Vulnerability Scans

One of the primary ways that we find vulnerabilities is through vulnerability scanning. There are a lot of different approaches of how we can do vulnerability scanning. One of the ways is we can install vulnerability scanning software somewhere on our network. It would do a scan of the network and discover a bunch of the devices that are on our network, and then scan those devices for vulnerabilities.

Vulnerability Scanning Software

When it comes to vulnerability scanning software, there's a lot of options out there. Some examples of companies that make vulnerability scanning software would be Nessus, Rapid7, Qualys and Tripwire. There are also open-source vulnerability scanning software out there, such as OpenVAS.

I jumped on the OpenVAS website here, openvas.org, where we see the Open Vulnerability Assessment Scanner, or OpenVAS. This is a free open-source option for installing on your network and doing vulnerability scans. I also pulled up the Tenable website. Tenable is the company, and they make this product Nessus, which is a vulnerability scanning software, so this is another great way to go for doing vulnerability scans on your network. Another example is Nexpose. Nexpose is Rapid7, and this is one that I've used in the past on the networks that I've managed.

Deployment Options

Many of these options have different ways you can utilize the software. For instance, some of them have where you can download it locally and utilize it locally, so you would install it on one of your local servers. That has the advantage of having all of your security aspects of it installed locally, and it never going out to the cloud, never getting exposed to the outside. So that's one option, is just to have the software local.

There are also hosted options where they have software as a service. It's running up in the cloud and you're utilizing those services in the cloud to do some of the scanning. Sometimes we do have to install some sort of local agent in order to do local scans, but not all the time, depending on what type of scans you're doing. Another option is a hybrid, where you have some services locally and then you have some services in the cloud.

There are also services you could subscribe to that do the scanning for you, so you just turn it over to another company that will utilize this software, the same software that we're talking about. But we're going to subscribe to a service, they're going to help us set up everything and monitor everything. Maybe we're actually using some sort of security operations center and they are monitoring it live, and as part of those services they're doing vulnerability scans for us.

Where the List of Vulnerabilities Comes From

Now, these vulnerability scans are going to scan our network, or our devices, or however we set them up. It's going to scan that for vulnerabilities, but somehow it needs to get a list of vulnerabilities. A lot of these companies will have some sort of proprietary list that they've created that they're scanning your network against, and so that's what they're finding. But they're pulling these from a lot of different sources. Maybe it's their own research. They're definitely using some open source intelligence. They're using some information sharing organizations. They're using the dark web. And they're pulling that all together for their proprietary list, and that list is what they're scanning your network for, the list of vulnerabilities that they have pulled together.

Setting Up the Scan

There are a lot of ways that we can set up vulnerability scanning. For instance, what is the scope? Is it going to be internal or external? Are we going to set it up to be active or passive? Are we going to use credentials or no credentials? Are we going to use agent or agentless? What are the sensitivity levels that we're going to use when we set up vulnerability scanning?

If it's external, we could just be hitting externally. We could be hitting an IP address and looking at that IP address to see if there's any vulnerabilities based off of that IP address, and what are the open ports to it. Or we could be looking at specific applications and web applications and websites, and doing scans based off of maybe URLs. We also have internally, we could be looking at the network and the infrastructure, or maybe there's specific applications or web apps that we're scanning. It could be software or devices that we're scanning on our network.

Reporting and Scoring

After the scan, it's going to have some sort of dashboard or reporting that's going to show you all of your vulnerabilities. It also is going to have some sort of scoring with it, and trend lines, and a bunch of data that's associated with these reports. So it's a great way to find out what's really going on on your network. They'll also use that scoring and ranking in order to score or rank this, so we'll get an actual number that's associated with it, or we'll get some sort of ranking of, is it informational, low, medium, high or critical, as far as what is the importance that we do away with this vulnerability and how critical that vulnerability is.

Standards and Compliance

A lot of times we measure up against some sort of standards. For instance, maybe there's some sort of regulatory standards that we need to comply with. So we may, number one, choose some sort of standard as a measuring stick that will determine what our scans look like. So we may do certain types of scans because of the different regulatory compliance. But the other thing too is we may just do a full vulnerability scan of our network and determine what our vulnerabilities are, and then that will help measure up against these standards. So I like to think of it as both: these standards will shape what we are looking for on our network and what our vulnerability scans actually look like, but also whatever our results are, we're going to compare against our regulatory compliance to see if we comply.

Some of those standards could come from baselines out there, just created baselines that we can measure against. There are also, like I mentioned, regulatory compliance, and there's industry frameworks. A great example of this is the Payment Card Industry Data Security Standards, the PCI DSS. So if we are processing credit cards, then we're going to have to comply with that. So we are going to scan our network based off of our compliance requirements for this, but also we're going to compare to see if we're meeting that standard and make sure that we have that all incorporated in there.

Other standards that we might see out there is the Center for Internet Security, CIS, benchmarks. We could also OWASP, or Open Web Application Security Program, and ISO 27000, or the International Organization for Standardization. This is the organization right here, and then the 27000 series is the one that we would utilize as the benchmark for our standard for scanning our network.

Here's the PCI Security Standards Council, who sets up the PCI Data Security Standards, or PCI DSS, and here's some information on it. They have a whole document library where you can actually download the different standards here. So if you want to see it as a PDF here, then you could actually download the standards, and it'll be like a check-off list of things on your network. We can use it as a standard for vulnerability scanning.

Other Considerations

There is quite a few different considerations when we're setting up vulnerability scanning: things like performance, bandwidth limitations, scheduling operations, and there are some considerations on whether we do query throttling or segmentation. So there are considerations when it goes into what are the settings and what is the scope.