BAB 15 - ANALISIS KEAMANAN

Definisi

Jenis Security Assessment

Siklus Security Assessment

Testing Methodologies

Konsep Asset Identification

Identifikasi aset adalah langkah pertama dalam security assessment. Anda tidak bisa melindungi apa yang tidak Anda ketahui. Ini termasuk hardware, software, data, people, dan services.

Kategori Aset

Praktik: Asset Discovery Tools

Bash - Asset Discovery
# 1. Network discovery with Nmap
$ nmap -sn 192.168.1.0/24
# Find all live hosts in subnet

# 2. Detailed host discovery
$ nmap -sV -O 192.168.1.100
# Service version detection + OS detection

# 3. Find web servers
$ nmap -p 80,443,8080,8443 192.168.1.0/24

# 4. Network scanning with masscan (faster)
$ sudo masscan 192.168.1.0/24 -p1-65535 --rate=1000

# 5. DNS enumeration
$ dig example.com ANY
$ dnsrecon -d example.com

# 6. Subdomain enumeration
$ subfinder -d example.com
$ amass enum -d example.com

# 7. Asset inventory with Snipe-IT (open source)
# Web-based asset management system

# 8. Cloud asset discovery
$ aws ec2 describe-instances --query 'Reservations[*].Instances[*]'
$ az vm list --output table

Asset Inventory Template

Asset Inventory Template
# ============================================
# ASSET INVENTORY REGISTER
# Organization: Example Corp
# Date: 2026-09-09
# ============================================

Asset ID: AST-001
Name: Production Web Server
Type: Hardware / Server
Owner: IT Operations
Location: Data Center A, Rack 12
IP Address: 10.0.1.10
OS: Ubuntu 22.04 LTS
Services: Nginx, Node.js, PostgreSQL
Criticality: Critical
CIA Impact:
  - Confidentiality: High
  - Integrity: High
  - Availability: Critical
Data Classification: Confidential
Last Updated: 2026-09-09

# ============================================

Asset ID: AST-002
Name: Customer Database
Type: Information / Database
Owner: Database Team
Location: Cloud (AWS RDS)
Data Type: Customer PII, Transaction Data
Criticality: Critical
CIA Impact:
  - Confidentiality: Critical
  - Integrity: Critical
  - Availability: High
Data Classification: Restricted
Compliance: GDPR, PCI-DSS

Threat Identification

Threat identification adalah proses mengidentifikasi potensi ancaman terhadap aset. Ini termasuk threat actors, threat vectors, dan threat scenarios.

Jenis Threat

Threat Modeling

Threat modeling adalah pendekatan sistematis untuk mengidentifikasi threat. Metode populer:

STRIDE Methodology

Praktik: Threat Modeling Process

Threat Modeling Process
# 1. Define scope
# - What are we modeling? (web app, network, system)
# - What are the boundaries?

# 2. Create data flow diagram
# - Identify components (users, servers, databases)
# - Map data flows between components
# - Identify trust boundaries

# 3. Identify threats using STRIDE
# - For each component, ask:
#   - Can it be spoofed?
#   - Can data be tampered?
#   - Can actions be repudiated?
#   - Can info be disclosed?
#   - Can it be DoS'd?
#   - Can privilege be elevated?

# 4. Characterize and rank threats
# - Use DREAD model (Damage, Reproducibility,
#   Exploitability, Affected users, Discoverability)

# 5. Determine countermeasures
# - For each threat, identify mitigation

# 6. Validate and document
# - Review with stakeholders
# - Document in threat model report

Vulnerability Identification

Vulnerability adalah kelemahan dalam sistem yang bisa dieksploitasi oleh threat. Identifikasi vulnerability adalah proses menemukan kelemahan ini sebelum attacker menemukannya.

Jenis Vulnerability

Vulnerability Databases

Praktik: Vulnerability Scanning

Bash - Vulnerability Scanning
# 1. Nmap vulnerability scripts
$ nmap -sV --script vuln 192.168.1.100
# Run all vuln scripts against target

# 2. Nmap specific CVE check
$ nmap -sV --script vulners 192.168.1.100
# Check for known CVEs

# 3. OpenVAS (Open Vulnerability Assessment System)
$ sudo apt install openvas
$ sudo gvm-setup
$ sudo gvm-start
# Access web interface at https://localhost:9392

# 4. Nikto web scanner
$ nikto -h http://example.com
# Comprehensive web server scan

# 5. OWASP ZAP (Zed Attack Proxy)
$ zap.sh -cmd -quickurl http://example.com
# Automated web app scan

# 6. WPScan (WordPress scanner)
$ wpscan --url http://example.com --api-token YOUR_TOKEN

# 7. Nessus (commercial)
# Professional vulnerability scanner

# 8. Qualys (cloud-based)
# Cloud vulnerability management

CVSS Scoring

CVSS v3.1 Vector Example
# CVSS Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

# Breakdown:
AV:N  - Attack Vector: Network
AC:L  - Attack Complexity: Low
PR:N  - Privileges Required: None
UI:N  - User Interaction: None
S:U   - Scope: Unchanged
C:H   - Confidentiality Impact: High
I:H   - Integrity Impact: High
A:H   - Availability Impact: High

# Base Score: 9.8 (Critical)

# Example: SQL Injection vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
# Base Score: 9.1 (Critical)

Risk Assessment Concepts

Risk assessment adalah proses mengidentifikasi, menganalisis, dan mengevaluasi risiko untuk menentukan prioritas mitigasi. Risk = Threat × Vulnerability × Impact.

Risk Formula

Risk Calculation
# Basic formula:
Risk = Threat × Vulnerability × Impact

# More detailed:
Risk = Likelihood × Impact

# Where:
# Likelihood = Probability of threat exploiting vulnerability
# Impact = Consequence if risk materializes

# Quantitative approach:
ALE = SLE × ARO
# ALE = Annualized Loss Expectancy
# SLE = Single Loss Expectancy
# ARO = Annualized Rate of Occurrence

# Example:
# SLE = $100,000 (value of asset at risk)
# ARO = 0.1 (10% chance per year)
# ALE = $100,000 × 0.1 = $10,000/year

Risk Treatment Options

Praktik: Risk Assessment Template

Risk Assessment Template
# ============================================
# RISK ASSESSMENT REPORT
# Organization: Example Corp
# Date: 2026-09-09
# ============================================

Risk ID: RISK-001
Asset: Production Web Server (AST-001)
Threat: SQL Injection Attack
Vulnerability: CVE-2024-1234 (CVSS 9.8)
Likelihood: High (8/10)
Impact: Critical (10/10)
Risk Score: 80 (Critical)
Risk Level: Critical

Current Controls:
  - Web Application Firewall (WAF)
  - Input validation (partial)

Recommended Controls:
  - Implement parameterized queries
  - Conduct code review
  - Deploy advanced WAF rules
  - Regular security testing

Risk Treatment: Mitigate
Timeline: 30 days
Owner: Development Team
Cost: $15,000
Residual Risk: Low (after mitigation)

Reconnaissance & OSINT

Information gathering (reconnaissance) adalah tahap pertama dalam security assessment. Tujuannya mengumpulkan informasi tentang target sebanyak mungkin menggunakan teknik OSINT (Open Source Intelligence).

Types of Reconnaissance

Praktik: OSINT Tools

Bash - OSINT Tools
# 1. WHOIS lookup
$ whois example.com
# Get domain registration info

# 2. DNS enumeration
$ dig example.com ANY
$ dnsrecon -d example.com
$ theHarvester -d example.com -b all

# 3. Subdomain enumeration
$ subfinder -d example.com -o subdomains.txt
$ amass enum -d example.com
$ sublist3r -d example.com

# 4. Google dorking
# site:example.com filetype:pdf
# site:example.com inurl:admin
# site:example.com intitle:"index of"

# 5. Shodan search
$ shodan init YOUR_API_KEY
$ shodan search "hostname:example.com"

# 6. Email harvesting
$ theHarvester -d example.com -b linkedin
$ hunter.io - find email patterns

# 7. Social media OSINT
# Sherlock - find usernames across social media
$ sherlock username

# 8. Metadata extraction
$ exiftool image.jpg
# Extract metadata from images

# 9. Wayback Machine
# Check historical versions of website
# web.archive.org

# 10. Maltego (GUI tool)
# Visual OSINT investigation tool

Praktik: Google Dorking

Google Dorking Examples
# Find sensitive files
site:example.com filetype:pdf
site:example.com filetype:xls
site:example.com filetype:sql

# Find admin panels
site:example.com inurl:admin
site:example.com inurl:login
site:example.com intitle:"admin panel"

# Find directory listings