Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Security Assessment and *nix Package Vulnerabilities
Blekinge Institute of Technology, Faculty of Computing, Department of Computer Science and Engineering.
2018 (English)Independent thesis Basic level (degree of Bachelor), 10 credits / 15 HE creditsStudent thesis
Abstract [en]

Background. Vulnerabilities in software provides attackers with the means to fulfill unlawful behavior. Since software has so much power, gaining control over vulnerabilities can mean that an attacker gains unauthorized powers. Since vulnerabilities are the keys that let attackers attack, vulnerabilities must be discovered and mitigated. Scanning vulnerable machines is not enough, and scanning data results must be parsed to prioritize vulnerability mitigation and conduct security assessment. Objectives. Creating a parser is the first objective, a tool that takes in input, filters it and gives output specified by the parser. The second objective is to have the parser connect found packages to known vulnerabilities. And the last objective is to have the parser give the output more information, sort them by severity and give information on what areas they are vulnerable. Methods. The interviews are conducted on experienced employees at Truesec AB. A parser is implemented with guidance from the supervisor at Truesec. The parser is experimented with to check practicality of parser. Results. The parser can find vulnerabilities from the Centos tests and does not find any from the Debian tests. From the interviews, we see that more information strengthens a security assessment. Expanding the scanning results will provide more information to the person(s) conducting security assessment. Conclusions. The amount of information gathered in security assessment needs to be expanded to make the assessment more reliable. Packages found can be connected with vulnerabilities by implementing a vulnerability database to match packages. The parser developed does not help in security assessment since the output is not reliable enough, this is caused by the phenomenon backporting.

Place, publisher, year, edition, pages
2018. , p. 31
Keywords [en]
*nix, Vulnerabilities, Parsing, IT-security, Mitigation
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:bth-16723OAI: oai:DiVA.org:bth-16723DiVA, id: diva2:1230515
External cooperation
Truesec
Subject / course
DV1478 Bachelor Thesis in Computer Science
Educational program
DVGIS Security Engineering
Supervisors
Examiners
Available from: 2018-07-04 Created: 2018-07-03 Last updated: 2018-07-04Bibliographically approved

Open Access in DiVA

BTH2018Sandgren(379 kB)16 downloads
File information
File name FULLTEXT01.pdfFile size 379 kBChecksum SHA-512
0edf644942c0b3e98942dc60d6bcac290b98b268556a0b5b987c7a206feab0e805e313d70719f8f2c9a871e73bc3a58b14eae76e655e73f659a61902804a7b9d
Type fulltextMimetype application/pdf

By organisation
Department of Computer Science and Engineering
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar
Total: 16 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

urn-nbn

Altmetric score

urn-nbn
Total: 24 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf