This when you we're going to talk about vulnerability assessment and penetration testing and what they
are before I start I just want to refresh your mind about what we talked about in the previous video
about or WAMC or US Top 10.
So all of us is the organization that basically pro-white a list of application or verification will
abilities and the top 10 list is basically the most common abilities that you can find applications
on verifications.
So you could go to war w a speedboat or to check the top 10 which is this is the most current one.
2017 what you would find in there is actually talking about applications security risks which kind of
is a bit confusing but I'm going to explain to you guys the differences between risks and abilities
and threats in a second and basically understanding what could become a risk.
So the list that you see in here are basically vulnerabilities not necessarily risks but I'm just going
to explain that in a second.
Let's start with some definition around threats vulnerabilities and risks.
So threats basically are things that potential to cause serious harm to computer system to an application
to basically a server or anything like that.
Well notability on the other hand is a weakness on the system that can be exploited by a threat actor.
So the combination of a threat and gullibility is what we call a risk.
So unless we have both threats and Woolner abilities this is not really considered a risk so just to
give you an example if we have the ability on a web server like in our area server around basic cotton
occasion and the application that we have is not using basic authentication on all of our users are
using different type of indication.
That really is not a threat for our application.
It could be really considered a very low risk because we're not really using that functionality.
So just keep that in mind.
Combination of threat of more liability is what we call risk but your assessment is basically a process
of identifying measuring and prioritizing abilities in a particular system network application whether
we're your caller there is really no harm to the system.
There might be some obviously performance drop and impact on the performance but we're not really changing
anything on the system so it's a risk free test.
And as I explained before I founda vulnerability might or might not be really a risk depending on how
we are using it.
So that needs to be assessed properly.
And this is an essential step before we start doing proper penetration testing what is penetration testing
and other hand so penetration testing is the process of testing and evaluating found Will abilities
for exploitation.
So we want to understand whether those vulnerabilities that we found are exploitable or not.
So that is where we actually find proper risk this could harm system this could harm their applications
and their operations.
Successful exploitation obviously consider the risk.
As I explained and it is much more accurate once we know that it is exploitable than just vulnerability
assessment and it could have obviously legal consequences I explained before that this has to be done
only under appropriate agreements and contractual agreements and non-disclosure agreements and it must
not be done without any of those.
So keep in mind ethical hacking or penetration I think is more than just vulnerability assessment and
the goal is to provide the customer report which is accurate and they can basically use that report
to basically move towards more security on their applications and or their environment.
And the next when you we're going to talk about ethical hacker responsibilities a little bit.
Thank you for watching this video and I will be with you in the next one.