In this lesson,
we will explore different types of assessments
that help identify vulnerabilities
and improve security within an organization.
These assessments include network, wireless, application,
mobile, web, cloud, and API assessments,
each targeting specific aspects
of an organization's technology,
to uncover risk and suggest improvements.
First, we'll start with network assessments,
which are crucial for evaluating security
of an organization's entire network as a whole.
Network assessments systematically examine
both hardware and software components,
such as routers, switches, and firewalls,
to identify vulnerabilities
that could potentially provide paths for attackers
to gain unauthorized access to disrupt network services.
Now, these assessments include detailed inspections
of the network topology, firewall configurations,
and security policies to ensure that they align
with the best security practices.
Here, we're only going to focus on the devices
that actually route
and switch information on the network itself,
not any type of host.
Moving on to the wireless assessments,
which really focus on the security of wireless networks.
Now, given how common wireless technology is
and its inherent vulnerabilities such as weak encryption
and the presence of rogue access points,
wireless assessments are vital.
Assessors simulate attacks on wireless networks
to just understand the security gaps
and provide recommendations
to enhance wireless security protocols,
which protect against eavesdropping and unauthorized access.
Then we have application assessments,
which target the security of specific application,
whether developed in-house or acquired from third party.
These assessments scrutinize the application's code,
dependencies, and configurations for vulnerabilities
that could be exploited,
compromising the key pillars of cybersecurity,
which are data integrity,
confidentiality, and availability.
Now, these application assessments
are very important in the development lifecycle,
so we must ensure that the applications are secure,
both for deployment and compliant
with the relevant security standard.
Mobile assessments acknowledge
the unique security challenges posed by mobile computing.
Now, these assessments focus
on mobile applications and platforms,
evaluating security aspects such as data leaks
and proper session handling and insecure data storage.
With the high usage of mobile devices in the workplace,
securing mobile applications is of utmost importance
to protect sense of corporate data
and maintain regulatory compliance.
Then we have web assessments,
which focus on scrutinizing the web applications
and websites for vulnerabilities
such as SQL injections, cross-site scripting,
and security misconfigurations.
Given the internet-facing nature of web applications,
they are are common targets for attackers.
These assessments are essential for ensuring
that web applications do not provide a gateway
for attackers to access sensitive data.
Moving on, we have cloud assessments,
which evaluate the security posture
of cloud-based services and infrastructure.
With the increasing adoption of cloud computing,
it's important to assess the security controls
provided by cloud providers, such AWS and Azure,
and the configurations of those cloud resources.
Something like an S3 bucket.
Cloud assessments help identify misconfigurations
and compliance issues
that could lead to significant data breaches.
Now, it's important to get experts who specialize
with the specific cloud platform that the organization uses
because there are a lot of differences between them.
Lastly, API assessments focus on the security
of application programming interfaces,
which are critical for the integration
of different software systems and services.
These assessments aim to uncover vulnerabilities
in authentication, authorization,
and data validation processes that could be exploited
to gain unauthorized access to sensitive information.
API assessments are mainly geared towards organizations
that develop their own software
and rely heavily on their APIs
for their operational functionality
and data integration needs.
Each type of assessment-network, wireless, application,
mobile, web, cloud, and API-
target specific components
of an organization's technology ecosystem.
Now, they uncover vulnerabilities
that provide insights into strengthening the defenses.
As you continue throughout this course,
we will dive deeper into the specific types of attacks
that they are most vulnerable to and how to exploit them.
So, remember, using different cybersecurity assessments
allows organizations to fully understand
and mitigate the risk
associated with their additional environment.
These assessments not only safeguard information assets
against the evolving landscapes of cyber threats,
but also enhance the organization's resilience
against potential security breaches.