What is Vulnerability Scanning?

Vulnerability scanning is the use of software to identify and report on security issues. These security issues are known as vulnerabilities, because when your security is weak, you are vulnerable to attack. This vulnerability assessment produced by the vulnerability scanner is then used to implement fixes and to remediate these vulnerabilities, making the system safe and secure.

A vulnerability scanner can have thousands of tests that it uses to probe for vulnerabilities and gather information about potential risks and problems. These tests spot holes in your security that could be exploited by hackers to access unauthorized data, steal it, sell it, or otherwise compromise your business.

The vulnerability scanner identifies and creates an inventory of all the systems connected to a network, including but not limited to desktop and laptop computers, servers, printers, virtual machines, firewalls, and switches. On every device that the vulnerability scanner identifies, it will run through its many tests and attempt to find the vulnerabilities present in each item. This includes investigating open ports and user accounts.

After the vulnerability scanner has identified and run through the tests on these systems, it will add it to its inventory, and routinely run checks of all systems in the inventory to make sure that they are continually protected against vulnerabilities.

The process of using a vulnerability scanner to search out these security holes, as well as the process of repairing those vulnerabilities, is referred to as vulnerability management.

What are Vulnerability Scanning Tools Used For?

The media and movies like to portray hacking as something that happens to large corporations through highly sophisticated and large-scale attacks. While there may be some truth to the “sophisticated” claim, the truth is that vulnerabilities are in every system, large or small, and hackers are just as likely, if not more likely, to attack small businesses. “Soft exploits” are also critical as some small businesses are unable to train staff to identify malicious emails and pop-up messages on their systems.

Whether your company relies on a proprietary software system, a cloud-based system, or even something as basic as a website through which users create accounts or pay bills, you can be the target of hackers. If anyone in your business has a computer, it can be the target of hackers. Even if your business merely uses a credit card machine connected to a cash register, you can be the target of hackers.

A breach of your system can reveal sensitive information, including the personal information of customers as well as usernames, passwords, payment information, credit information, financial documents, and personnel files. The cost of an attack like this can be enormous — it not only results in time and money invested in fixing the problem, but also it causes customers to lose trust in your business and send them fleeing to competitors.

When it comes to testing for vulnerabilities in your systems, two techniques are typically used: vulnerability scanning and penetration testing. The two are very different, and each has its pros and cons.

Benefit of Vulnerability Scanning

Vulnerability scanning’s main benefit is that it is automatic and continuously running, and operates at a lower cost than penetration testing. New security issues are identified as soon as they pop up. Penetration testing is a more manual type of testing, usually performed by consultants, which means that it is both expensive and slow.

It can occasionally find more than a vulnerability scanner, because it involves a human worker with an elevated level of understanding, but it is generally restricted to higher profile needs, and periodic use. For day-to-day work, vulnerability scanners are preferred, though there’s nothing wrong with employing both.

Generally speaking, companies that are new to vulnerability testing should begin with vulnerability scanners to regularly test against attack. Penetration tests can be used on an as-needed basis, but it should be clearly understood that a penetration test, while often more comprehensive, takes a snapshot of your systems at a single moment in time, and does not patrol the systems day-in and day-out. For that, even companies who pay for penetration testing rely on vulnerability scanners for their routine work.

Syxsense Vulnerability Scanner (Learn More)

How Vulnerability Scanning Works

Vulnerability scanners find vulnerabilities, and work within a four-part framework to manage them. These parts include identification of vulnerabilities, evaluation of the risk of the vulnerabilities, treatment of the vulnerabilities, and reporting of the vulnerabilities.

Identifying Vulnerabilities

A vulnerability scanner works to identify vulnerabilities by locating devices, software, and open ports. It is connected to a vulnerability database with which it remains in constant updating contact so that it can correlate vulnerability information in as close to real time as possible.

Vulnerability scanning can be more or less aggressive, per the user’s wishes, with the knowledge that the more aggressive a vulnerability scanner is, the more burden it will put on the system and may cause things to slow or otherwise affect the performance of the system. Vulnerability scanners can partially overcome this by running during off hours (though this can lead to the problem that some devices, such as laptops, may no longer be connected to the system during the off hours).

An alternative is adaptive vulnerability scanning, which detects changes to the network, such as when a new device (a computer, a server, a printer, or something else) is connected for the first time. When this happens, the vulnerability scanner activates automatically and searches the new system for vulnerabilities, in addition to waiting for the standard off-hours scans.

Risk Evaluation

When a vulnerability scanner is activated, it can produce a long list of vulnerabilities identified, which can be overwhelming to the IT department. Therefore, a good vulnerability scanner will triage these identifications. This ranking can determine how dangerous the vulnerability is and what kind of impact it would have if exploited, as well as how practical it would be for a hacker to actually exploit it and how easily it would be accomplished. It can also determine what existing security measures could combat the vulnerability, and it can also recognize false positives.

All of this information is given to the IT team for evaluation so that they can move forward with the next steps.

Treatment of Identified Vulnerabilities

A good vulnerability scanner, and, indeed, Syxsense’s scanner, treats the identified vulnerabilities that have been detected during the scan. There is not always an easy solution or a patch that is immediately available. In these circumstances the vulnerability scanner’s job is to notify the IT department’s security team to address the vulnerabilities manually. The team may examine the vulnerability, come up with a fix, or simply decide that the vulnerability poses so little risk that it doesn’t need a fix.

Syxsense is the only vulnerability scanner on the market currently that shows you what’s wrong and also deploys a solution to fix it. Because of this you can recognize vulnerabilities as they appear and get automated patching.