Blog

IT Vulnerabilities and How to Find Them

November 23, 2021
Data Protection, IT Security

Where are IT vulnerabilities? They’re everywhere, from your servers and software to the fingertips of your employees. Some, like those that result from the actions of negligent employees, can be dealt with through training. Others, like bugs in software, can be handled via timely patch management.

Many IT vulnerabilities, however, aren’t so obvious or easy to manage. That’s why it’s important to use a multi-faceted system to identify and deal with the broad spectrum of potential issues. The following steps can help.

1. Understand the Common Types of Vulnerabilities

• Cybersecurity Vulnerabilities. In cybersecurity, a vulnerability is a potential weakness in a security architecture that opens an organization or individual to cyberattacks.
• Network Vulnerabilities. These are issues with a network’s hardware or software that make it vulnerable to intrusion by outside parties. This includes poorly configured firewalls and insecure Wi-Fi access points. Unencrypted data can also be a problem. It doesn’t necessarily cause an attack to occur, but it does make it easier for attackers to steal or corrupt data.
• Operating System (OS) Vulnerabilities. These are vulnerabilities within a particular OS ─ such as hidden backdoors ─ that can be exploited to cause damage or gain access to an asset installed on OS.
• Human Vulnerabilities. Actions by users, typically employees, can leave IT systems open to a wide variety of issues. This includes sharing passwords with individuals who aren’t authorized to access an organization’s data or applications or clicking on links in emails that allow for malware to enter an IT system.
• Process Vulnerabilities. It’s not so much the processes as the lack of them or failure to adhere to them. This could include not limiting access privileges or not having or following a patch management plan.

2. Inventory Your IT Assets

You can’t protect what you don’t know you have. Create an inventory of all IT assets, such as hardware, software, applications, and data. Use employee surveys or other means to account for shadow IT. Note what everything is used for, where it resides and who has access to it. Map everything to account for all dependencies.

3. Create Risk Profiles and Threat Models

Once you have a comprehensive list of your IT assets, note what security and data protection protocols and technologies are used for each asset. Review the architecture of applications for security flaws. Note which assets are subject to patch management, monitoring, third-party managed security services, etc.

Create a risk profile to help determine how risk-averse or tolerant each asset is. You should also develop threat models for external assets and components like your APIs, cloud infrastructure, and hosted data centers.

This will help you better understand the correlation between threats, internal assets, and design structure to expose system flaws and vulnerabilities.

4. Review Your Vulnerability Scanning and Management Efforts

Are you using vulnerability scanning tools (software) or vulnerability management as a service solution o identify issues? Are you conducting both external and internal scans?

• External scans take place outside a network perimeter to determine the exposure to attacks of servers and applications that are accessible directly from the internet. These scans detect vulnerabilities in perimeter defenses such as open ports in the network firewall.
• Internal scans are conducted inside an organization’s network perimeter to detect vulnerabilities that could be exploited by hackers who penetrate perimeter defenses. Internal scans can also identify the potential for “insider threats”, such as disgruntled employees who have legitimate access to parts of the network.

You may not need both types of scans, but conducting external and internal scans provides a much clearer picture of your overall security. In addition, your organization may be subject to industry standards that require both types of scans. For example, organizations subject to the Payment Card Industry Data Security Standard (PCI-DSS) must perform external and internal vulnerability scans quarterly, as well as every time new systems or components are installed, network topology changes, firewall rules are modified, or software is upgraded.

Scanners can uncover thousands of vulnerabilities, so there may be enough severe vulnerabilities that further prioritization is needed. A third-party Security Operations Center (SOC) analysis service can help.

5. Conduct Penetration Testing

Penetration (pen) testing, also referred to as “ethical hacking” is a simulated cyberattack against your IT system to check for exploitable vulnerabilities. There are various types of pen tests that focus on different areas of an IT infrastructure, including:

• Web application penetration tests, which examine the overall security and potential risks of web applications, including coding errors, broken authentication or authorization, and injection vulnerabilities.
• Network security tests, which are conducted to uncover vulnerabilities on different types of networks, associated devices like routers and switches, and network hosts. They aim to exploit flaws in these areas, like weak passwords or misconfigured assets, to gain access to critical systems or data.
• Cloud security tests, which help validate the security of a cloud deployment, identify the overall risk and likelihood for each vulnerability and recommend how to improve the cloud environment.
• IoT security tests, which entail analysis of each component and the interaction between them. By using the layered methodology, where each layer is analyzed, pen testers can spot weaknesses that may otherwise go unnoticed.
• Social engineering tests employ phishing tools and emails tailored to an organization to test defense mechanisms, detection and reaction capabilities, finding susceptible employees, and security measures that need improvement.

6. Assess Your Patch Management Program

Who is responsible for patch management? Is it done internally or by a third party? Is it automated or manual? Are patches prioritized by the severity of the vulnerability or its impact on your organization’s operations?

Does some of or all your network need to be shut down to apply fixes to major vulnerabilities? Are patches tested before or after implementation? Are vulnerabilities prioritized so the most important vulnerabilities are addressed first? Is there a program in place to communicate with users when patches will be applied?

7. Evaluate Employee/User Training and Protocols

Review your IT security training programs. Do they cover all the elements necessary to help employees and other system users understand potential threats and how to avoid them? Is training frequently repeated and updated? Is testing conducted to ensure users are following through with what they’ve learned?

How does your organization handle user – including vendors and other third parties ─ access to various IT assets? Are you ensuring that users only have access to what they need to do their required tasks and nothing more? Are mechanisms in place to immediately cut off access when someone leaves the organization?

8. Protect Your Endpoints

Are you employing security measures to protect endpoints such as laptop computers and mobile devices? There are many different types available, including traditional antivirus, endpoint protection platforms (EPPs), and endpoint detection and response (EDR), and managed detection and response (MDR) solutions. EDR and MDR solutions are useful in not only identifying and responding to known threats. Many employ machine learning and artificial intelligence to detect anomalous behaviors and proactively identify and prioritize weak points across your network, including your users.

9. Assess Your IT Resources, Including Staffing

Do you currently have the in-house staffing resources and budget to not only identify IT vulnerabilities but also fix them? Does your staff have the necessary expertise? Do you have mechanisms in place to keep your staff up-to-speed on emerging threats? Do they have the knowledge base to identify and remedy potential vulnerabilities on newly acquired IT assets? If the answer to any of these questions is no, determine possible fixes to the problems. That could include making a business case for additional resources or using managed services from a third-party company.

10. Review and Update All IT Asset-related Plans

Chances are you have plans in place to deal with issues such as patch management, disaster recovery (DR), incident response, etc. However, these plans don’t do much good if they aren’t regularly evaluated and updated. Not updating these plans can open your organization up to a broad range of unanticipated vulnerabilities.

Make sure you have mechanisms in place for reviewing and updating these plans periodically. Reviews and updates should be conducted after any pen testing and DR testing as well as following staff changes.

Frequently review and update IT asset inventories and risk profiles, and overall risk assessments. New IT vulnerabilities are always emerging; old ones that have been forgotten or neglected can leave an organization at risk too.

The Never-ending Pursuit of Vulnerabilities

Unfortunately, it’s impossible to eliminate all potential IT vulnerabilities. It is, however, possible, to identify and mitigate many of them. A good place to start is with US Signal.

US Signal offers a variety of services and solutions that can help identify IT vulnerabilities, prioritize them, and mitigate or eliminate them. Contact us for a free consultation. Call (616) 988-0414 or email [email protected]