Risk
6/14/2010
02:35 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Vulnerability Scanners Must Be Used Carefully

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.Automated vulnerability scanners, both for network and Web app scans, have attracted a lot of attention lately, both because of their increasing capabilities and ease of use, as well as the growing role risk assessment plays in a thorough business defense strategy.

But just because vulnerability scanners are increasingly easy to use, that doesn't mean they're easy to use well. As with any tool, preparation, practice and proficiency have as much to do with effective vulnerability scans as the tools themselves.

A good new report exploring "The Truth About Vulnerability Scanners" gives a glimpse of some of the most common -- and most commonly mismanaged -- problem areas associated with vulnerability scanners:

Authentication: As with anti-virus definition list, vulnerability identification is only as good as the scanner's authenticated vulnerability list and the points where that list matches vulnerabilities in your company's systems and apps. Your IT team will need to put in the time studying potential vulnerability scanners' authentication tools.

Custom applications: If you're running custom or non-standard programs, be aware that the vulnerability scanner may not be able to detect problems.

Complex attacks and other security issues: Standardization enhances the automated aspects of scanning, but also renders off-the-shelf scanners unable to recognize complex threats and vulnerabilities. Again, your team will be configuring and tweaking a scanner both before and after using it.

Other potential problems include collisions with legacy hardware and software, interruptions of business traffic patterns and failure to inform key personnel that the scan is being run. Recently I took a look at some of these "Vulnerability Scan Do's And Don'ts" for Dark Reading's Vulnerability Management Center.

The complete "Scanning Reality: Limits Of Automated Vulnerability Scanners" report can be downloaded here. (Registration required.)

Don't Miss: SMB Security: Fight The Right Fight

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9605
Published: 2015-09-04
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webup...

CVE-2015-5612
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.

CVE-2015-5688
Published: 2015-09-04
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

CVE-2015-6807
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label.

CVE-2015-6808
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.