Vulnerability Scanning | ND

Vulnerabilities are a constant concern in the ever-evolving cyber environment. Every month hundreds of new flaws are found in both hardware and software, old and new, that could lead to a breach of security. In January there have already been over 100 common vulnerabilities and exposures (CVEs) identified. A full listing of these vulnerabilities can be found on the government-maintained website as well as other reputable sites. Knowing your own weaknesses and exposures is critical to maintaining a secure environment.

Hackers are familiar with CVEs and know how to check for them. Nowadays, there is a minimum standard of security that must be met if a company is processing large payments or credit cards. Without meeting thes security minimums that involve CVEs, business will take a hit, as many entities will withhold payments and processing. Luckily, for the end user that is not as well versed, there is simple solution that is a good starting point when it comes to identifying CVEs; a vulnerability scanner.

The vulnerability scanner is a tool that can be used to identify CVEs on a network from both the inside and the outside, depending on where the scan is run from. A recent client of ConexNet needed a scan to be completed and have its CVEs remedied so business could run as normal. The PCI Compliance manager is the tool that was used for the job. To use this tool, all that needs to be done is to login, point the scanner to the domain to be tested, and allow it to run.

There are a couple main features with the PCI scan interface. The PCI Compliance manager will allow you to scan multiple targets and review your results in depth. You will see the causes and possible solutions to the found CVEs. However, it is still recommended that a professional look at the results and determine the best course of action. Especially when considering that not all scan results are equal.There are many other vulnerability scanners out there.

Nessus, OpenVAS Security, Qualys, Nmap, and Nikto are just a few you can expect to encounter. It is important to note that a vulnerability scanner is only as good as the company/people updating it. For that reason, many vulnerability scanners will turn out slightly different results or CVE mitigation tactics. It is important to keep this in mind as a scanner is not the ultimate in security, but is one essential tool in maintaining security.