Risk Evaluation by Vulnerability Detection Tools for IT Department of the Royal Thai Army

摘要

Security is always a main concern in any organization networks. Securitytest is an important step to ensure that the organization network isregularly inspected and well prevented from attackers. However, audit and analysis are not only time-consuming procedure but also depended to human expertise. Automatic vulnerability detection ispreferred asa proactive tool for security professionals to identify vulnerabilities before an adversary can exploit them. Typically, there are two types of vulnerability detection tools: Hardware Appliances and Software Applications. However, vulnerability detection tools have some important weaknesses. They only identify surface vulnerabilities and are unable to address the overall risk level of the scanned network. Network risks arebasically divided into 4 levels. Nevertheless, they often use different standard for risk level classification whichhabitually related to some organizations or vendors. Henceforth, this paper presents "Network Risk Metric" as an unbiased risk evaluation from several vulnerability detection tools. In this paper, NetClarity (hardware-based) and Nessus (software-based) are implemented on two networks from an IT department of the Royal Thai Army (RTA). Then, the proposed metric is applied for evaluating overall network risk from both vulnerability detection tools.