Risk
6/14/2010
02:35 PM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Vulnerability Scanners Must Be Used Carefully

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.Automated vulnerability scanners, both for network and Web app scans, have attracted a lot of attention lately, both because of their increasing capabilities and ease of use, as well as the growing role risk assessment plays in a thorough business defense strategy.

But just because vulnerability scanners are increasingly easy to use, that doesn't mean they're easy to use well. As with any tool, preparation, practice and proficiency have as much to do with effective vulnerability scans as the tools themselves.

A good new report exploring "The Truth About Vulnerability Scanners" gives a glimpse of some of the most common -- and most commonly mismanaged -- problem areas associated with vulnerability scanners:

Authentication: As with anti-virus definition list, vulnerability identification is only as good as the scanner's authenticated vulnerability list and the points where that list matches vulnerabilities in your company's systems and apps. Your IT team will need to put in the time studying potential vulnerability scanners' authentication tools.

Custom applications: If you're running custom or non-standard programs, be aware that the vulnerability scanner may not be able to detect problems.

Complex attacks and other security issues: Standardization enhances the automated aspects of scanning, but also renders off-the-shelf scanners unable to recognize complex threats and vulnerabilities. Again, your team will be configuring and tweaking a scanner both before and after using it.

Other potential problems include collisions with legacy hardware and software, interruptions of business traffic patterns and failure to inform key personnel that the scan is being run. Recently I took a look at some of these "Vulnerability Scan Do's And Don'ts" for Dark Reading's Vulnerability Management Center.

The complete "Scanning Reality: Limits Of Automated Vulnerability Scanners" report can be downloaded here. (Registration required.)

Don't Miss: SMB Security: Fight The Right Fight

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio