Analytics
5/21/2010
02:10 PM
Connect Directly
RSS
E-Mail
50%
50%

Vulnerability Scanning Do's And Don'ts

Legacy hardware, software, traffic patterns among critical vulnerability scanner considerations

In vulnerability assessment scanning, preparation and planning can make the difference between an accurate and illuminating scan and a big IT headache. Failure to account for and accommodate legacy hardware and software, port management strategies, traffic patterns, and usage schedules can all contribute to a vulnerability scan that has the potential for causing as many problems as it identifies.

Yet the sheer variety of easy-to-install, point-and-click vulnerability scanners on both the commercial and free open-source markets that has helped make vulnerability scanning a near-ubiquitous tool for security-conscious businesses could itself contribute to a false sense of security and system safety when launching a scanner for the first time.

"Today's scanners are generally delivered with the best generic settings for most environments they'll be used in," says security consultant Chris Nickerson. Even so, a business isn't a generic commodity, he says.

That is why leading scanners include customization and tweaking tools, as well as plug-ins and add-ons that enable you to craft and tailor your vulnerability scan for your business' specific nature and operations. Tenable's Nessus, for instance, has more than 36,000 plug-ins.

That nature might well include legacy hardware and, in some industries (financial services, for example), lots of legacy hardware. Approaching big iron, a z/OS, or AS400 box, for instance, with a vulnerability scan calls for caution, lest the scan collide with the legacy machine's own approaches to port management and binding.

The consequences of such collisions can include connection hang-ups while waiting for responses, ports hanging up while waiting for connections, and, worst case, system crashes. In a post about new challenges that cloud computing brings to vulnerability assessment, security blogger Craig Balding offered this observation applicable to all vulnerability assessment tools: "If the scanning policy includes Denial of Service checks or the scanning engine is configured with 'aggressive' settings; e.g. connection entries in firewall state tables get exhausted. It's also possible for scans to tickle obscure bugs in the target -- or devices en route to the target."

The solution? Take it slow and take one (or a few) step at a time, particularly when launching vulnerability scans or a new scanner for the first time.

"Segment your risk," Nickerson advises. "Test and tune the scanner for the environment it will be used in and tackle the scan surgically, rather than a shotgun, all-at-once approach. If the default out-of-the-box scan tests 24 hosts at a time, try it with five hosts firsts. Break your hosts into manageable and actionable boxes before turning loose the hounds."

Steve Stasiukonis, founder and vice president of Secure Network Technologies, recommends setting up closed, test-bed environments if possible or practicable. "If you're aware of the potential harm an untested scan can create, you can easily see the benefit of running the scan first against a system that's not involved in business production," he says.

Likewise, critical business traffic and traffic patterns need to be factored into vulnerability scans because the scan itself will add to network traffic. The scan needs to be scheduled for minimal traffic impact, so don't launch a major scan of retail servers at the height of the holiday purchasing rush.

"Even without a full-on outage, poorly configured scans can still negatively impact performance or availability for other customers of shared infrastructure," Balding observed in his blog.

Understanding the nature of the business, the business' traffic patterns, and, crucially, communicating and coordinating with key business personnel are all keys to both an effective and nondisruptive vulnerability scan.

Scans and their effects are liable to set off alarms and key-person notifications. "Give some thought to what time your scans will be run and also to what time zone affected businesses operate in," Stasiukonis says. "Don't surprise someone on the West Coast with a 5 a.m. alert that you scheduled to run at 8 a.m. on the East Coast."

All of these considerations need to be factored in not only before launching a scan, but also before selecting the scanner you'll be launching.

The integration of vulnerability assessment scanning with penetration testing and other security tools will likely be accompanied by further refinements of interfaces, dashboards, and ease-of-use considerations.

And that is all for the good, so long as you bear in mind that the ease-of-use tools for major vulnerability include a wide array of customizations and add-ins.

"Use them," Nickerson says. "And use them before buying a scanning tool. Test the various scanners you're considering, and test them against the environment they'll be scanning. Make sure that the scanner you choose is the right tool for the environment you're choosing it for."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4013
Published: 2014-07-14
SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through 6.1.4.61696, 6.2.x through 6.2.6.62196, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-4944
Published: 2014-07-14
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.

CVE-2014-4945
Published: 2014-07-14
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.

CVE-2014-4946
Published: 2014-07-14
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.

CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.