Practical Vulnerability Management

Practical Vulnerability Management

by Andrew Magnusson
Released September 2020
Publisher(s): No Starch Press
ISBN: 9781593279882

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Bugs: they’re everywhere. Software, firmware, hardware — they all have them. Bugs even live in the cloud. And when one of these bugs is leveraged to wreak havoc or steal sensitive information, a company’s prized technology assets suddenly become serious liabilities.

Fortunately, exploitable security weaknesses are entirely preventable; you just have to find them before the bad guys do. Practical Vulnerability Management will help you achieve this goal on a budget, with a proactive process for detecting bugs and squashing the threat they pose.

The book starts by introducing the practice of vulnerability management, its tools and components, and detailing the ways it improves an enterprise’s overall security posture. Then it’s time to get your hands dirty! As the content shifts from conceptual to practical, you’re guided through creating a vulnerability-management system from the ground up, using open-source software.

Along the way, you’ll learn how to:

•Generate accurate and usable vulnerability intelligence
•Scan your networked systems to identify and assess bugs and vulnerabilities
•Prioritize and respond to various security risks
•Automate scans, data analysis, reporting, and other repetitive tasks
•Customize the provided scripts to adapt them to your own needs

Playing whack-a-bug won’t cut it against today’s advanced adversaries. Use this book to set up, maintain, and enhance an effective vulnerability management system, and ensure your organization is always a step ahead of hacks and attacks.

Table of contents

  1. Cover Page
  2. Title Page
  3. Copyright Page
  4. Dedication
  5. About the Author
  6. BRIEF CONTENTS
  7. CONTENTS IN DETAIL
  8. ACKNOWLEDGMENTS
  9. INTRODUCTION
    1. Who This Book Is For
    2. Back to Basics
    3. Vulnerability Management Is Not Patch Management
    4. Main Topics Covered
    5. How This Book Is Organized
    6. Outcomes
    7. Get the Code
    8. Important Disclaimer
  10. PART I: VULNERABILITY MANAGEMENT BASICS
  11. 1 BASIC CONCEPTS
    1. The CIA Triad and Vulnerabilities
    2. What Is Vulnerability Management?
    3. Vulnerability Management and Risk Management
    4. Summary
  12. 2 SOURCES OF INFORMATION
    1. Asset Information
    2. Vulnerability Information
    3. Exploit Data
    4. Advanced Data Sources
    5. Summary
  13. 3 VULNERABILITY SCANNERS
    1. What Vulnerability Scanners Do
    2. How Vulnerability Scanners Work
    3. How to Deploy Vulnerability Scanners
    4. Getting Results
    5. Summary
  14. 4 AUTOMATING VULNERABILITY MANAGEMENT
    1. Understanding the Automation Process
    2. Data Collection
    3. Automating Scans and Updates
    4. Exploiting Your System’s Vulnerabilities
    5. Summary
  15. 5 DEALING WITH VULNERABILITIES
    1. Security Measures
    2. Summary
  16. 6 ORGANIZATIONAL SUPPORT AND OFFICE POLITICS
    1. Balancing Competing Priorities
    2. Gaining Support
    3. Summary
  17. PART II: HANDS-ON VULNERABILITY MANAGEMENT
  18. 7 SETTING UP YOUR ENVIRONMENT
    1. Setting Up the System
    2. Installing the Tools
    3. Keeping the System Updated
    4. Summary
  19. 8 USING THE DATA COLLECTION TOOLS
    1. An Introduction to the Tools
    2. Getting Started with Nmap Scanning
    3. Getting Started with OpenVAS
    4. Getting Started with cve-search
    5. Summary
  20. 9 CREATING AN ASSET AND VULNERABILITY DATABASE
    1. Preparing the Database
    2. Understanding the Database Structure
    3. Getting Nmap into the Database
    4. Getting OpenVAS into the Database
    5. Summary
  21. 10 MAINTAINING THE DATABASE
    1. Defining Database Indexes
    2. Keeping the Data Fresh
    3. Summary
  22. 11 GENERATING ASSET AND VULNERABILITY REPORTS
    1. Asset Reports
    2. Vulnerability Reports
    3. Summary
  23. 12 AUTOMATING SCANS AND REPORTING
    1. Visualizing the Automation Process
    2. Planning the Script
    3. Assembling the Script
    4. Summary
  24. 13 ADVANCED REPORTING
    1. Detailed Asset Reporting
    2. Detailed Vulnerability Reporting
    3. Exploitable Vulnerability Reporting
    4. Summary
  25. 14 ADVANCED TOPICS
    1. Building a Simple REST API
    2. Automating Vulnerability Exploitation
    3. Bringing the System into the Cloud
    4. Summary
  26. 15 CONCLUSION
    1. A Look Back
    2. Commercial Vulnerability Management Products
    3. Coming Trends in Information Security
    4. In Closing
  27. INDEX

Product information

  • Title: Practical Vulnerability Management
  • Author(s): Andrew Magnusson
  • Release date: September 2020
  • Publisher(s): No Starch Press
  • ISBN: 9781593279882