Cyberstudy
PDF p.233 In progress

Vulnerability Scanning

Open PDF at p.233 14 flashcards

Summary

PDF p.233

Vulnerability scanning is a crucial aspect of vulnerability management, involving the systematic probing of systems or networks to detect security weaknesses. This process helps identify, classify, remediate, and mitigate vulnerabilities, supporting both general and application-specific security.

In plain words

Supplementary — not from your PDF

Vulnerability management means identifying, classifying, fixing and mitigating weaknesses. Scanners such as Nessus and OpenVAS check hosts for missing patches and configuration problems. A non-credentialed scan sees what an outsider would see. A credentialed scan logs in, so it finds much more, such as misconfigurations and missing patches, which also shows what an insider could reach. Application scanners use static analysis (reviewing code) and dynamic analysis (testing the running app). Package monitoring (SCA tools) tracks third-party components.

Detailed explanation

PDF p.233
  • Vulnerability Management
    • Definition: Identifying, classifying, remediating, and mitigating vulnerabilities.
    • Process: Internal and external scans to inventory vulnerabilities from different network viewpoints.
    • Application Security: Locates misconfigurations and missing patches in software.
  • Vulnerability Scanning Tools
    • Examples: openVAS, Nessus.
    • Features: Analyze network equipment, operating systems, databases, patch compliance, configuration.
    • Specialized Tools: For deeper application analysis.
  • Network Vulnerability Scanner
    • Examples: Tenable Nessus, OpenVAS.
    • Function: Test network hosts (PCs, mobile devices, servers, routers, switches).
    • Output: Reports on missing patches, configuration deviations, vulnerabilities.
  • Credentialed and Non-Credentialed Scans
    • Non-Credentialed Scan: Test packets directed at a host without login rights.
      • Focus: External assessment, web application scanning.
    • Credentialed Scan: User account with login rights for in-depth analysis.
      • Focus: Insider attack simulation, misconfiguration detection.
  • Application and Web Application Scanners
    • Definition: Specialized scanning for software application weaknesses.
    • Methods: Static analysis (code review), dynamic analysis (testing running applications).
    • Focus: Issues like unvalidated inputs, broken access controls, SQL injection.
  • Package Monitoring
    • Definition: Tracks and assesses the security of third-party software packages, libraries, dependencies.
    • Tools: Automated software composition analysis (SCA) tools.
    • Purpose: Ensure components are up to date and free from known vulnerabilities.

Important terms

taken from the text above
Vulnerability Management
Identifying, classifying, remediating, and mitigating vulnerabilities.
Application Security
Locates misconfigurations and missing patches in software.
Specialized Tools
For deeper application analysis.
Output
Reports on missing patches, configuration deviations, vulnerabilities.
Non-Credentialed Scan
Test packets directed at a host without login rights.
Credentialed Scan
User account with login rights for in-depth analysis.
Application and Web Application Scanners
Specialized scanning for software application weaknesses.
Package Monitoring
Tracks and assesses the security of third-party software packages, libraries, dependencies.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A weekly credentialed scan of all servers.
  • An external non-credentialed scan of the public IP range.
  • An SCA tool flagging an outdated library in a build.

Scenario

An external scan of a server shows only two minor findings, but a credentialed scan reveals 40 missing patches. Credentialed scans give the more accurate picture of internal risk.

Common mistakes

Supplementary — not from your PDF
  • Relying only on non-credentialed scans and thinking systems are clean.
  • Scanning systems without authorization or outside the agreed scope.

Practical skills

Supplementary — not from your PDF
  • Explain when to use credentialed vs non-credentialed scans.
  • Read a scanner report and pick the top priorities.

What I should remember

Key Points PDF p.233
  • Vulnerability Management
    • Definition: Identify, classify, remediate, mitigate vulnerabilities.
    • Process: Internal/external scans, application security.
  • Vulnerability Scanning Tools
    • Examples: openVAS, Nessus.
    • Features: Network equipment, OS, databases, patch compliance.
  • Network Vulnerability Scanner
    • Examples: Tenable Nessus, OpenVAS.
    • Function: Test network hosts, report vulnerabilities.
  • Credentialed and Non-Credentialed Scans
    • Non-Credentialed: No login rights, external assessment.
    • Credentialed: Login rights, in-depth analysis.
  • Application and Web Application Scanners
    • Definition: Specialized scanning for software applications.
    • Methods: Static, dynamic analysis.
    • Focus: Unvalidated inputs, access controls, SQL injection.
  • Package Monitoring
    • Definition: Track third-party software security.
    • Tools: SCA tools.
    • Purpose: Ensure up-to-date, secure components.