Risk
6/14/2010
02:35 PM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Vulnerability Scanners Must Be Used Carefully

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.Automated vulnerability scanners, both for network and Web app scans, have attracted a lot of attention lately, both because of their increasing capabilities and ease of use, as well as the growing role risk assessment plays in a thorough business defense strategy.

But just because vulnerability scanners are increasingly easy to use, that doesn't mean they're easy to use well. As with any tool, preparation, practice and proficiency have as much to do with effective vulnerability scans as the tools themselves.

A good new report exploring "The Truth About Vulnerability Scanners" gives a glimpse of some of the most common -- and most commonly mismanaged -- problem areas associated with vulnerability scanners:

Authentication: As with anti-virus definition list, vulnerability identification is only as good as the scanner's authenticated vulnerability list and the points where that list matches vulnerabilities in your company's systems and apps. Your IT team will need to put in the time studying potential vulnerability scanners' authentication tools.

Custom applications: If you're running custom or non-standard programs, be aware that the vulnerability scanner may not be able to detect problems.

Complex attacks and other security issues: Standardization enhances the automated aspects of scanning, but also renders off-the-shelf scanners unable to recognize complex threats and vulnerabilities. Again, your team will be configuring and tweaking a scanner both before and after using it.

Other potential problems include collisions with legacy hardware and software, interruptions of business traffic patterns and failure to inform key personnel that the scan is being run. Recently I took a look at some of these "Vulnerability Scan Do's And Don'ts" for Dark Reading's Vulnerability Management Center.

The complete "Scanning Reality: Limits Of Automated Vulnerability Scanners" report can be downloaded here. (Registration required.)

Don't Miss: SMB Security: Fight The Right Fight

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant