Vulnerability Assessment
The remote database server of the e-commerce company I worked for has been open to the public since the company's launch, which was a serious vulnerability.
So I was tasked to conduct a vulnerability assessment of the situation to communicate the potential risks to decision makers at the company.
Following the guidelines and recommendations given in the NIST SP 800-30 Rev. 1, I conducted the vulnerability assessment and provided a written report where I documented the identified potential threat sources, threat events and also calculated the risk of potential threats.
In my security recommendation, I proposed both remediation and mitigation strategies for example implementation of controls such as Principle of least privilege, Defense in depth, Multi-factor authentication (MFA), Authentication, Authorization, Accounting (AAA) framework etc. which provided the stakeholders with actionable steps that can be taken to remediate, or fix vulnerabilities to avoid threats.
