02:10 PM

Vulnerability Scanning Do's And Don'ts

Legacy hardware, software, traffic patterns among critical vulnerability scanner considerations

In vulnerability assessment scanning, preparation and planning can make the difference between an accurate and illuminating scan and a big IT headache. Failure to account for and accommodate legacy hardware and software, port management strategies, traffic patterns, and usage schedules can all contribute to a vulnerability scan that has the potential for causing as many problems as it identifies.

Yet the sheer variety of easy-to-install, point-and-click vulnerability scanners on both the commercial and free open-source markets that has helped make vulnerability scanning a near-ubiquitous tool for security-conscious businesses could itself contribute to a false sense of security and system safety when launching a scanner for the first time.

"Today's scanners are generally delivered with the best generic settings for most environments they'll be used in," says security consultant Chris Nickerson. Even so, a business isn't a generic commodity, he says.

That is why leading scanners include customization and tweaking tools, as well as plug-ins and add-ons that enable you to craft and tailor your vulnerability scan for your business' specific nature and operations. Tenable's Nessus, for instance, has more than 36,000 plug-ins.

That nature might well include legacy hardware and, in some industries (financial services, for example), lots of legacy hardware. Approaching big iron, a z/OS, or AS400 box, for instance, with a vulnerability scan calls for caution, lest the scan collide with the legacy machine's own approaches to port management and binding.

The consequences of such collisions can include connection hang-ups while waiting for responses, ports hanging up while waiting for connections, and, worst case, system crashes. In a post about new challenges that cloud computing brings to vulnerability assessment, security blogger Craig Balding offered this observation applicable to all vulnerability assessment tools: "If the scanning policy includes Denial of Service checks or the scanning engine is configured with 'aggressive' settings; e.g. connection entries in firewall state tables get exhausted. It's also possible for scans to tickle obscure bugs in the target -- or devices en route to the target."

The solution? Take it slow and take one (or a few) step at a time, particularly when launching vulnerability scans or a new scanner for the first time.

"Segment your risk," Nickerson advises. "Test and tune the scanner for the environment it will be used in and tackle the scan surgically, rather than a shotgun, all-at-once approach. If the default out-of-the-box scan tests 24 hosts at a time, try it with five hosts firsts. Break your hosts into manageable and actionable boxes before turning loose the hounds."

Steve Stasiukonis, founder and vice president of Secure Network Technologies, recommends setting up closed, test-bed environments if possible or practicable. "If you're aware of the potential harm an untested scan can create, you can easily see the benefit of running the scan first against a system that's not involved in business production," he says.

Likewise, critical business traffic and traffic patterns need to be factored into vulnerability scans because the scan itself will add to network traffic. The scan needs to be scheduled for minimal traffic impact, so don't launch a major scan of retail servers at the height of the holiday purchasing rush.

"Even without a full-on outage, poorly configured scans can still negatively impact performance or availability for other customers of shared infrastructure," Balding observed in his blog.

Understanding the nature of the business, the business' traffic patterns, and, crucially, communicating and coordinating with key business personnel are all keys to both an effective and nondisruptive vulnerability scan.

Scans and their effects are liable to set off alarms and key-person notifications. "Give some thought to what time your scans will be run and also to what time zone affected businesses operate in," Stasiukonis says. "Don't surprise someone on the West Coast with a 5 a.m. alert that you scheduled to run at 8 a.m. on the East Coast."

All of these considerations need to be factored in not only before launching a scan, but also before selecting the scanner you'll be launching.

The integration of vulnerability assessment scanning with penetration testing and other security tools will likely be accompanied by further refinements of interfaces, dashboards, and ease-of-use considerations.

And that is all for the good, so long as you bear in mind that the ease-of-use tools for major vulnerability include a wide array of customizations and add-ins.

"Use them," Nickerson says. "And use them before buying a scanning tool. Test the various scanners you're considering, and test them against the environment they'll be scanning. Make sure that the scanner you choose is the right tool for the environment you're choosing it for."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
4 Ways to Fight the Email Security Threat
Asaf Cidon, Vice President, Content Security Services, at Barracuda Networks,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
PUBLISHED: 2018-10-16
Z-BlogPHP (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.