Welcome Guest. | Log In| Register | Membership Benefits
Dark Reading's Security Views Weblog
Topics:   Security Views : Vulnerability Management Tech Center

  • Email this page E-mail this page
  • |  Print this page Print this page
  • |  Bookmark and Share

Getting To Know Your Infrastructure


Posted by Wolfgang Kandek, Oct 29, 2009 08:09 PM

Knowing your network is a fundamental step for building a successful vulnerability management (VM) project. You cannot manage what you don't know, so one of the first things to do when starting your VM project is to map the networks that you will be dealing with. Mapping (or enumerating) all devices on the network will give you an overview on the total number of equipment and further insight into the types of systems present, including routers, switches, Unix and Linux systems, Windows servers, and Windows workstations. This map will then be your basis for identifying machine owners, machine functions and level of importance to the organization and will allow you to group machines according to:
  • Locality, for example the machine belongs to the North America DMZ
  • Type, all Windows servers
  • Function, all Accounting machines
and even combinations, such as all Windows servers in Accounting. The groups can then be used to define a scanning strategy -- i.e. weekly on Windows workstations and daily on DMZ servers and further to verify the adherence to a fixing/patching schedule for each of the groups, for example immediate on Windows desktops and three days after QA approval for DMZ servers.

Map data can also be used to detect changes in your network. By comparing the results of two maps and detecting the differences, you can focus efforts on new systems that have entered the network and make sure that they are not rogue devices that were placed on the network without proper validation, which can easily become a point of entry for attackers.

Today, all commercial vulnerability management tools allow the user to perform such maps and use the results to build a baseline for the network. In addition, there are a number of open source tools that can be used to perform the same function. Nmap is a probably the most widely known tool for mapping and Gordon Lyon’s book has excellent explanations of the various parameters available for mapping, including protocols, ports and timeouts. There are also a number of online tutorials available that can help determining the right setup.

-- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: http://www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

« The Dirty Dozen Spam Relaying Countries -- And How Zombie Armies Help Them | Main | LinkedIN With 'Bill Gates' »



Sign up now for the weekly InformationWeek Blog Newsletter.


This is a public forum. United Business Media and its affiliates are not responsible for and do not control what is posted herein. United Business Media makes no warranties or guarantees concerning any advice dispensed by its staff members or readers.

Community standards in this comment area do not permit hate language, excessive profanity, or other patently offensive language. Please be aware that all information posted to this comment area becomes the property of United Business Media LLC and may be edited and republished in print or electronic format as outlined in United Business Media's Terms of Service.

Important Note: This comment area is NOT intended for commercial messages or solicitations of business.