Introduction:

            In most of the current technologies in the world vulnerabilities can be found. Vulnerability is the weakest point of the system from where an attacker can enter into the inner configuration of the system and can perform illegal activities (Sommestad, Ekstedt & Holm, 2013). For fixing a particular type of vulnerability issue patches and updates are released which ensures that the program are using latest version of the code for the security features. As it is very much important ensure that the current technologies are safe, various number of agencies are solely working on it and they are creating awareness among the general public about the common vulnerabilities and exploits.

            To prevent the intrusion from the attackers end it is very much important to assess the mind set of the attacker. Thus first it need to be assess the possible ways of how an attacker can intrude in the network and from that it can be assessed how to prevent the attack. Thus for preventing the attack network administrator can use the information which already exists in the system such as NIST and CVE’s updates for best practice.

Remediation of Vulnerabilities:

            One of the highest ranked common vulnerability and exploits can affect the iTunes users. For the business purposes the iTunes does not allows to download the songs directly but it still faces a common vulnerability and exploits (Arditi, 2014). In this type of common vulnerability and exploits attacker can run a malicious code using malformed itpc. This itpc is typical type of pseudo-protocol which is developed by the hackers and it can allow the user to be redirected to the iTunes for different types of news feeds, music, apps and podcasts. Also pseudo-protocol is also able to give permission to the attacker to access the computer of the users (Deering & Hinden, 2017). Later this issue was fixed by pushing an update to the software which was the update of the iTunes 9.2.1.

            In the context of the credit card transaction data transferring data online is very much important which are mainly done through routers. Common vulnerability and exploits has affected the D-Link Wi-Fi Router also. In the business purpose routers is a very important aspects as this controls the inflow and outflow of the business related data. Thus common vulnerability and exploits in the routers is very much harmful to the security of information (Yamaguchi et al., 2014). Also, in the environment of the consumers this can be bad same as the business related issue as privacy can be lost of the users. In the case of the Wi-Fi routers the main way of avoiding attacks is the keeping the firmware of the router always updated. In the process of the firmware update again vulnerability can be found as in the initial stage there is no admin passwords is attached. Thus to mitigate the vulnerability of the routers two steps need to be followed. The first step is the updating the firmware of the D-Link Wi-Fi router to the latest version and the second step is changing the admin password of the router.

            The credit card transaction also involves transferring of data between several of devices thus it is very much important to ensure that the wireless connection is safe as transferring of data can be a chance for the attackers to exploit the attacks (Koenig et al., 2013). In this case the attacker uses an arbitrary code which for accessing the data through the SMB port. This type of vulnerability has been found when the users used the credit card in the environment of the windows vista and windows server 2008. To fix this issues in the Windows Vista and in Windows Server 2008 Microsoft released a patch.

            As it has been identified that the routers can bring a vulnerability issue to the transaction of the credit cards it needs to be mitigated on an emergency basis. With the D-Link routers the Linksys routers also has a security flaw in their system which can be an attraction point of the attackers. The main flaw with the Linksys routers is that after resetting the whole router it makes the initial password of accessing the router to the ‘admin.’ This password is the most common passwords and can be easily determined by the attackers (Ur et al., 2016). By the determination of the password the attacker can easily change the password and can configure the password however they want for performing illegal operations. To mitigate this issue one idea can be implemented which is changing the password immediately after resetting the network router.

Reason behind addressing the Vulnerabilities by Changing Configuration of OS:

            In many of the cases it becomes very much problematic to implement new upgrade or a new patch. The main issue arises in this case is compatibility with other programs or might be there are some other issues such as omitting an important feature. In such of the cases the only way is OS hardening (Silberschatz, Gagne & Galvin, 2018). This is the process of making the operating system tougher. To make the OS tough patches, updates and system upgrade need to be implemented. This update and the patches are used for closing loop holes within the systems or the loop holes that can occur in the future.

            Though just a patch and or a update needs to be implemented in this case it does not mean that the update and the patches can be implemented in the same day or the next day. In many of the cases organizations runs legacy systems and lots of careful planning. In the case of the system hardening system reaches to an end point where the systems cannot go further until the system is upgraded or patched properly.

Process for Monthly Vulnerability Scanning:

            Vulnerability scanning of the networks is very much important on a monthly basis to assess if there is any type of vulnerability in the current system. To perform the vulnerability scanning there are various of procedures, but the best assessment is done by the organization itself. Nessus was used in the previous of scanning that would make sense to use going forward (Genge & Enăchescu, 2016). This scans are very much east to perform but correcting the vulnerability from the scanning is very much difficult in this case. While considering vulnerability scanning certain consideration need to be made which are:

1. Identification of the risk – in this case what the issues raised and to begin and to go form there.
2. Communicating what is found from the scan and the other that need to know.
3. Updating or creating policies as needed.
4. Development of the metrics to measure the compliance.

The other concern in the scan report is the always presence of the false-positive reports. As the false-positive reports can be make for a “tail-chase” it is very much important to get a scanner for identification of the false positive reports or ignoring the false positive reports. The Nessus uses the banner return for connecting to the ports.

Conclusion:

            From the above discussion it can be concluded that OS hardening is very much important for mitigating the various types of attacks. In this case the main idea is ensuring that the all to buy process gets the support as it is needed for to be successful. From the scan it has been determined that the software which need to be upgraded may require involved works from various types of departments to fulfil the necessary of keeping the organization safe and for running the system at its full potential. In this case remediation of various types of assessed vulnerabilities within the system has been discussed. After that, reason behind addressing the vulnerabilities by changing configuration of OS has been evaluated properly. Further, in this discussion process of the monthly vulnerability scanning has been evaluated.

References:

Arditi, D. (2014). iTunes: Breaking barriers and building walls. Popular Music and Society, 37(4), 408-424.

Deering, S., & Hinden, R. (2017). Internet protocol, version 6 (IPv6) specification (No. RFC 8200).

Genge, B., & Enăchescu, C. (2016). ShoVAT: Shodan‐based vulnerability assessment tool for Internet‐facing services. Security and communication networks, 9(15), 2696-2714.

Koenig, S., Lopez-Diaz, D., Antes, J., Boes, F., Henneberger, R., Leuther, A., … & Zwick, T. (2013). Wireless sub-THz communication system with high data rate. Nature Photonics, 7(12), 977.

Silberschatz, A., Gagne, G., & Galvin, P. B. (2018). Operating system concepts. Wiley.

Sommestad, T., Ekstedt, M., & Holm, H. (2013). The cyber security modeling language: A tool for assessing the vulnerability of enterprise system architectures. IEEE Systems Journal, 7(3), 363-373.

Ur, B., Bees, J., Segreti, S. M., Bauer, L., Christin, N., & Cranor, L. F. (2016, May). Do Users’ Perceptions of Password Security Match Reality?. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (pp. 3748-3760). ACM.

Yamaguchi, F., Golde, N., Arp, D., & Rieck, K. (2014, May). Modeling and discovering vulnerabilities with code property graphs. In Security and Privacy (SP), 2014 IEEE Symposium on (pp. 590-604). IEEE.