Analytics
5/21/2010
02:10 PM
Connect Directly
RSS
E-Mail
50%
50%

Vulnerability Scanning Do's And Don'ts

Legacy hardware, software, traffic patterns among critical vulnerability scanner considerations

In vulnerability assessment scanning, preparation and planning can make the difference between an accurate and illuminating scan and a big IT headache. Failure to account for and accommodate legacy hardware and software, port management strategies, traffic patterns, and usage schedules can all contribute to a vulnerability scan that has the potential for causing as many problems as it identifies.

Yet the sheer variety of easy-to-install, point-and-click vulnerability scanners on both the commercial and free open-source markets that has helped make vulnerability scanning a near-ubiquitous tool for security-conscious businesses could itself contribute to a false sense of security and system safety when launching a scanner for the first time.

"Today's scanners are generally delivered with the best generic settings for most environments they'll be used in," says security consultant Chris Nickerson. Even so, a business isn't a generic commodity, he says.

That is why leading scanners include customization and tweaking tools, as well as plug-ins and add-ons that enable you to craft and tailor your vulnerability scan for your business' specific nature and operations. Tenable's Nessus, for instance, has more than 36,000 plug-ins.

That nature might well include legacy hardware and, in some industries (financial services, for example), lots of legacy hardware. Approaching big iron, a z/OS, or AS400 box, for instance, with a vulnerability scan calls for caution, lest the scan collide with the legacy machine's own approaches to port management and binding.

The consequences of such collisions can include connection hang-ups while waiting for responses, ports hanging up while waiting for connections, and, worst case, system crashes. In a post about new challenges that cloud computing brings to vulnerability assessment, security blogger Craig Balding offered this observation applicable to all vulnerability assessment tools: "If the scanning policy includes Denial of Service checks or the scanning engine is configured with 'aggressive' settings; e.g. connection entries in firewall state tables get exhausted. It's also possible for scans to tickle obscure bugs in the target -- or devices en route to the target."

The solution? Take it slow and take one (or a few) step at a time, particularly when launching vulnerability scans or a new scanner for the first time.

"Segment your risk," Nickerson advises. "Test and tune the scanner for the environment it will be used in and tackle the scan surgically, rather than a shotgun, all-at-once approach. If the default out-of-the-box scan tests 24 hosts at a time, try it with five hosts firsts. Break your hosts into manageable and actionable boxes before turning loose the hounds."

Steve Stasiukonis, founder and vice president of Secure Network Technologies, recommends setting up closed, test-bed environments if possible or practicable. "If you're aware of the potential harm an untested scan can create, you can easily see the benefit of running the scan first against a system that's not involved in business production," he says.

Likewise, critical business traffic and traffic patterns need to be factored into vulnerability scans because the scan itself will add to network traffic. The scan needs to be scheduled for minimal traffic impact, so don't launch a major scan of retail servers at the height of the holiday purchasing rush.

"Even without a full-on outage, poorly configured scans can still negatively impact performance or availability for other customers of shared infrastructure," Balding observed in his blog.

Understanding the nature of the business, the business' traffic patterns, and, crucially, communicating and coordinating with key business personnel are all keys to both an effective and nondisruptive vulnerability scan.

Scans and their effects are liable to set off alarms and key-person notifications. "Give some thought to what time your scans will be run and also to what time zone affected businesses operate in," Stasiukonis says. "Don't surprise someone on the West Coast with a 5 a.m. alert that you scheduled to run at 8 a.m. on the East Coast."

All of these considerations need to be factored in not only before launching a scan, but also before selecting the scanner you'll be launching.

The integration of vulnerability assessment scanning with penetration testing and other security tools will likely be accompanied by further refinements of interfaces, dashboards, and ease-of-use considerations.

And that is all for the good, so long as you bear in mind that the ease-of-use tools for major vulnerability include a wide array of customizations and add-ins.

"Use them," Nickerson says. "And use them before buying a scanning tool. Test the various scanners you're considering, and test them against the environment they'll be scanning. Make sure that the scanner you choose is the right tool for the environment you're choosing it for."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.