VAPT - Vulnerability Assessment & Penetration Testing (Requirements, Scope & Deliverables)

Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised daily. Attackers exploit loopholes existing in IT infrastructures as well as poorly coded/implemented application solutions to conduct attacks leading to denial of service (DoS), data theft, identity theft, financial frauds, etc. This make it imperative to constantly assess the state of security of organizations’ network environment, associated IT infrastructures and internet facing applications for assurance on their security for business. Some of the reasons we see for carrying out Vulnerability Assessment & Penetration Testing (VAPT) are not limited to the following:

1. Customer needs:

It is becoming common practice today for customers to request Security Certifications (e.g. PCIDSS, ISO 27001) from their partners or vendors for continued business relationships. This often provide clients with the comfort that their business information as well as personal identifiable information (PIDs) of their customers e.g. names, address, cardholder information and financial details, are safe and will be treated in confidence in the course of that business relationship. It is important to note that security certifications such as PCIDSS and ISO 27001 mandates the conduct of vulnerability assessment and penetration testing at least annually or when significant changes occur in the control environment as a requirement for certification.

2. Compliance:

A good number of industries that serve the public, most importantly those that collect, process and store personal identifiable information such as in banking, insurance, pension, telecommunications, real estate, investment and trusteeship, among others are required by their respective regulators and local laws to have Vulnerability Assessment & Penetration Testing (VAPT) included as a mandatory requirement for players. As such, it is a matter of public safety and security to ensure that these assessments are conducted to assure of compliance of players to laid down rules, procedures and best practices in cybersecurity.

3. Security validation:

Beyond the need for compliance and relationship with customers, vulnerability assessment & penetration testing (VAPT) also helps to validate an organization’s internal security practices, controls and measures against real-world attacks. It helps to demonstrate management commitment to information & cybersecurity by testing the effectiveness and adequacy of cybersecurity governance structures, risk management, strategies, operations and controls. This will help management validate their preparedness for attacks and robustness of strategies to respond to same when they occur.

4. Best-practice & data security:

As threats evolve and attackers adopt new techniques, there is growing need for organizations to carry out proactive security assessments/audits to protect their data and systems from emerging and advanced persistent threats. This is about entrenching the culture and practice of always being ahead of the par, constantly evaluating the control environment for possible loopholes, vulnerabilities, lapses that can be exploited by threat actors/agents to inflict harm on an organization.

Determining the Scope of a Vulnerability Assessment & Penetration Testing (VAPT)

The scope for the VAPT is usually dependent on needs of the customer involved, the nature of its business, the industry where it operates and compliance standards within such industry. To be able to perform value adding VAPT, it is important to first gain understanding of the customer business and industry of operation. Doing so will enable one to identify some of the risk prevalent in the customers’ space for proper dimensioning as well as solution to mitigating them. The need for compliance with extant rules and regulations will also help in determining systems, operations and services that will naturally fall in scope of the assessment when considered from risk standpoint. Understanding the customer operating environment will help in determining the scope of the VAPT well enough to be able to provide assurance on the security of the organization operating environment. In general terms, the following will usually be in scope of vulnerability assessment except otherwise stated:

i. All devices (hardware or software) with an IP address including PCs, PDAs, servers, network devices, IoT devices, cloud infrastructures will generally be in scope of a vulnerability assessment activity. Vulnerability assessment seeks to scan target devices or systems’ security state against known/defined database of vulnerabilities to determine security loopholes that are associated with such systems for which fixes are already available. This may or may not include zero-day related vulberabilities, for which fixes may not be immediately available. Vulnerability Assessment will usually focus on organization’s internal IT infrastructure (for example, servers, databases, switches, routers, endpoints/workstations, wireless controllers & access points, VPNs, etc.), which can be exploited by an attacker.

ii. Penetration Testing usually focus on organization's external parameters, which are, loopholes that could aid access or breach of an organization's perimeter network or sensitive information through external invasive means. Perimeter firewall, extranet segment (i.e. connection with third parties) as well as web facing application servers in the Demilitarized Zone (DMZ) will generally be in scope. This will not exclude servers that are in the campus LAN or data centre segment if there are loopholes that could facilitate their exploitation

Vulnerability Assessment & Penetration Testing (VAPT) Deliverables

The following are the VAPT deliverables:

a. Executive Report:
A high level overview of the activity conducted, summary of issues identified, risk ratings and action items.
b. Technical Report:
A detailed report explaining each issue identified, step-by-step proof of concepts (POCs) for each issue, code and configuration examples to fix the issue and reference links for further details.
c. Issue Tracking Dashboards:
A dashboard that allows client’s team to monitor the audit progress, take immediate actions for high risk issues, track fixes and closure status, etc.
d. Repository of Supporting Artifacts.

For most VAPT, certain level of access to the client’s systems will be required where necessary and all such access are to be closely monitored by client’s team for transparency. To protect the client organization from risk of unauthorized disclosure of information, a Non-disclosure agreement (NDA) is usually executed between the client and the provider of the service as generally required to ensure protection of client organization's confidential and internally used information that will be in the custody of the service provider during and after the engagement period.

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.