2KKUU7ita

Chapter 16: Reporting Your Results
reasons, and you might not be able to afford to eliminate others. Or, simply
enough, your business may have a certain level of risk tolerance. Every situation
is different. You need to factor whether the benefit is worth the effort
and cost. For instance, if you determine that it will cost $30,000 to encrypt
a sales leads database worth $20,000 to the organization, encryption might
not make sense. On the other hand, spending a few weeks worth of development
time to fix cross-site scripting and SQL injection vulnerabilities could
be worth a lot of money. The same goes for mobile devices that everyone
swears contain no sensitive information. You need to study each vulnerability
carefully, determine the business risk, and weigh whether the issue is
worth fixing.
It’s impossible — or at least not worth trying — to fix every vulnerability that
you find. Analyze each vulnerability carefully and determine your worst-case
scenarios. So you have cross-site request forgery (CSRF) on your printer’s web
interface? What’s the business risk? For many security flaws, you’ll likely find
the risk is just not there.
Here’s a quick method to use when prioritizing your vulnerabilities. You can
tweak this method to accommodate your needs. You need to consider two
major factors for each of the vulnerabilities you discover:
✓ Likelihood of exploitation: How likely is it that the specific vulnerability
you’re analyzing will be taken advantage of by a hacker, a malicious
user, malware, or some other threat?
✓ Impact if exploited: How detrimental would it be if the vulnerability
you’re analyzing were exploited?
Refer to The Open Group’s Risk Taxonomy (www.opengroup.org) for more
information on this subject.
Many people often skip these considerations and assume that every vulnerability
discovered has to be resolved. Big mistake. Just because a vulnerability
is discovered doesn’t mean it applies to your particular situation and
environment. If you go in with the mindset that every vulnerability will be
addressed regardless of circumstances, you’ll waste a lot of unnecessary
time, effort, and money, and you can set up your ethical hacking program for
failure in the long term. However, be careful not to swing too far in the other
direction! Many vulnerabilities don’t appear too serious on the surface but
could very well get your organization into hot water if they’re exploited. Dig
in deep and use some common sense.
Rank each vulnerability, using criteria such as High, Medium, and Low or a
1-through-5 rating (where 1 is the lowest priority and 5 is the highest) for each
of the two considerations. Table 16-1 shows a sample table and a representative
vulnerability for each category.
321