full-disclosure - Top 15 Reasons Why Admins Use Security Scanners

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: keydet89 at yahoo.com (Harlan Carvey)
Subject: Top 15 Reasons Why Admins Use Security Scanners

Just some things to think about...

> Top 15 Reasons Why Admins Use Security Scanners

Question: Should admins be using security scanners?

> This list has been compiled by emailing various
> Security/Admin lists...
> Anyone care to offer their input - add to the list?
> 
> -Am I sure that I have found all vulnerabilities in
> my network?
> -Have I configured my network properly?

What's your policy say?  If you're relying on a
security scanner to define proper network
configuration, maybe you're in the wrong line of work.

> -Am I finding and closing security holes fast
> enough?

With proper policies and procedures in place, it's not
a matter of finding and closing holes fast enough. 
Some Microsoft guys (Dave LeBlanc included) set up an
IIS 4.0 web server on NT a full year before Code Red
came out, and from the time it went live, it was
immune to Code Red.  Why?  The ida/idq script mappings
were unnecessary functionality and therefore disabled.

> -How do I know which machines have a missing patch?

What is your patch management process?

> -Are we resistant enough to network-savvy viruses
> that spread via known exploits?

What is "resistant enough"?  You can roll out Norton
on your email server (and other servers) as well as on
your desktops, and manage them all from a central
location, pushing out updates as they become
available?  Do you?  A security scanner won't tell you
if you do or not.

> -Are we in compliance with HIPAA, Sarbanes-Oxley and
> other regulations?

The only way a security scanner will tell you this is
if it's compliant, as well.

> -What have I missed in locking down a server or
> environment?

What do your policies and procedures say?

> -Do I have my network perimeter and interior
> sufficiently protected?
> -Have I identified and protected my network
> resources from external threats?
> -Do I know which systems are now well protected?
> -How vulnerable are we from the inside?

>From what threat?  Are you refering to users, or to
admins?

> -How will I ever pass my IT Security Audits?

Don't worry about it...most audits don't seem to have
an IT background, and even when they do, they don't
take the time to understand your business processes or
your network infrastructure.

> -How do I locate computers on my network, that are
> not within compliance?
> -How do I report to Management that we have done all
> we could to lock down?

Very carefully.  IT guys and management don't speak
the same language.

> -How do I detect unknown and/or rogue
> devices/connections?

By understanding your infrastructure.  If you know
what IP address ranges are assigned and to where, then
you'll know that whatever device is on 10.2.1.52
shouldn't be responding to ICMP...