English

← Back to list

What exactly does VAPT do? NIST SP 800-115 Boundary for gap reduction assessment and penetration testing

itadol5j

The VAPT (Vulnerability Assessment and Implementation Test, Gap Assessment and Infiltration Test) is almost the most used and easily confused set of abbreviations. The purchase list contained “VAPT services once” and could have been delivered either by a bunch of scanning reports or by a real reset of intrusion routes - the difference between the prices and the value. This paper describes boundaries in the light of one of the most authoritative public approaches: SP 800-115 of the National Institute of Standards and Technology of the United States of America.

Gap assessment versus penetration test: VA list, PT verification breach

I. Boundary between VA and PT: NIST Point Broken

NIST's original statement is very direct:The leak scanner only checks that there may be a loophole, while the penetration test attack phase is actually used to confirm its existence.I don't know. This is the essential division of labour between the two:

  • Gap Assessment (VA): Batch identification of hosts, services, applications, output of “how many holes, how serious” lists are compared to a loophole (e.g. NVD). The degree of automation and coverage was high, but the report was misreported and largely did not answer “how far these holes can go in combination”.
  • Infiltration test (PT): Simulation of a real attacker, launching a real attack on a selected target. NIST stresses in particular that most penetration tests are worth finding out.Group of gaps in individual or multiple systems— greater access than any single loophole.

One sentence:VA is a medical check-up, PT is a real-person exercise.I don't know. Both types of procurement are often packaged in the compliance scene, but it must be clear at the time of receipt and inspection: has the validation actually been used? Or did Nessus just hand over the export forms?

II. NIST IV METHODOLOGY

NIST SP 800-115 Four Phases of Infiltration Test: Plan, Discovery, Attack, Reporting

SP 800-115 Section 5.2.1 divides infiltration tests into four stages (Figure 5-1):

  • Planning SchemeIdentification rules, obtaining management approval and writing down, setting test targets. NIST specifies:No actual tests at this stage.But it's the foundation of the whole test.
  • Discovery found: Information gathering and gap analysis. Port and service identification, DNS/WHOIS query, Banner grab, NetBIOS enumerator (internal testing only); then compare what has been cleaned to the loophole. It's only slow for a man to catch a new glitch from the scanner.
  • Attack attack: The core of the test. The potential gaps that have been identified are being used on a case-by-case basis; success is being verified with a clear response to mitigation measures; when power is being used, the real risk level of the network continues to be analysed; and a particular loophole is not moving. Between the attack and the discovery,Feedback Ring— Once the new foothold has been secured, it will be collected, retested, multiple system rolling tests.
  • Reporting report: Not the last, but the last.Synchronize with the other three phasesThe border check record.

NIST also reminds that this is only an “acceptable division”, but industry mainstream processes (including the OWASP WSTG and PTS standards) can be matched to this skeleton: the OWASP Web Safety Test Guide is a Web application test of the de facto public manual, and PTES has written up the six-part community standard for pre-interaction/intelligence collection/threat modelling/use/after-use/reporting.

III. Overt or Covert: Prefixing the rules of the game

NIST divides safety tests into two categories according to the level of knowledge:Overt testConducted with the knowledge and consent of the IT team, with the aim of finding as full a hole as possible;Covert (black hat) confrontation testThe defense is not notified, and the real confrontation organization is examined for the damage it can cause, and the response is tested. The two objectives are completely different and do not use a scanning report to claim both effects. In any case,Rules of engagement first.: scope, time period, prohibited actions (e.g. DoS, delete production data), cessation conditions, emergency contact, all written - NIST Appendix B directly to the ROE template. Infiltration tests naturally involve real systems and real data, with no ROE "infiltration tests" amounting to an unlicensed homicide.

VAPT: Rules of engagement, scene selection, combination of risk, landing report

IV. THREE ENJOYMENTS TO A AND B

A-A-A-A-R.1) reports are required to distinguish between “scan discovery” and “validated use”, which is the only one worthy of high-risk conclusions; 2) focus on combination paths and final landing points (domain control? Database?) instead of CVSS average score; 3) check the scope of the test with ROE to cover cloud assets and API.

Professional position B(1) The Plan stage does not do anything without obtaining written approval, NIST writes this sentence in section I of the methodology; (2) the report is synchronized, with the cut-off, time-line, and recovery steps being kept on-site, and the subsequent recording is a mass disaster; and (3) the three main categories named by CVE-NIST are only misconfiguration (especially unsafe default values), internal nuclear defects, buffer zone spills, and most of the lines of defence in actual projects are the first.

Source: NIST SP 800-115 (2008-09), csrc.nist.gov/pubs/sp/800/115/final, PDF Sections 2.4.2, 4.3, 5.2.1 and Appendix B/F; cross-certificate: owasp.org WSTG project page, Pentest-standard.org. The definitions and assertions in the text are identified in the corresponding section of the original text.