脆弱性診断
(GMOサイバーセキュリティ byイエラエ)

What is a vulnerability?

Vulnerabilities are information security flaws and weaknesses hidden in web applications, smartphone apps, software, cloud platforms, etc.
Vulnerabilities can be caused by a variety of causes, including bugs in the software, improper configuration, poor security policies, and unauthorized operations.

Background to the need for vulnerability assessment

Financial damage or loss of credibility

If the vulnerability is left unaddressed, it can be exploited when targeted by an attacker, resulting in website tampering, unauthorized access, leakage of important information such as personal information, credit card information, and confidential information, and intrusion into the corporate network. Such events can result in financial damage or damage to the reputation and goodwill of individuals and companies. In order to prevent such vulnerabilities from being exploited, it is desirable to conduct vulnerability assessments of systems every quarter ~ one year.

Examples of financial damage risk

Liability Risk

Risk of being claimed for damages due to leakage of customer information or system outage due to cyber attack

Cost Risk

Risks related to investigating the cause and scope of damage caused by cyberattacks, recovery, and implementation of measures to prevent recurrence

Profit Risk

Risk of suspension of the company's business and loss of profits until countermeasures are taken due to cyber attacks

Purpose of vulnerability assessment (risk and impact assessment)

The purpose of vulnerability assessment is to find vulnerabilities in systems, software, etc., and to assess their risks and impact.
In addition, by fixing vulnerabilities that are judged to be high-risk and have a high impact, it is possible to improve system security and prevent damage from exploitation.
As mentioned above, if a vulnerability is left unaddressed, it can be exploited by malicious actors and lead to financial damage and loss of trust. Before that happens, you need to identify vulnerabilities and fix them to keep your system secure.

EC事業者のセキュリティ対策について

割賦販売法に規定するセキュリティ対策義務の実務指針である「クレジットカード・セキュリティガイドライン」では以下のように方針が記載されています。
EC業界では脆弱性診断を含む基本的なセキュリティ対策の実施を必須化する動きがあることをご認識ください。

• 現状：セキュリティ対策実施状況の申告(試行)

  全てのEC加盟店は、新規加盟店契約の申込み前に自らセキュリティ対策を実施し、契約申込みの際にカード会社（アクワイアラー）又はPSP（決済代行会社）にその実施状況を申告し、カード会社（アクワイアラー）と加盟店契約を締結することが求められる

• 今後：基本的なセキュリティ対策の必須化

  「クレジットカード決済システムのセキュリティ対策強化検討会報告書」（2023 年 1 月 20 日） において、EC加盟店の漏えい対策の強化のための当面の対応として、EC加盟店のシステム、ECサイト自体の脆弱性対策（システム上の設定の不備への対策（PW 管理等）、脆弱性診断・ 対策、ウイルス対策等）の基本的なセキュリティ対策を必須とすることを2024年度末までに本ガイドラインに追記することが求められている。

Types of vulnerability assessments and what to diagnose

Types of vulnerability assessments

Vulnerability Assessment can be conducted in the following ways:

1. 自動診断：自動化されたツールを使用してネットワークやシステムをスキャンして既知の脆弱性を検出する手法
2. 手動診断：専門家が手動で特徴的なパターンを利用して脆弱性を見つける手法
3. ハイブリッド：ツールを使用しつつ手動でも脆弱性診断を行うハイブリッドな手法

Target of vulnerability assessment

The scope of vulnerability diagnosis is expanding more and more due to the emergence of new technologies such as web applications, smartphone applications, PC software, middleware, OS, network equipment, cloud platforms, IoT devices, and smart contracts used in blockchains.

Differences from penetration testing

Vulnerability assessment and penetration testing are both methods of assessing the security of a system, but they have different goals and approaches.
While vulnerability diagnosis aims to visualize the presence or absence of vulnerabilities, penetration testing finds vulnerabilities and verifies whether they can actually be exploited.

Features of GMO Cybersecurity by Yerae

Highest quality at the lowest price

Engineers belonging to GMO Cybersecurity by Yerae have participated in hacking contests held around the world and have achieved good results.
By continuing to update the latest and more sophisticated hacking technology, we are able to propose specific protection technologies and methods that companies need from the perspective of attackers.
In addition, we have realized that we can provide diagnostic technology at an inexpensive price by effectively utilizing the asset of abundant diagnostic Actual and improving work efficiency using AI.

*情報セキュリティのスキルを競うコンテスト

How to choose a vulnerability assessment related service

【By request】Developer service lineup

* Web application diagnosis and diagnosis content are equivalent.

• お問合せはこちら

Simple Diagnosis Service "GMO Cyber Attack Net de Diagnosis"

GMOサイバー攻撃 ネットde診断は経産省が推奨するASM(Attack Surface Management)にカテゴライズされるツールです。 安価かつ手軽に脆弱性を可視化し対処法まで把握することができるため、何から手をつけていいかわからない、対策にかける予算がないといった課題にお応えすることが可能です。

• お問合せはこちら