SXGuard — Swiss Security
...
Vulnerability Assessment (VA)
Methodology

Vulnerability Assessment (VA)

A high-level, largely automated scan across your digital estate for missing patches and misconfigurations.

A security operations display showing scan results

I) Introduction

Definition

A Network Vulnerability Assessment (VA) is a systematic process of identifying, quantifying, and prioritizing the security vulnerabilities present in an organization's computer network. It provides a comprehensive inventory of assets, their associated vulnerabilities, and the potential risks they pose.

VA vs. Penetration Testing

It is crucial to distinguish this process from a penetration test:

  • Vulnerability Assessment: Focuses on identifying, classifying, and prioritizing vulnerabilities. It is a wide-ranging, often automated process designed to be comprehensive. It answers the question: "What are our weaknesses?"
  • Penetration Testing: Focuses on actively exploiting vulnerabilities to gain access. It is a deep, objective-based process that simulates a real-world attack. It answers the question: "Can our weaknesses be exploited to cause a breach?"

Vulnerability assessment

Broad and Automated

Every asset gets a light scan

“What are our weaknesses?”

Penetration testing

Narrow and Manual

  1. Layer 1 - network
  2. Layer 2 - app
  3. Exploited

One path, actively proven

“Can it cause a breach?”

Primary Goal

The goal of this methodology is to produce a prioritized and actionable report that enables IT and security teams to effectively remediate vulnerabilities, reduce the network's attack surface, and make informed risk-management decisions.

II) VA Phases

Phase 1: Planning and Scoping

1.1. Define Objectives

  • Clearly state the primary driver for the assessment (e.g., routine security hygiene, compliance audit (PCI, HIPAA), post-incident review, assessing a new network segment).

1.2. Define Scope

  • In-Scope Assets: Explicitly define the target network segments. This must be documented and approved.
  • Examples: Specific IP ranges (10.1.0.0/16), VLANs (VLAN-10_Servers), physical locations (Data-Center-A), or asset groups (All production web servers, Workstation networks).
  • Out-of-Scope Assets: Explicitly list what must not be scanned.
  • Examples: Highly sensitive systems (Industrial Control Systems/ICS), third-party vendor equipment, or systems where a scan could cause operational failure. These require special handling.

1.3. Define Scan Type

  • Uncredentialed (Black-Box) Scan:
    • Description: Scans the network from the outside, with no internal access or credentials. Simulates an external attacker.
    • Result: Open ports, service versions, and network-level vulnerabilities visible to an unauthenticated user.
  • Credentialed (White/Grey-Box) Scan:
    • Description: Scans are performed with read-only credentials (e.g., a domain user account, SSH key) provided by the client. This is the most recommended approach for a comprehensive assessment.
    • Result: Deep, local vulnerabilities invisible from the network, such as missing OS patches, insecure local configurations, and vulnerable software versions.

1.4. Establish Rules of Engagement (ROE)

  • Testing Window: Define precise dates and times when scanning is permitted.
  • Scanner IP Whitelisting: Provide the source IP addresses of the vulnerability scanners to the client, so they can be whitelisted in Intrusion Prevention Systems (IPS) or firewalls. This prevents the scan from being blocked and ensures a complete assessment.
  • Communication Channels: Establish a clear point of contact (e.g., IT manager, security lead) and a communication channel (e.g., email, phone) for progress updates or in case of any issues.

Phase 2: Discovery and Enumeration

2.1. Host Discovery

  • Use network scanning techniques (e.g., nmap ping sweeps, ARP scans, or the scanner's built-in discovery module) to identify all live hosts (servers, workstations, printers, routers, etc.) within the scoped IP ranges.

2.2. Service Enumeration

  • For each live host, perform a comprehensive port scan to identify all open TCP and UDP ports.
  • The goal is to map every running service (e.g., HTTP on port 80, SSH on port 22, SMB on port 445).

2.3. Version Detection

  • Actively and passively fingerprint each service to determine its precise version (e.g., "Microsoft-IIS/10.0," "OpenSSH 8.2p1").
  • Identify the underlying operating system of the host (e.g., "Windows Server 2019," "Ubuntu 20.04"). This information is critical for matching against vulnerability databases.

Phase 3: Vulnerability Scanning

3.1. Scan Execution

  • Configure and launch a commercial or open-source vulnerability scanner (e.g., Nessus, Qualys, OpenVAS, Nexpose) against the discovered assets.
  • Execute both uncredentialed and credentialed scans as defined in the scope.
  • Ensure scan policies are set appropriately (e.g., using "safe" non-intrusive checks for sensitive environments).

3.2. Data Collection

  • The scanner will test each host and service against a large database of known vulnerabilities (CVEs), common misconfigurations, and default credentials.
  • All findings are collected into a raw data report, often containing thousands of potential issues.

Phase 4: Reporting

4.1. Data Aggregation

  • Consolidate results from all scans (credentialed, uncredentialed, different network segments) into a single dataset.

4.2. False Positive Reduction

  • Manually review and validate high-impact findings. Scanners can make mistakes (e.g., flagging a vulnerability based on a service banner when a backported patch has already been applied).
  • Attempt to confirm the vulnerability's presence through non-intrusive manual checks (e.g., verifying a file version, checking a registry key).

4.3. Vulnerability Correlation

  • Identify patterns and root causes. For example, 100 servers may share a "Critical" vulnerability due to a single-service misconfiguration or a single missing patch in a master VM image.
  • Analyze how vulnerabilities might be chained, even if exploitation is not performed.

4.4. Risk Assessment

  • A vulnerability's risk is more than its technical severity (e.g., a CVSS score). Each finding must be contextualized:
  • Asset Criticality: Is the asset a non-production test web server or a domain controller? A "Medium" vulnerability on a critical asset is often a higher priority than a "Critical" one on an isolated, low-value system.
  • Data Sensitivity: Does the system store or process PII, financial data, or intellectual property?
  • Exploitability: Is a simple, public exploit available?
  • Impact: What is the business impact if the vulnerability is exploited (e.g., data breach, service disruption, reputational damage)?
  • Based on the contextualized risk, assign a final priority rating (e.g., Critical, High, Medium, Low) to each validated vulnerability.

4.5. Reporting

  • Executive Summary:
    • Audience: Management (CISO, CIO, IT Directors).
    • Content: High-level overview, written in plain business language. Includes a risk "heat map," key trends (e.g., "Poor patch management"), and a summary of the most critical risks to the business.
  • Technical Report:
    • Audience: IT and security teams.
    • Content: A detailed, prioritized list of all validated vulnerabilities. Each finding must include:
    • Vulnerability: A clear description.
    • Affected Assets: A list of IPs and hostnames.
    • Risk Rating: The prioritized risk (Critical, High, etc.).
    • Evidence: Scanner output and manual validation steps.
    • Remediation: Clear, step-by-step instructions on how to fix the issue (e.g., "Apply patch KBXXXX," "Disable SSLv3," "Update sshd_config and restart service").

Phase 5: Remediation and retest

  • Present the findings in a debrief meeting.
  • Support the technical teams as they apply the recommended fixes.
  • Verification (Re-test): After the remediation window, perform a targeted re-scan on the patched systems to validate that the vulnerabilities have been successfully resolved.
Back to all services

Ready to scope this engagement?

Tell us about your environment and objectives — we'll return a tailored scope, timeline, and quote within 24 hours.

Request a Free Scoping Call