Risk
6/14/2010
02:35 PM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Vulnerability Scanners Must Be Used Carefully

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.Automated vulnerability scanners, both for network and Web app scans, have attracted a lot of attention lately, both because of their increasing capabilities and ease of use, as well as the growing role risk assessment plays in a thorough business defense strategy.

But just because vulnerability scanners are increasingly easy to use, that doesn't mean they're easy to use well. As with any tool, preparation, practice and proficiency have as much to do with effective vulnerability scans as the tools themselves.

A good new report exploring "The Truth About Vulnerability Scanners" gives a glimpse of some of the most common -- and most commonly mismanaged -- problem areas associated with vulnerability scanners:

Authentication: As with anti-virus definition list, vulnerability identification is only as good as the scanner's authenticated vulnerability list and the points where that list matches vulnerabilities in your company's systems and apps. Your IT team will need to put in the time studying potential vulnerability scanners' authentication tools.

Custom applications: If you're running custom or non-standard programs, be aware that the vulnerability scanner may not be able to detect problems.

Complex attacks and other security issues: Standardization enhances the automated aspects of scanning, but also renders off-the-shelf scanners unable to recognize complex threats and vulnerabilities. Again, your team will be configuring and tweaking a scanner both before and after using it.

Other potential problems include collisions with legacy hardware and software, interruptions of business traffic patterns and failure to inform key personnel that the scan is being run. Recently I took a look at some of these "Vulnerability Scan Do's And Don'ts" for Dark Reading's Vulnerability Management Center.

The complete "Scanning Reality: Limits Of Automated Vulnerability Scanners" report can be downloaded here. (Registration required.)

Don't Miss: SMB Security: Fight The Right Fight

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web