502
B. Russell
10.5.9 Vulnerability Scanning
Vulnerability scanning should be performed at least annually and preferably
continuously. If hiring an outside consultant, the processing begins by reviewing
agreements and assumptions, providing a detailed listing of IP addresses to be
scanned, planning the approach, setting up user accounts, and assembling tools
and network access. The scanning process is executed using the selected tools and
an extensive review process is conducted to verify the discovered vulnerabilities,
prioritize findings, and identify remediation. Finally, remediation is the process of
fixing the problems, for example, by patching or making configuration changes to
devices and services.
There are many tools available to conduct vulnerability scanning. OWASP
maintains a listing of vulnerability scanners and this list is updated regularly [27].
One of the most well-known tools used for this activity is Nessus.
10.5.10 Penetration Testing
Vulnerability scans and penetration testing are two different activities. People often
mistake one for the other. Vulnerability scans look for known vulnerabilities in a
network and the scanning process is well suited for automation. Penetration tests are
designed to exploit weaknesses in a network or system. Penetration tests include not
only electronic methods but also non-electronic methods. For example, “dumpster
diving” to collect information that may be useful in reconstructing passwords or
aiding in social engineering attacks. There is a high degree of creativity that goes
into a penetration test.
There are three basic types of penetration test.
• A white box test involves a tester that has intimate knowledge of the system under
test. The tester is provided with information such as IP addresses, ports, and
services in use, network diagrams and may even be provided with user accounts.
• A black box test assumes the tester has no inside knowledge of the system under
test. This type of test requires the most creativity from the tester as he or she must
be able to amass information used to attack the system.
• A gray box test is a hybrid of the black and white box tests. The tester may be
provided some limited amount of information, for example, IP addresses and a
basic description of the applications.
Once a penetration test has been set for a system, the tester will begin by
enumerating the system to collect and later analyze data. Information on the devices
and computers that are on the network, and their operating systems, versions and
more can be found using network scanners. This can also include the open ports
that are being listened on and the associated services being used.
B. Russell
10.5.9 Vulnerability Scanning
Vulnerability scanning should be performed at least annually and preferably
continuously. If hiring an outside consultant, the processing begins by reviewing
agreements and assumptions, providing a detailed listing of IP addresses to be
scanned, planning the approach, setting up user accounts, and assembling tools
and network access. The scanning process is executed using the selected tools and
an extensive review process is conducted to verify the discovered vulnerabilities,
prioritize findings, and identify remediation. Finally, remediation is the process of
fixing the problems, for example, by patching or making configuration changes to
devices and services.
There are many tools available to conduct vulnerability scanning. OWASP
maintains a listing of vulnerability scanners and this list is updated regularly [27].
One of the most well-known tools used for this activity is Nessus.
10.5.10 Penetration Testing
Vulnerability scans and penetration testing are two different activities. People often
mistake one for the other. Vulnerability scans look for known vulnerabilities in a
network and the scanning process is well suited for automation. Penetration tests are
designed to exploit weaknesses in a network or system. Penetration tests include not
only electronic methods but also non-electronic methods. For example, “dumpster
diving” to collect information that may be useful in reconstructing passwords or
aiding in social engineering attacks. There is a high degree of creativity that goes
into a penetration test.
There are three basic types of penetration test.
• A white box test involves a tester that has intimate knowledge of the system under
test. The tester is provided with information such as IP addresses, ports, and
services in use, network diagrams and may even be provided with user accounts.
• A black box test assumes the tester has no inside knowledge of the system under
test. This type of test requires the most creativity from the tester as he or she must
be able to amass information used to attack the system.
• A gray box test is a hybrid of the black and white box tests. The tester may be
provided some limited amount of information, for example, IP addresses and a
basic description of the applications.
Once a penetration test has been set for a system, the tester will begin by
enumerating the system to collect and later analyze data. Information on the devices
and computers that are on the network, and their operating systems, versions and
more can be found using network scanners. This can also include the open ports
that are being listened on and the associated services being used.