I'm wondering this. I am planning to resolve Vulnerability Assessment and Penetration Testing reports. Do I need to learn how to do such attacks in order to harden the server? Or don't I?
-
"Do I need to learn how to cut someone in order to apply a bandage?" This is a strange question. Why do you think that you need to do this to harden the findings in the reports? The reports you mention should include remediation steps, and there are many hardening guides, including CIS Benchmarks.– schroeder ♦Sep 26 at 9:57
-
Any guides on how to protect servers against various types of attacks?– Team B.IOct 5 at 15:46
-
Yes, there are many "hardening guides" to help you with that.– schroeder ♦Oct 5 at 16:46
-
ok sir. I want in detail guide though (like a book)– Team B.IOct 7 at 11:05
-
Ok, then look for "hardening guides". They are detailed...– schroeder ♦Oct 7 at 11:24
Add a comment
|
1 Answer
As Schroeder says in a comment, the reports should have remediation steps so you can fix the vulnerability.
However, as a server admin, programmer and also penetration tester, I have found that knowing about the possible flaws is indeed better, because those reports aren't too detailed in most of the cases, so it's easy to open a new vulnerability while solving one, or it's also possible to misunderstand the real requirement or simply doing a bunch of things without solving the flaw at all.
On the other hand, if I have enough knowledge, I can solve any possible new issue right in the moment and understand the implications of doing something to try to harden the issues. Also, it's possible that an issue listed in the report doesn't apply to the context or if it's applied can make things harder for the business, and only somebody who knows the server, the possible flaws and the business, can determine if it's something that worth the time solving it or not.
You must know that most of the time, if the review was done by an external, those flaws in the reports are just the results of tools ran by the tester, so they are written as they come, without a real analysis of the applicability.
Real examples that I have faced:
- The server has SSH that is too open and can be accessed publicly. The remediation step is to use a VPN and add some ACLs. The result after they "solve" it, is that the SSH is not available anymore for the users that really need it.
- Talking a bit about programming, I ask the developers to use JWT to do auth with the backend, but they use JWT to create a token every time a page is loaded, for an anonymous user and they allow it to access every endpoint.
It is also worth mentioning that knowing about security flaws and vulnerabilities, helps you to solve them from the very beginning and so you can get less of them in the reports.
