Automated security testing is a crucial component of software development and maintenance. With the increasing cyber threats, it is essential for organizations to regularly conduct security tests of their applications and infrastructure. One effective tool for this purpose is OpenVAS (Open Vulnerability Assessment System), an open-source platform for vulnerability scanning. In this article, we will focus on implementing automated security testing of applications on the CentOS 7 operating system using OpenVAS.

Installation of OpenVAS on CentOS 7

To begin, CentOS 7 must be installed and configured. Then follows the installation of OpenVAS. OpenVAS is not directly available in the CentOS base repositories, so it is necessary to add the required repositories:

1. Add the Atomicorp repository, which contains the OpenVAS package:

   sudo wget -q -O - https://www.atomicorp.com/installers/atomic | sudo sh
   ​

2. Install OpenVAS:

   sudo yum install openvas
   ​

After installation, initial setup and updating of the vulnerability database are required using the following commands:

Configuration of OpenVAS

Before running the first scan, OpenVAS needs to be configured. This step involves starting services, creating a user account, and configuring the firewall:

1. Start OpenVAS services:

   sudo systemctl start openvas-scanner
   sudo systemctl start openvas-manager
   sudo systemctl enable openvas-scanner
   sudo systemctl enable openvas-manager
   

2. Create a user account:

   sudo openvasmd --create-user=admin --role=Admin
   

3. Configure the firewall to allow access to the web interface:

   sudo firewall-cmd --permanent --add-port=9392/tcp
   sudo firewall-cmd --reload
   

Running and Working with OpenVAS

After completing the configuration, you can proceed to the actual testing. The OpenVAS web interface is accessible at https://[your-IP-address]:9392. Log in using the previously created login credentials.

1. Create a new task: Click on "New Task" and enter the necessary information such as the task name and scan target.
2. Start the scan: Once the task is created, you can start it. OpenVAS will perform a scan of the target and identify potential vulnerabilities.
3. Analyzing the results: After the scan is complete, review the results, which include information about identified vulnerabilities and recommendations for their remediation.

Automated security testing using OpenVAS on CentOS 7 provides an effective way to identify and address vulnerabilities in applications and infrastructure. Integrating OpenVAS into an organization's security strategy helps prevent security incidents by identifying weaknesses before potential attackers exploit them. While the setup and configuration process may be initially challenging, the benefits that OpenVAS brings in terms of improving security are invaluable.

It is important to recognize that no vulnerability scanning tool is complete or perfect. OpenVAS should be part of a broader security strategy that includes regular software updates, employee training in cybersecurity, and creating backups. Additionally, it is crucial to regularly analyze scan results and promptly respond to identified vulnerabilities.

Utilizing OpenVAS on CentOS 7 establishes a strong foundation for securing your IT systems. With regular scanning, proper configuration, and active vulnerability management, you can significantly reduce the risk of security threats and protect your digital assets.