Some organizations don't have the same resources that others do, and have to make effective decisions based on their team size and budgets available. But security is equally never about the perfect scenario. Meanwhile, will the noise that gets added to your results in the way of additional SSL cipher warnings, self-signed certificates, and the extra management overheads of including them to the whole process be worthwhile?Ĭlearly, the desirable answer over time is yes, you would want to scan these assets defence in depth is a core concept in cyber security. They may assist an attacker who is already inside your network, but will they help one break into your network to begin with? Probably not. But how much value do those extra results to your breach prevention efforts bring? Those printers and HP iLO devices may infrequently have vulnerabilities, and only some of these may be serious. Yes, you are scanning everything, which immediately sounds better. This is a double-edged sword in disguise, though. However, they will have an IP address, which means you can scan them via a network-based scanner. It almost goes without saying, but agents can't be installed on everything.ĭevices like printers routers and switches and any other specialized hardware you may have on your network, such as HP Integrated Lights-Out, which is common to many large organizations who manage their own servers, may not have an operating system that's supported by an agent. Which internal scanner is better for your business? Coverage So for organizations looking to implement internal vulnerability scans for the first time, here's some helpful insight. Implementing this badly can cause headaches for years to come. While "authenticated scanning" allows network-based scans to gather similar levels of information to an agent-based scan, there are still benefits and drawbacks to each approach. Agent-based scanning explainedĪgent-based internal vulnerability scanning is considered the more modern approach, running 'agents' on your devices that report back to a central server. Network-based internal vulnerability scanning is the more traditional approach, running internal network scans on a box known as a scanning 'appliance' that sits on your infrastructure (or, more recently, on a Virtual Machine in your internal cloud). Generally, when it comes to identifying and fixing vulnerabilities on your internal network, there are two competing (but not mutually exclusive) approaches: network-based internal vulnerability scanning and agent-based internal vulnerability scanning. If you're reading this article, though, you are probably already aware of the value internal scanning can bring but you're not sure which type is right for your business. For this reason, it's also seen as a must for many organizations. Protecting the inside like you protect the outside provides a second layer of defence, making your organization significantly more resilient to a breach. This is the gap that internal vulnerability scanning fills. Furthermore, an externally facing system that looks secure from a black-box perspective may have severe vulnerabilities that would be revealed by a deeper inspection of the system and software being run. Techniques like phishing, targeted malware, and watering-hole attacks all contribute to the risk that even if your externally facing systems are secure, you may still be compromised by a cyber-criminal. Some serious vulnerabilities can be discovered at this stage, so it's a must for many organizations, but that's not where hackers stop. While external vulnerability scanning can give a great overview of what you look like to a hacker, the information that can be gleaned without access to your systems can be limited. Why should you perform internal vulnerability scanning? This article will go in-depth on the strengths and weaknesses of each approach, but let's wind it back a second for those who aren't sure why they should even do internal scanning in the first place. However, with remote working now the norm in most if not all workplaces, it feels a lot more like agent-based scanning is a must, while network-based scanning is an optional extra. For years, the two most popular methods for internal scanning: agent-based and network-based were considered to be about equal in value, each bringing its own strengths to bear.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |