Security Assessment, Penetration Testing & Vulnerability Management

Defensive security controls must be subjected to continuous, rigorous validation. Organizations cannot assume their firewalls, access policies, and application logic are invulnerable; they must proactively identify, classify, and remediate vulnerabilities before threat actors exploit them.

In this lesson, we examine the formal stages of the Penetration Testing Execution Standard (PTES), analyze vulnerability assessment methodologies, dissect the Common Vulnerability Scoring System (CVSS v3.1), and compare Red, Blue, and Purple team exercises.

Vulnerability Assessment vs. Penetration Testing#

Security testing is divided into two distinct operational paradigms:

+------------------------------------+------------------------------------+
| Vulnerability Assessment (VA)      | Penetration Testing (PT)           |
+------------------------------------+------------------------------------+
| Broad, automated scanning.         | Deep, targeted human exploitation. |
| Identifies potential known flaws.  | Proves real-world exploitability.  |
| Produces large catalogs of CVEs.   | Chains multiple flaws together.    |
| Low operational disruption.        | Simulates realistic adversaries.   |
+------------------------------------+------------------------------------+

The Penetration Testing Execution Standard (PTES)#

Professional penetration testers adhere to the seven phases of PTES:

1. Pre-engagement Interactions: Defining the scope, rules of engagement (RoE), testing windows, emergency contacts, and legal authorization (Get-Out-of-Jail-Free card).
2. Intelligence Gathering (OSINT): Passively and actively harvesting intelligence about the target organization without triggering alarms:

- DNS enumeration (sublist3r, amass), certificate transparency logs (crt.sh).

- Identifying employee credentials via data breach dumps (DeHashed).

- Discovering infrastructure technologies via Shodan and Censys.

1. Threat Modeling: Analyzing harvested data to identify high-value targets, critical business assets, and primary attack paths.
2. Vulnerability Analysis: Discovering flaws and misconfigurations through targeted port scanning (nmap), service banner grabbing, and vulnerability scanning (Nessus, Burp Suite).
3. Exploitation: Safely executing exploits to prove vulnerability existence while avoiding system crashes or data corruption.
4. Post-Exploitation: Evaluating the business impact of the compromise:

- Privilege escalation (local root/SYSTEM).

- Credential harvesting from memory (mimikatz).

- Lateral movement across internal networks via Pass-the-Hash or SSH keys.

- Identifying access to sensitive data (crown jewels).

1. Reporting: Delivering executive summaries for leadership and actionable technical reproduction walkthroughs for engineering remediation.

CVSS v3.1: Vulnerability Severity Scoring#

The Common Vulnerability Scoring System (CVSS v3.1) provides a standardized framework for rating vulnerability severity on a scale from 0.0 to 10.0:

+-------------------+--------------------+
| CVSS Score Range  | Severity Rating    |
+-------------------+--------------------+
| 0.0               | None               |
| 0.1 - 3.9         | Low                |
| 4.0 - 6.9         | Medium             |
| 7.0 - 8.9         | High               |
| 9.0 - 10.0        | Critical           |
+-------------------+--------------------+

The Base Metric Group#

The base score reflects intrinsic qualities that do not change over time or across user environments:

1. Attack Vector (AV): Network (N - 0.85), Adjacent (A - 0.62), Local (L - 0.55), Physical (P - 0.20).
2. Attack Complexity (AC): Low (L - 0.77), High (H - 0.44).
3. Privileges Required (PR): None (N - 0.85), Low (L - 0.62), High (H - 0.27).
4. User Interaction (UI): None (N - 0.85), Required (R - 0.62).
5. Scope (S): Unchanged (U), Changed (C). A scope change occurs when a vulnerability in one component impacts resources managed by a different security authority (e.g., escaping a virtual machine to compromise the hypervisor).
6. Impact Metrics: Confidentiality (C), Integrity (I), Availability (A) — each evaluated as None (0.0), Low (0.22), or High (0.56).

Example Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a Critical 9.8 vulnerability: exploitable remotely over the network with zero privileges, zero user interaction, and causing complete loss of confidentiality, integrity, and availability.

Team Topologies: Red vs. Blue vs. Purple#

Modern enterprise security engineering leverages three collaborative perspectives:

• Red Team (Offensive Adversarial Simulation): Simulates the tactics, techniques, and procedures (TTPs) of real-world Advanced Persistent Threats (APTs). Operates stealthily to test whether people, processes, and technologies detect breaches.
• Blue Team (Defensive Detection Engineering): Operates the Security Operations Center (SOC). Analyzes telemetry, builds detection rules in SIEMs, tunes firewalls, and executes incident response playbooks.
• Purple Team (Collaborative Verification): A collaborative integration where Red and Blue teams work side-by-side. The Red team executes a specific TTP (e.g., Kerberoasting), and the Blue team immediately verifies whether their SIEM detection rules fired. If not, the detection engineers tune their queries on the spot.

Checkpoint Questions & Practice Exercises#

Question 1: An attacker discovers a cross-site scripting (XSS) vulnerability that requires tricking an administrative user into clicking a specially crafted malicious link. What are the values for Attack Vector (AV), Privileges Required (PR), and User Interaction (UI) in the CVSS v3.1 base score?

• Answer:

- Attack Vector (AV): Network (AV:N)

- Privileges Required (PR): None (PR:N) (the attacker needs no prior authentication to send the link)

- User Interaction (UI): Required (UI:R) (the administrative victim must actively click the link)

Question 2: What is the core difference between a standard penetration test and a Red Team engagement?

• Answer: A penetration test focuses on identifying and exploiting as many vulnerabilities as possible within a defined scope to produce a comprehensive list of flaws. A Red Team engagement tests an organization's detection and response capabilities against a simulated realistic adversary, operating stealthily over weeks or months with a specific objective (such as stealing customer database records).