Vulnerability Scanning: Keeping on top of the most common threats

So, who would benefit from a vulnerability scanning service? The answer is any business or organisation that owns or makes use of IT systems to communicate with other systems or people. This includes both internal connections within a controlled private network or externally over the Internet.

If you think this sounds like a very wide net to be caught in, you'd be right! But, this is the world we live in. Digital services very often need to be reachable from everywhere, by everyone, all the time. And, thanks in part to COVID-19, remote connections are absolute essentials. The problem is, opening up these channels of communication can increase the risk of unwanted attention from attackers.

There are countless situations where vulnerability scanning would be helpful. Let's say your business is responsible for developing and hosting a large enterprise application. How do you avoid accidentally introducing vulnerabilities through insecure development practices or using 3rd party components with known security issues?

Perhaps your systems hold sensitive data such as payment card details or other Personally Identifiable Information. If so, how do you ensure you’re adhering to the Payment Card Industry Data Security Standard (PCI DSS) or other protections required by the relevant standards and certifications bodies?

As a final example, you may operate a Bring Your Own Device policy. If so, how can you ensure that devices connecting to your corporate network use a modern and well-supported Operating System with anti-virus installed and all the latest security patches applied?

Attackers routinely use automated tools to scan for exploitable vulnerabilities. There's no reason why we cannot also benefit from performing the same activities on our own networks, in a bid to stay one step ahead.

A wide range of vulnerability scanning services are available that can quickly and cheaply perform an automated assessment of common vulnerabilities within your infrastructure or applications.

By ensuring you run these scans on a regular schedule, you can make sure you stay on top of new issues as they arise and deal with them before they get discovered and exploited by would-be attackers.

Many Vulnerability Scanning solutions also include features to support other areas of your VMP. For example, one may include asset discovery capabilities to help you find and track the hosts owned by your organisation. Another may have the ability to export findings directly to your issue tracking solution where you can co-ordinate remediation activities with other individuals and teams.

Scanners targeted at software development may be able to hook into your existing development tools or build pipeline, allowing insecure programming practices to be caught as the code is typed, or when a new build version is generated.

Automated tools form an essential cornerstone of a solid Vulnerability Management Program, but don’t be deceived into thinking that “a scan a day will keep the attackers away”.

Vulnerability Scanning solutions are only as good as the knowledge bases and rulesets driving them. If a vulnerability is too complex, niche or recently made publicly available to be checked by the scanner, it’ll likely go unnoticed. Errors in deployment can also lead to vulnerabilities not being picked up for a number of reasons.

Whilst a clean scan report is undeniably better than one littered with findings, this can lead to a false sense of security regarding your true level of risk. When it comes to depth and comprehensiveness of testing, automated scanners pale in comparison to humans with the right skill sets.

Instead, think of Vulnerability Scanning as a cheap and cost-effective way of keeping the most common security issues at bay, leaving you time and budget to invest in more focused forms of manual testing. Regular penetration tests with comparison to your own vulnerability scan results help to identify any systemic weaknesses in your vulnerability scanning regime.

Vulnerability Scanning solutions come in many shapes and sizes. The right one(s) for you will be dependent on many factors, such as the size and nature of your IT estate, pricing and hosting models, features to support your existing VMP, and so on.

Our newly released guidance will help you to understand the various types of vulnerability scanners available, when and how to use them most effectively and what to look out for when buying such a product or service.

Richard D
Lead Security Engineer