Security Basics: Vulnerability Detection
This post is one in a series of blog posts on the fundamentals of an information security program. You can see the complete list of posts in this series here.
Another cause of system and network vulnerabilities is configuration choices. Modern systems can be very complex, with a bewildering array of potential configuration options. Identifying and understanding these is a major challenge, as is ensuring that all of your systems and devices are configured as intended.Anything man-made will have imperfections. When they are serious and potentially life-threatening, we sometimes spend a lot of time and effort to remedy them. My minivan, for instance, has been in to the dealer for three different recall-related repairs in the eleven years I've had it!
Modern software is, in many ways, more complex than any physical thing that can be built. Yet its ephemeral nature makes it relatively easy to modify after its initial "manufacturing" is complete. The consequence of these two facts is that flaws in software functionality are discovered with significant frequency, and "patches" and updates to fix them are released with a similar frequency. This is actually an advantage of software, but it also presents a challenge.
When a vulnerability is discovered and publicized in a widely-used piece of software, it is only a short time before malicious hackers develop a method of exploiting the vulnerability and begin using it to attack organizations. Thus it is crucial to install updates made available by vendors as quickly as possible.
Another cause of system and network vulnerabilities is configuration choices. Modern systems can be very complex, with a bewildering array of potential configuration options. Identifying and understanding these is a major challenge, as is ensuring that all of your systems and devices are configured as intended.
Vulnerability scanning is a technology that can aid in managing both of these challenges. Many vendors offer vulnerability scanning products with similar core features. For internal network scanning, most consist of software or a hardware appliance, or in some cases as "virtual" appliance that can be simply installed on your VMWare or other virtual server infrastructure. For scanning of your external, Internet-facing presence some vendors offer cloud-based services allowing you to run scans from the vendor's servers. Whether internal or external, these devices initiate network connections to your various devices to test whether they are vulnerable to any of many thousands of different known attacks. Depending on the configuration and capabilities of the scanner, they can also test your configuration settings to see if they conform to recommended security practices.
Key issues to keep in mind when buying, setting up, and using vulnerability scanning solutions:
Modern software is, in many ways, more complex than any physical thing that can be built. Yet its ephemeral nature makes it relatively easy to modify after its initial "manufacturing" is complete. The consequence of these two facts is that flaws in software functionality are discovered with significant frequency, and "patches" and updates to fix them are released with a similar frequency. This is actually an advantage of software, but it also presents a challenge.
When a vulnerability is discovered and publicized in a widely-used piece of software, it is only a short time before malicious hackers develop a method of exploiting the vulnerability and begin using it to attack organizations. Thus it is crucial to install updates made available by vendors as quickly as possible.
Another cause of system and network vulnerabilities is configuration choices. Modern systems can be very complex, with a bewildering array of potential configuration options. Identifying and understanding these is a major challenge, as is ensuring that all of your systems and devices are configured as intended.
- Authenticated scanning is far more effective than non-authenticated. Most good scanners allow you to provide credentials for them to use when scanning internal systems, and this provides not only more complete results but also a lot fewer false positives.
- Consider compliance scanning. Many scanning solutions allow you to scan and validate your system configurations against a specific baseline, including industry standards such as CIS benchmarks or DISA STIGs. You can generally customize these further so that your scanner will check your systems against your own standard configuration baseline.
- Ultimately scanning is just a diagnostic tool. Scanning doesn't make you more secure; it merely tells you where your vulnerabilities lie. Effective processes to address these vulnerabilities are an essential companion to vulnerability management software.
- Many scanning solutions include a capability to track your systems' results over time, and even to assign and monitor the progress of remediation actions. Some vendors include such features in their basic products, while with others it is an added feature at an additional cost. This is a benefit for some customers, but those with more modest risk management needs may be able to simply use a spreadsheet report from the scanner to perform this type of tracking. It is helpful to begin by assessing your organization's risk and determining whether investing in such advanced features is worth the cost for you.
Comments
Post a Comment