Vulnerability Assessment Services

Our vulnerability assessment services check for missing patches and misconfigurations on operating systems and applications.

Blue Goat to the rescue! We are so glad we switched cybersecurity providers. Our former provider didn't find hardly any vulnerabilities and led us to a false sense of security. Blue Goat found many holes and helped us patch them!

Blue Goat Cyber Vulnerability Assessment Review

Sarah Long

Project Manager

Steps to Schedule Your Vulnerability Assessment:

1. Schedule a 30-minute Discovery Session

2. We determine IF and HOW we can help

3. We provide a Tailored Proposal

4. Together, we review the Proposal

A Vulnerability Assessment is a process of evaluating assets in an enterprise for missing patches and misconfigurations. Often the vulnerability assessment is in support of regulatory compliance or compliance with a standard. The process identifies and prioritizes vulnerabilities based on criteria such as the likelihood of the vulnerability being exploited and the severity of the vulnerability – what the vulnerability provides the attacker when used. These criteria are used to categorize the vulnerability as Critical, High, Medium, Low, or Informational.

We assess systems using vulnerability scanning tools and manual methods to identify and prioritize findings based on the criticality of system vulnerabilities. We scrub findings to eliminate false positives and prioritize risk based on existing security controls for your environment. The Vulnerability Assessment looks for missing patches and existing vulnerabilities for each system. We use authenticated scans wherever possible to reduce false positives and improve accuracy.

We typically perform a Vulnerability Assessment on an internal enterprise environment and a Penetration Test against the external, public-facing systems. We can, however, perform a Vulnerability Assessment against your external systems and wireless systems as well.

BENEFITS / RETURN ON INVESTMENT (ROI)

The majority of attacks take advantage of unpatched or misconfigured systems or applications.

Our Vulnerability Assessment service helps you identify vulnerable systems and applications. We provide prioritized, risk-based step-by-step actions to fix the identified vulnerable systems and applications.

Our Vulnerability Assessment not only looks for unpatched systems but checks for misconfigured systems, applications, and unnecessary services. Our Vulnerability Assessment service also helps ensure your IT assets are compliant with policy and standards, such as the following:

PCI DSS
HIPAA
FISMA
DISA STIGs
GLBA guidelines
OWASP
NIST

WHAT YOU GET / DELIVERABLES

You get three items:

1. Vulnerability Assessment Report

Our Vulnerability Assessment Report includes the devices (IP addresses, applications, URLs, etc.) tested, vulnerabilities discovered, steps taken during the assessment, and prioritized recommendations. Our report has many useful elements such as an Executive Summary, Top 5 Findings, Top 5 Vulnerable systems, etc.

We make every effort possible to produce a report free of false positives and easy to understand. Our aim is to provide value to you for the purpose of making your environment more secure.

2. Vulnerability Assessment Report Findings Review

We schedule an online session with you where we walk through the report with your team and answer any questions about the findings, our methods, or the steps required for remediation. Many competitors deliver a confusing lengthy report at the end of the assessment for you to decipher. Our vulnerability assessment report review adds tremendous value because we can clarify findings and remediation steps.

3. Discounted Rerun Option

How do you know the steps you took to fix our vulnerability assessment report findings actually worked? Validation removes the guesswork. When you’re ready, after fixing the issues identified in the vulnerability assessment report, we offer a deep discount to rerun the same vulnerability assessment. This is a crucial and often overlooked step in this process. Validating security controls, patches, and other fix actions is extremely important. We have discovered numerous organizations that thought they fixed a finding we identified, only to discover after another assessment that the finding was still there.

VULNERABILITY ASSESSMENT FAQS

What is a false positive?

A false positive is when a vulnerability assessment tool indicates a vulnerability exists – tests positive for the vulnerability, when the vulnerability does not actually exist. This is a common problem with vulnerability assessments. Many of our competitors do not eliminate false positives and provide you a lengthy report riddled with false positives. This wastes your time and will have you chasing ghosts. We work with you to eliminate false positives by learning your environment, using authenticated assessment scans, demonstrating proficiency in our tools and methods, and by leveraging our experience, team, and expertise.

What is the difference between a vulnerability assessment and penetration test?

A vulnerability assessment is less-intrusive than a penetration test. With the vulnerability assessment, we identify vulnerabilities but do not exploit them. A penetration test goes beyond a vulnerability assessment by exploiting vulnerabilities and seeing how far into your environment an attacker can go by taking advantage of system or application vulnerabilities.

How often should we have a vulnerability assessment performed?

Ideally, you would have a continuous vulnerability assessment and remediation program. Organizations that do not routinely scan for vulnerabilities and address these vulnerabilities are more likely to be breached. We offer a subscription-based Vulnerability Assessment model to help you address the requirement for continuous vulnerability assessment and remediation.

What happens if while performing the vulnerability assessment you discover we already are infected?

This is quite common. Any existing malware or breaches discovered during the vulnerability assessment will immediately result in a cessation of testing and be brought to the attention of the designated Point of Contact (POC). We can help with incident response, digital forensics, and malware analysis.

Is the vulnerability assessment performed remotely or onsite?

For an Internal Vulnerability Assessment, we have two options: 1) Onsite. We travel to your location and perform this service onsite. To leverage the fact that we will be traveling to your location, we offer to bundle (at a discount) other services that require us to be onsite with the Internal Vulnerability Assessment, such as our Wireless Penetration Test and Physical Security Review. 2) Remote. We perform the assessment remotely, using a VPN connection to your internal environment, by installing our tools on a system you give us access to, or by providing a virtual machine for you to run in your environment.

What is an “authenticated” vulnerability assessment?

An authenticated vulnerability assessment is the most accurate. This is where we use credentials during the scan. This can be Windows Domain credentials, Linux credentials, or database credentials. Rather than guessing at an application version or patch level, the authenticated scan can check the actual files on the system. As an example, if a recent DLL file fixed a vulnerability with a Microsoft Windows service, the authenticated scan can test for that exact DLL version.

Explore Our Other Cybersecurity Services

Medical Device Cybersecurity

We understand that often the key objective of testing medical devices is to assist with FDA approval.

Penetration Testing Services

How secure is your network? When is the last time you tested your cybersecurity defenses?

HIPAA Security Risk Analysis (SRA)

We help you meet the requirement to conduct an accurate and thorough assessment of risks to the confidentiality, integrity, and availability of ePHI.

CISO-as-a-Service

We help you mature your cybersecurity posture in alignment with your compliance requirements and business objectives.

Our purpose is simple — to make your organization secure

The number of cybersecurity incidents continues to climb. The variety of attacks continues to grow. It is no longer a question of if you will have a cyber event.