Hello Youtubers, welcome to NET-SEC Youtube channel
This is Danny. In today's video, I'm gonna start to talk about Voluntary Assetment
We're gonna build Voluntary Assetment from Guardian Basque. We're gonna create some data scores
We're gonna identify the assessment scope and the wrong assessment. Then we need to view the results
Eventually, we're gonna do some inspection for the results. Here is the diagram I'm gonna use for today's lab
We have Guardian Standard 1. Guardian installed on IC192168.2.14. And we also have MSSQL, MySQL, SQL on Windows 2016 at 192168.2.13
This is our web grid. We're gonna do the assessment. Let's go to the Harden Voluntary Assessment
Before we can create the assessment, we have to define the data score
Create a new data score. We're gonna choose our application type, which is security assessment
We're gonna have a name. And we're gonna choose a database type, which is MSSQL server database
You can put some description. You can share your data score with other applications
We're gonna assign the credentials, of course. In this lab, we make it single and using a page
But if you have a specific username and password for your database, then you can put in here
And host the name of your database server, which is 192168.16. And of course, it's a standard code, 1433
You can put specific database here, or you can leave empty level scanning or database
It's your use of credential have permission to do. We will leave it default entity, so just send everything here
But then, it's your option. You can put that specific database here
So, you save first, and then you can test connection. And connection successful
Then, you save information, put it here. It's good. You can do assessment now
You can create a new assessment through the assessment builder
Click to this plus sign. Then, you need to put description. If you want to run a SQL server, create
We are not, we didn't create audit process yet, so it's very tempting
But you can, if you already have audit process, to generate report or sending emails
And then, you may want to choose your audit process here. It's false. That's the one you created
And then SQL, add it in. Great. Apply. That's pretty much it
But then, you need to define assessment test here, complete test. That's the scope, how many vulnerabilities you want to scan, how many tests you want to do
And the SQL server, at this moment, you see there's nothing empty
Because you just new scanned a new vulnerability assessment. You have to choose your type, your database type, which is NSSQL server in this one
And choose all of them. You can choose just some of them, but before, they want to assess all vulnerabilities here
Click add selection. Okay, all assessment or tests have been added in to this vulnerability assessment task
You can click return to go back. And then now, we already have our first security assessment
And we can run it now. So, assessment execution is added to the guardian job queue
You can check the job queue in the guardian job queue. You will see the status of your task
Okay, so now it's running. Sometimes you will see it's waiting if you have multiple tasks
It's waiting, and waiting status, and then now it's running. It's probably take a couple of minutes to get it done
It shouldn't take long. Our database is small. I cannot pause the video here until it's done
Okay, then, when a business assessment task has been completed, as you can see from here
you can keep refreshing your page until you get a completed status
Then, you can go back to assessment builder. Then, you can create a new job
So, the job page is opening, but the system is kind of busy
and they are generating this HTML page for you
Okay, since it's done, let's take a look. So, we get a task in passing 71%
That means 71% of tasks have been passed. So, we've got this nice diagram to show you the assessment default history
We only run the assessment once, so we only see a dot here that shows 71
Once you have multiple runs, you can see a nice curved diagram here
Then, you can show how you've improved or how your assessment score changes
So, you can download a PDF file, and then the one thing I would like to show you is filter feature here
You can click filter, and then you can change the scores. So, you only want to see the fail, the test
So, then you can just choose fail and apply it to it
Then, the page cannot be changed. It only shows your failed results here
which is only showing 40 results out of 262. That's what we want
And you also, I would like, most likely I would like to choose only critical and measurable to work on
and continue if we have so many. So, let me, oh, we only got 39 of them
So, that's the 39, which is a reasonable number to work after you did the first scan
One more thing I would like to mention here is that once you find out something
you want to exclude it from your scanning report. For example, a SQL Server patch level
You may not be able to patch it. It never takes time for testing, and then apply to the production environment
So, you may want to add the test instruction until your SQL DBAs are able to patch your SQL Server
So, you give them time. For example, you can give them to October 22nd, give them two months
and so until then, so you give a justification, DBAs are going to patch this on October 22nd
Save it. So, next time when you run this assessment, these findings, these failed findings are not shown in your report
That's basic steps you can do using one of these assessments. Thank you for watching