Vulnerability Assessment and Penetration Testing

Cybersecurity researchers globally are consistent with their report on findings from vulnerability landscape studies. In that both the number and severity of industrial cybersecurity vulnerabilities have spiked in 2020 and continued northwards in 2021. A very significant number of assets and devices on IT networks, in industrial OT environments as well as connected IoT devices, have patching requirements and have known vulnerabilities that are globally published and exposed. The National Vulnerability Database (NVD) is testimony to the risk that thousands of vendors and millions of hardware/ software pose.

Here’s why it is so important to identify and flag the weaknesses and vulnerabilities so they may be mitigated.

Many disclosed vulnerabilities are remotely exploitable A significant number of disclosed vulnerabilities do not require authentication for exploitation Many do not need user interaction before remote exploitation A significant percentage of vulnerabilities can contribute to information theft, identity compromise, and/ or data exfiltration More than half of identified vulnerabilities can cause total loss of availability of systems.

This is going to be a crucial step toward hardening devices and assets, locking down networks, which are going to continue to fall under the management of IT organizations. Today, digital transformation and convergence are expanding the attack surfaces. IT security teams are responsible for overseeing and decision-makers will need to understand their risk posture and how technologies such as network-based detection and secure remote access solutions will need to be leveraged.

The situation is not too dissimilar from the early days of the maturation of IT security when Microsoft was under constant pressure from customers and security companies to lock down its products and install a secure development lifecycle. Windows, the desktop operating system leader, has faced relentless attacks from threat actors. Discovery after discovery of vulnerabilities by researchers resulted ultimately in trustworthy computing initiatives and regular patch cycles. Tech giants, such as Apple and Oracle, matched that model and built their customized cycle for security updates.