BradEgeland.com
  • Welcome
  • Blog
  • Expertise
  • Resume
  • Software / Service Reviews
  • Contact
  • Videos
  • Books / White Papers
  • Mentoring Contact Form
  • Awards/Recognition
  • Templates & Downloads
  • Clients
  • Professional Services
  • Past Survey Results

Learn What A Vulnerability Scanner Is and How to Use It

4/26/2020

0 Comments

 
The looming specter of a data breach is enough to give most IT team members nightmares. Other than the potential financial losses that can come with a breach, it could be possible to lose business due to dwindling customer trust. Luckily, vulnerability databases such as the NVD are here to help. Companies can refer to them, identify vulnerabilities in their systems, and patch them before cybercriminals can even get their hands on this information.

Despite the presence of these databases, it is surprising to learn that 80% of enterprise applications still have at least a single unpatched vulnerability. Such a point of weakness is simply the sign of a data breach waiting to happen. With a vulnerability scan, however, your IT department can identify and patch vulnerabilities as well as come up with sustainable solutions.

Here is what to know about vulnerability scans and their use in building a strong cybersecurity posture:

What Is Vulnerability Scanning?In a nutshell, vulnerability scanning involves assessing your business’ systems for security issues. This includes systems like servers, virtual machines, laptops, desktops, firewalls, printers, switches, and containers. A vulnerability scanner will attempt to establish the operating system, software, open ports, and any user accounts that a scanned system contains. 

Once it is done building an inventory of your IT assets, the scanner will then compare every item in the inventory against the data in vulnerability databases to identify if any of these items have vulnerabilities. It is the role of your IT department to work on patching the vulnerabilities that demand attention. The comforting thing is that most of the vulnerabilities in these databases already have a patch, which you can apply to your affected systems.

Vulnerability Scanning Vs. Penetration TestingAlthough they are quite different, it is common for people to confuse vulnerability scanning with penetration testing. A vulnerability scan aims at identifying corporate systems that might be subject to already known vulnerabilities, while a penetration test aims at identifying weaknesses within your organizational processes and practices as well as specific system configurations that could easily be exploited by cybercriminals. Here are some of the practices that are involved in a penetration test, but aren’t done in a vulnerability scan:
  • Sending users phishing emails with the aim of accessing their accounts
  • Intercepting unencrypted passwords that are shared over the network and using them. 
  • Using other social engineering techniques to gain access to corporate accounts and data

The Vulnerability Management ProcessThere are four steps of vulnerability scanning, which include:

1. Identification of Vulnerabilities
In this part of the process, you will need to use a dependable vulnerability scanner to identify vulnerabilities in your system. The efficacy of your scanner will depend on:
  • Its ability to locate and gather system information about the different devices, software, and open ports, among other system devices. 
  • Its ability to compare this information against the information from one or multiple vulnerability databases

Since a vulnerability scan can easily affect the performance and stability of your system, you should consider configuring the scan to be less intrusive or aggressive. A good solution to this would be to conduct the vulnerability scan outside business hours, although this might limit the chances that employees will have connected their laptops to the network for the scan. 

Among the best ways to circumvent this challenge would be to conduct adaptive vulnerability scanning, which allows the scanner to identify changes to the network, such as when an employee connects their laptop to the system for the first time. In this situation, the scanner will launch automatically to scan the device instead of waiting for the next scan. To be safe, you should also consider creating a culture that makes reporting vulnerabilities easy. 

2. Evaluating the Risks
Vulnerability scans can present IT teams with a large number of vulnerabilities, which can be tiring to patch. Evaluating the risks posed by the vulnerabilities will help your team triage the vulnerabilities to identify those that need the most attention. With enough evaluation, your team will establish:
  • The potential impact of a vulnerability
  • The effectiveness of current security controls in dealing with the risk posed by the vulnerability
  • The practicality of hackers exploiting the vulnerability
  • Whether a vulnerability was a false positive or not

Ranking these vulnerabilities also ensure that IT and business resources are used optimally. 

3. Treating the Identified Vulnerabilities
In a perfect world, solving system vulnerabilities would be as easy as applying their ad hoc patches. Unfortunately, this option isn’t always available owing to limited business resources and premature vulnerability patches. Your IT team might need to look for other ways to circumvent the risk posed by the vulnerability. 

For instance, you can stop using the vulnerable system to mitigate the risk. You could also add other security controls to your existing ones to make it tough for hackers to exploit the vulnerability or reduce the impact that a successful exploit could have on your business. If the cost of mitigating the vulnerability is lower than the impact of a successful exploit, you should consider accepting/ignoring the vulnerability.

4. Report the Chosen Treatment Measures
Reporting these measures ensures that they are well-documented. IT teams and employees can refer to these documents whenever they need to access this information. The documents can also help with complying with regulations that require such reports. 
​

Vulnerability databases were created to make it easier for businesses to deal with known vulnerabilities. It would be a shame to have your business maimed by one. For the sake of your security posture, add vulnerability scans to your cybersecurity strategy, and enjoy using secure systems.

​
0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Author:

    Picture

    Brad Egeland


    Named the "#1 Provider of Project Management Content in the World," Brad Egeland has over 25 years of professional IT experience as a developer, manager, project manager, cybersecurity enthusiast, consultant and author.  He has written more than 8,000 expert online articles, eBooks, white papers and video articles for clients worldwide.  If you want Brad to write for your site, contact him. Want your content on this blog and promoted? Contact him. Looking for advice/menoring? Contact him.

    Picture
    Picture
    Picture
    Picture
    Picture
    Picture

    RSS Feed

    Archives

    December 2022
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    November 2018
    October 2018
    September 2018
    August 2018
    July 2018
    June 2018
    May 2018
    April 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    August 2017
    July 2017
    June 2017
    May 2017
    April 2017
    March 2017
    February 2017
    January 2017
    December 2016
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    February 2016
    January 2016
    December 2015
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015
    February 2015
    January 2015
    December 2014
    November 2014
    October 2014
    September 2014
    August 2014
    July 2014
    June 2014
    May 2014
    April 2014
    March 2014
    February 2014
    January 2014
    December 2013
    November 2013
    October 2013
    September 2013
    August 2013
    July 2013
    June 2013
    May 2013
    April 2013
    March 2013
    February 2013
    January 2013
    December 2012
    November 2012
    October 2012
    September 2012
    August 2012
    July 2012
    June 2012
    May 2012
    April 2012
    March 2012
    February 2012
    January 2012
    December 2011
    November 2011
    October 2011
    September 2011
    August 2011
    July 2011
    June 2011
    May 2011
    March 2011
    January 2011
    December 2010
    November 2010
    October 2010
    September 2010
    August 2010
    June 2010
    May 2010
    April 2010
    March 2010
    November 2009

    RSS Feed

Powered by Create your own unique website with customizable templates.