The first step of the risk analysis is to search for vulnerabilities on the target being analyzed,
then we need to think about the possible threats that can exploit the detected vulnerabilities.
Also quantifying the statistical probability on an annual basis of such exploitation.
The next step is to quantify the economic damage resulting from the exploitation of the vulnerability
once the damage quantification has been calculated.
For example, ten thousand dollars, you will immediately know how much you can invest in counter measures,
up, for example, to 10000 maximum.
The risk is determined by the calculated damage and the probability of occurrence of the threat and
is indicated in predetermined levels, for example, high, medium or low.
We're seeing that the search for vulnerabilities plays an important role in risk analysis.
Let's see how we can search for vulnerabilities inherent in certain targets.
You can search for vulnerabilities manually through search sites, for example, one of the most famous
sites is SecurityFocus, or use vulnerability scanners.
Let's see a vulnerability search, simulate on with securityfocus.
From the first combobox, you can select the vendor, then move on to select the product of interest,
and at the end you will have the list of all known vulnerabilities of that product.
By clicking on a specific vulnerability from the list found, you will access details of the selected
vulnerability.
The first card of the vulnerability provides general data on the vulnerability, such as whether it
can be exploited locally or remotely, its CVE code and the versions of the vulnerable target.
The discussion Tab provides a brief explanation of what the vulnerability consist and what
effects it exploitation can cause.
In the Exploit Tab, you can sometimes find a POC
A proof of concept of the vulnerability that is a simple program that allows you to experiment with
a possible exploitation of the vulnerability.
The last two Tabs solution and references explain where to find patches to mitigate or eliminate the vulnerability.
The Nist website allows you to create graphs that show the trend of the vulnerabilities over a certain
period of time, for example, in this simulation, I simulated the search for cross site scripting
vulnerabilities.
The CVE Details site is also interesting for the search
of vulnerabilities. In this simulation, for example, i simulated the search for Android vulnerabilities.
Thank you for your kind attention.