02 - Vulnerability Scanning and Asset Inventory
You cannot secure what you do not know exists. A robust vulnerability management program is built on the foundation of continuous, accurate asset discovery.
Continuous Asset Discovery
Asset inventory must be dynamic. Cloud environments, ephemeral containers, and remote workforces mean that point-in-time spreadsheets are instantly obsolete.
Key discovery mechanisms:
- Network Sweeps: ICMP and port scans (e.g., Nmap) to find active IP addresses.
- Cloud APIs: Querying AWS/Azure/GCP for running instances, databases, and serverless functions.
- Active Directory/LDAP: Syncing domain-joined machines.
- Endpoint Detection and Response (EDR): Leveraging security agents already deployed on endpoints.
Vulnerability Scanning Methodologies
Once assets are identified, they must be assessed for vulnerabilities.
Authenticated vs. Unauthenticated Scans
| Scan Type | How it Works | Pros | Cons |
|---|---|---|---|
| Unauthenticated (Network) | The scanner probes open ports and services from the outside, acting like an external attacker. | Identifies exposed services and misconfigurations. Low friction to set up. | High false positive rate. Cannot see installed software or registry keys. |
| Authenticated (Credentialed) | The scanner logs into the asset via SSH, WMI, or SNMP using provided credentials to inspect the local file system and configuration. | Highly accurate. Identifies vulnerable libraries, missing patches, and local misconfigurations. | Requires credential management (e.g., CyberArk, Vault). Can cause account lockouts if misconfigured. |
Best Practice: Always use Authenticated scans for internal assets. Use Unauthenticated scans to validate the external attack surface.
Agent-based vs. Network-based Scanning
Traditional vulnerability scanners (like Nessus, Qualys, and OpenVAS) historically relied on deploying a network appliance that reached out to endpoints. Modern environments increasingly use Agent-based scanning.
Network-Based Scanners
- Architecture: A central appliance sends traffic to target IPs.
- Use Case: Best for scanning network infrastructure (routers, switches, firewalls) and IoT devices where agents cannot be installed.
- Drawbacks: Network bandwidth consumption, firewall rules required, devices must be online during the scan window.
Agent-Based Scanners
- Architecture: A lightweight service (agent) runs continuously on the endpoint, assessing local software and reporting back to the central console.
- Use Case: Best for cloud workloads, remote employee laptops, and ephemeral instances.
- Drawbacks: Requires OS compatibility; consumes local CPU/Memory resources.
Leading Tools in the Market
- Tenable (Nessus): A standard for network and agent-based scanning. Excellent plugin coverage.
- Qualys: Cloud-native vulnerability management platform. Strong agent deployment capabilities.
- Rapid7 (InsightVM): Integrates vulnerability management with incident response workflows.
- OpenVAS / Greenbone (Open Source): The premier open-source vulnerability scanner. Great for budget-conscious or homelab environments.