Category Archives: openvas

system security needs classification

Posted on by

I am working on a way to classify our systems (everything that is reacheable through ip) on how bad it would be and how possible it is, that someone would get unauthorized access using exploits.

I do this to determine how deep and how often I am going to check them with vulnaribility scanners like OpenVAS.

So far I have the following criteria:

  • Are there any plaintext credentials on the affected system or files which can be decrypted easily to get access to other systems?
  • Do users on the affected system have special rights to connect and authenticate to other systems?
  • Is there any personal-related data on the system?
  • Does the loss of the system affect other systems which rely on it too?
  • Is it costly in time or money to replace the system if an attacker destroys it or makes it useless (Software)?
  • Is it a productive or just a demo/test system?
  • Is only a sole department concerned with the temporal loss of the system or multiple ones?
  • Does the affected department rely invariably on the system or is it possibly to maintain operability over a short time without the system?
  • Does the configuration and software on the system change often, so it´s more likely that misconfigurations happen or new vulnerabilities get patched into the system?
  • Is it a physical system or a virtual machine?

I would appreciate if someone has a point or two to add or if theres already a standard for classifying systems that way.

Continue reading system security needs classification→