Vulnerability Scanners Must Be Used Carefully

Automated network and Web app vulnerability scanners can make strengthening your business's defenses a lot simpler -- or a lot more complicated, depending on how much you and your team know about their uses. A new report looks at some of the challenges accompanying vulnerability scanning.Automated vulnerability scanners, both for network and Web app scans, have attracted a lot of attention lately, both because of their increasing capabilities and ease of use, as well as the growing role risk assessment plays in a thorough business defense strategy.

But just because vulnerability scanners are increasingly easy to use, that doesn't mean they're easy to use well. As with any tool, preparation, practice and proficiency have as much to do with effective vulnerability scans as the tools themselves.

A good new report exploring "The Truth About Vulnerability Scanners" gives a glimpse of some of the most common -- and most commonly mismanaged -- problem areas associated with vulnerability scanners:

Authentication: As with anti-virus definition list, vulnerability identification is only as good as the scanner's authenticated vulnerability list and the points where that list matches vulnerabilities in your company's systems and apps. Your IT team will need to put in the time studying potential vulnerability scanners' authentication tools.

Custom applications: If you're running custom or non-standard programs, be aware that the vulnerability scanner may not be able to detect problems.

Complex attacks and other security issues: Standardization enhances the automated aspects of scanning, but also renders off-the-shelf scanners unable to recognize complex threats and vulnerabilities. Again, your team will be configuring and tweaking a scanner both before and after using it.

Other potential problems include collisions with legacy hardware and software, interruptions of business traffic patterns and failure to inform key personnel that the scan is being run. Recently I took a look at some of these "Vulnerability Scan Do's And Don'ts" for Dark Reading's Vulnerability Management Center.

The complete "Scanning Reality: Limits Of Automated Vulnerability Scanners" report can be downloaded here. (Registration required.)

Don't Miss: SMB Security: Fight The Right Fight