Detecting Asset Vulnerabilities and Application Risks

Analysis of Asset Vulnerabilities and Application Risks

Asset vulnerabilities include configuration risks, weak passwords, and vulnerabilities. Attackers exploit these vulnerabilities and weak passwords to pose security risks to enterprise resources. In security risk assessments, the vulnerabilities of assets themselves are also important considerations. Assets owned by enterprises refer to cloud servers and applications, container environments built on cloud servers, etc.

Best Practices for Asset Vulnerability Detection and Application Risk Assessment

Asset Management

Establish tools and processes for asset information collection and management. Asset information is the basic information that helps enterprise security administrators analyze, locate, and trace in the event of a network attack. It is also known as asset fingerprints. Centralized collection and management of asset information help enterprises quickly understand the current asset status and monitor and analyze security risks from a global perspective.

Please use the asset fingerprints feature to achieve global asset fingerprint management.

Security Baseline Detection for Servers

Server security baseline checks are used to perform security baseline checks on servers based on relevant standards, such as CIS Benchmark (baseline for operating systems), and Alibaba Cloud Server Security Best Practices. Security baseline detection helps identify weak passwords, unauthorized access, security configurations of operating systems, risks in Kubernetes Cluster and Node configurations for containers, compliance requirements, and evaluation criteria and requirements of authoritative evaluation organizations for security baseline environments. Users can also perform evaluation based on custom security check items.

Use the Baseline check function.

Server Vulnerability Detection

To ensure the security of enterprise assets, it is recommended that enterprises perform regular vulnerability scanning, assessment, and remediation for servers. Vulnerabilities are one of the most common and effective attack methods used by attackers. It is advisable for enterprises, regardless of the size of the server scale, to regularly assess vulnerabilities in servers, including operating system vulnerabilities, web vulnerabilities, application component vulnerabilities, etc. Establish periodic scanning and assessment tasks and collaborate with application teams and operation teams to develop corresponding emergency plans for vulnerability remediation, enabling timely response to large-scale vulnerability exploitation attacks.

• Use the Security Center Vulnerability Management function to perform periodic vulnerability scanning for all servers in the cloud.

• View vulnerability scanning results for further evaluation of the impact and level of the vulnerability in the enterprise environment. Refer to the vulnerability's CVE number and details, Alibaba Cloud vulnerability level description, and vulnerability tags (Alibaba Cloud tags vulnerabilities based on historical discoveries and fixes, such as "EXP exists", "command execution", "remote access", etc.).

• View the vulnerability scores to assess the real risk of the vulnerabilities based on their scores and severity levels. The scoring rules and model can refer to the Alibaba Cloud Vulnerability Vulnerability Scoring System.

• View the list of vulnerabilities with real risks based on the score of urgency to fix a vulnerability. It assesses vulnerabilities based on the Alibaba Cloud Vulnerability Vulnerability Scoring System, time factors, actual environmental factors, and asset importance factors. It combines the exploitability (PoC, EXP) and severity of the vulnerability in actual attack and defense scenarios to help you automatically filter out vulnerabilities with real security risks. Enabling this function can help you improve the efficiency of remediation for vulnerabilities that can be exploited by hackers in your assets and the effectiveness of remedial measures. Disabling this function will display all vulnerabilities.

• The Alibaba Cloud vulnerability database includes CVE, CNNCD, and Alibaba Cloud Official Vulnerability Database.

Verification of Server Vulnerabilities and Automated Remediation

You can use the vulnerability remediation and verification functions of the Security Center to remediate and verify the identified vulnerabilities.

• Before performing remediation, please check the vulnerability types supported for remediation.

• Execute one-click vulnerability remediation (system vulnerabilities support one-click remediation), and it is recommended to create a pre-repair snapshot for system rollback.

• Perform manual remediation. You can view vulnerability information in the vulnerability details, go to the Alibaba Cloud vulnerability database to view remediation recommendations and operations, and manually perform remediation. After remediation, you can verify the remediation effect in the vulnerability detection function of the Security Center.

• View the reasons for vulnerability remediation failure.

• You can view the software vulnerability remediation suggestions for Alibaba Cloud servers.

• Create an automated remediation vulnerability task using the playbook feature of the Security Center to implement automated run books for vulnerability remediation.

Regular Application Vulnerability Assessment

Perform regular scanning for application vulnerabilities in the system by using the vulnerability management function of the Security Center.