Cyber Defense eMagazine August Edition for 2021

continuous game of catching up each time a vulnerability scan is run. That’s why a vulnerability strategy
is critical.
Do not rely on tools to find business logic vulnerabilities
Most vulnerability data come from scanners, but the most important vulnerability data often comes from
humans, specifically penetration testers.
It’s a fact that good pentesters use automated scanning tools (ideally from many different sources) and
run frequent vulnerability discovery and assessment scans in the overall pentesting process. Scanning
is generally considered an addition to manual, deep dive pentests conducted by an ethical hacker. When
correctly understood, manual penetration testing leverages the findings from automated vulnerability and
risk assessment scanning tools to pick critical targets for experienced human pentesters to: 1) verify as
high-fidelity rather than chasing false-positives, and then 2) to consider exploiting as possible incremental
steps in a serious effort to eventually gain privileged access somewhere important on the network.
Purely automated tools or highly automated testing activities cannot adequately perform testing of the
business logic baked into the application under the test. While some tools claim to perform complete
testing, no automated technology solution on the market today can perform true business logic testing.
The process requires the human element that goes well beyond the capabilities of even the most
sophisticated automated tools.
Vulnerability data tracking helps ensure remediation
Vulnerability data must be tracked to ensure remediation – otherwise vulnerabilities may fall through the
cracks and leave your organization exposed to a data breach or other cyber security attacks. Further,
developing vulnerability tracking requires a system for managing remediation workflows that can handle
these seven tasks:
• Ingestion of various data formats with flexible normalization
• Reviewing of normalized data for changes and modifications as needed
• Distribution of normalized data to various external systems
• Tracking the data distributed externally to keep a central listing up to date
• Ensuring policy is adhered to across the various systems where the data vulnerability remediation
is tracked
• Sending notifications and keeping humans involved in the process, especially when vulnerability
remediation is overdue
• Reporting on the outcome of vulnerabilities by group, business unit, or globally across the
organization
This all ties back to risk-based security. The security industry should understand why risk-based security
strategies are more effective than compliance-based strategies but are often challenged as to how to
make the shift. To mature your security program and achieve a risk-based strategy, it is essential to align
business logic with vulnerability management and track and prioritize the vulnerabilities that pose the
highest risk specific to your business.
Cyber Defense eMagazine – August 2021 Edition 77
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.