What is Vulnerability Scanning?
For organizations in need of quantifying their exposure to surface level risks, vulnerability scanning can be a cost-effective method of discovering available attack vectors, albeit with some shortcomings that are important to understand.
First, a vulnerability scan is not equivalent to a network penetration test. In a pen test, vulnerabilities are not only discovered, but they are also exploited and re-exploited, if possible, in the name of discovering all potential damage a harmful actor could do if able to gain access to an organization’s network.
Such testing is carried out by a live specialist – in our case here at Cynexlink, by our Certified Ethical Hacker (CEH) – who thinks and acts like an intruder.
Vulnerability scans, on the other hand, are typically run via automated programs. While these scans can be effective at performing network discovery, identifying open ports, missing patches, misconfigurations and more, it should also be remembered that such scans only uncover surface vulnerabilities – those weaknesses that exist in isolation, independent from other weak spots.
Unfortunately, vulnerabilities rarely exist in isolation. Indeed, a string of seemingly low-level individual risks could leave a gaping security hole while leaving the scanned organization falsely confident in its risk profile.
Out-of-date signature repositories and the ability of network-based scanning solutions to run only on active systems are further drawbacks, which means poorly established vulnerability scans can either be inaccurate or more labor-intensive than imagined.
If run by an experienced provider who knows how to avoid the potholes mentioned above, however, vulnerability scanning can indeed provide great cybersecurity bang-for-the-buck.
Here are five rules for ensuring a positive outcome with vulnerability scanning :
- Scan All Network Assets
Make sure to scan each device and access points within your network ecosystem. Assessing all assets within the system helps expose various loopholes within the infrastructure and lets you create solutions accordingly. Moreover, create an inventory list including all network assets regardless of their function, and determine which target to be scanned from your inventory.
- Scan Frequently
The gap between the scans can be critical as this time interval leaves your systems exposed to new threats. Scanning can be done weekly, monthly, or quarterly. If done frequently, not every network device is required to be scanned, minimizing the time and effort while providing layered network coverage. Your network architecture and device impact are factors that help determine scanning intervals.
- Set Accountability
Create asset owners or asset supervisors to create accountability. For example, roles can be designed to protect specific devices and take actions in the event of a data incident. However, asset owners shouldn’t be confined to tech teams; business owners can also oversee some systems.
- Run Patching Process
Patching internet-enabled equipment for all discovered vulnerabilities is more crucial than patching similar devices that have already been blocked by firewalls or settings. This is a time-management practice that can be needed due to resource limitations and it is essential to focus on assets that provide the highest risk levels to the enterprise.
- Document All Scans and Their Results:
Make sure to document all scans and their outcomes. Every vulnerability scan should be scheduled utilizing a management-approved timetable, with an audit process set to provide detailed reporting. By documenting the scan run according to a timetable, companies can monitor vulnerability trends and issues, identifying susceptible systems and creating accountability.
Interested in learning more about how Cynexlink provides pen testing and vulnerability scanning solutions for companies of all sizes? Contact us to learn more!