Last updated on Jun 24, 2024

How do you perform a VA on a cloud-based database service?

A vulnerability assessment (VA) is a process of identifying and evaluating the potential risks and weaknesses of a system or network. A VA can help you improve your security posture, comply with regulations, and prevent data breaches. But how do you perform a VA on a cloud-based database service, such as AWS RDS, Azure SQL Database, or Google Cloud SQL? In this article, we will cover the main steps and best practices for conducting a VA on a cloud-based database service.

1 Choose a VA tool

The first step is to choose a VA tool that can scan and analyze your cloud-based database service. There are many tools available, both commercial and open source, that can perform VA on various types of databases. Some examples are Nmap, Nessus, SQLmap, Acunetix, and Qualys. You should choose a tool that supports your database platform, provides comprehensive and accurate reports, and integrates with your cloud provider's APIs and security features.

Add your perspective

Felipe Mafra

CISO North America at Hitachi Rail
Report contribution
The best is selecting a tool that can perform scan on multiple environments and is cloud-friendly. Triggering this type of scan from your physical appliance can affect the performance of your firewall and impact your business operations. Tools such as Qualys and Tenable has agents that could be installed on those servers and are capable to run multiple type of scans, such as OS, Data Base, ICS, and application. If you can't install agents, you can consider deploying virtual appliances on each network zone (usually those are included on common VA licenses). Always avoid triggering scans that transposes different network segments

Like

Unhelpful
William Songer

Providing comprehensive information systems security consulting, specializing in risk management, security planning, analysis, and incident response.
Report contribution
I've had good results using Nessus, it offers comprehensive coverage, gives accurate reports, regular updates, user-friendly interface, automation, strong community support, and regulatory compliance features. Its also has a reliability and proven track record make it highly recommended for vulnerability assessment and security management.

Like

Unhelpful

2 Configure the VA tool

The next step is to configure the VA tool according to your needs and preferences. You should set up the credentials, scope, schedule, and output format of the VA tool. You should also customize the scan settings, such as the level of detail, the types of vulnerabilities to look for, and the actions to take in case of a discovery. You should also ensure that the VA tool complies with the cloud provider's policies and limits, such as the number of requests, the bandwidth, and the impact on the performance and availability of the database service.

Add your perspective

Felipe Mafra

CISO North America at Hitachi Rail
Report contribution
Start reviewing the assets that you will include in your scope. You may consider start my adding agentless devices first by including your servers and exposed services (anything sitting on your VLAN) and expand to workstations once you are able to deploy the agents (unless your company is not favorable with that approach). Make sure you create groups or tags based on the asset objective (for example: External Facing, Data Base, Critical Service, Etc.) as this will help you on next few steps. You may start with unauthenticated scans first (based on the scenario that an attacker did not compromise any credentials).

Like

Unhelpful

3 Run the VA scan

The third step is to run the VA scan on your cloud-based database service. Depending on the size and complexity of your database, the scan may take from minutes to hours. You should monitor the progress and status of the scan, and check for any errors or warnings. You should also verify that the scan does not interfere with the normal operation of the database service, and that it does not trigger any false positives or false negatives.

Add your perspective

Felipe Mafra

CISO North America at Hitachi Rail
Report contribution
You can start with a few assets first and scale as you progress. You may consider scanning assets that are exposed to the internet, followed by critical and sensitive servers. Exposure to threats includes access from internal users. If you have sensitive assets that are used by several internal users, even if those are not directly accessible through the internet, you may also want to consider scanning workstations too. Remember that it requires one single exposed and vulnerable asset for an attacker to gain persistency and move laterally within your network

Like

Unhelpful

4 Review the VA report

The fourth step is to review the VA report generated by the tool. The report should provide you with a summary and a detailed breakdown of the vulnerabilities found in your cloud-based database service. You should analyze the report and prioritize the vulnerabilities based on their severity, impact, and likelihood of exploitation. You should also compare the report with your security baseline and benchmarks, and identify any gaps or deviations.

Add your perspective

Felipe Mafra

CISO North America at Hitachi Rail
Report contribution
As scans are performed, review results and compare progress of vulnerabilities that are remediated. Now, in order to keep your progress rolling you have two options: either you go and enable auto-patch, or work with asset owners on a very collaborative and #teamplayer approach otherwise you won't progress much.

Like

Unhelpful

5 Remediate the vulnerabilities

The fifth step is to remediate the vulnerabilities detected by the VA tool. You should follow the recommendations and guidance provided by the tool or by your cloud provider. You should also apply the best practices and standards for securing your cloud-based database service, such as encrypting data at rest and in transit, enforcing strong authentication and authorization, implementing backup and recovery strategies, and updating patches and configurations.

Add your perspective

Felipe Mafra

CISO North America at Hitachi Rail
Report contribution
This might be the most challenging activity, in especial on services that are directly related to an application. In some cases, remediation measures (such as patching) may generate an impact which would require a developer to modify the source code. In these cases, remediation work is always put aside. Use a risk-bases approach where you consider the exposure to threats, probability of attack based on how easy it is to exploit, and threat landscape. For example, you have an application that is critical to your business functionality, exposed to the internet, there are exploits available for that particular vulnerability, this should be priority number one. If devOps decides to not move ahead, C-level should sign a letter of risk acceptanc

Like

Unhelpful

6 Repeat the VA process

The final step is to repeat the VA process on a regular basis. You should schedule and perform VA scans periodically, or whenever there are changes or updates in your cloud-based database service. You should also review and update your VA tool settings, your security policies and procedures, and your remediation actions. By repeating the VA process, you can ensure that your cloud-based database service remains secure and resilient against threats and attacks.

Add your perspective