQL & XSS injection attacks

– Faulty authentication mechanisms and escalation of privileges

– Insecure defaults – such as software with guessable admin passwords