Vulnerability Scanning Methods

What it is

A vulnerability is a weakness that an attacker could use, such as missing software updates or an insecure setting. A vulnerability scan is an automated check that compares systems against a database of known weaknesses and reports what it finds.

Scanning is only useful if it covers the right systems in the right way. The analyst chooses a scan type to match the target, the risk of disruption and the detail needed.

How it works

Start with the asset inventory

You cannot scan or protect what you do not know about. Asset discovery finds hosts, services and software, often with a host discovery scan, and compares the result with the official inventory to expose unmanaged or forgotten systems (shadow IT).

The tool Nmap (Network Mapper) is a common discovery and port scanning tool. In a Linux shell:

nmap -sn 192.0.2.0/24
nmap -sV -p 1-1024 192.0.2.15

The first command is a ping scan that lists live hosts without scanning ports. The second probes ports 1 to 1024 on one host and tries to detect the service versions running.

Two other tools appear for network scanning and mapping.

masscan -p80,443 192.0.2.0/24 --rate 1000

The -p option picks the ports, and --rate caps the packets sent per second. Masscan trades depth for speed: it does not do the service and version detection or scripting that Nmap does, so a common pattern is to find open ports with Masscan and then examine them with Nmap. A high rate can overload fragile devices and links, so keep it low on production networks.

Choosing a scan type

Credentialed scans give more accurate and more complete results with fewer false positives. A non credentialed scan is still valuable because it shows the attacker's view, so many programmes run both.

Scan targets and special cases

• Network and host scans check operating systems, services and patches.
• Web application scans test sites for flaws such as injection or weak session handling. Tools such as the Open Worldwide Application Security Project (OWASP) Zed Attack Proxy (ZAP), Burp Suite and Nikto are examples.
• Database and cloud scans check configuration and exposure, and cloud accounts often need provider approval and permissions.
• Container and image scans look inside images and dependencies before deployment.
• Software analysis includes static application security testing (SAST), which reads source code, dynamic application security testing (DAST), which tests a running app, and software composition analysis (SCA), which checks third party libraries.

Industrial control systems (ICS) and other operational technology (OT) need special care. Active probes can crash old controllers, so use passive monitoring, gentle scan settings or scheduled windows agreed with the operators.

Standards and content

The Security Content Automation Protocol (SCAP) is a set of standards for describing vulnerabilities and checking configuration. Benchmarks such as those from the Center for Internet Security (CIS) define secure settings, and a compliance scan checks systems against them. Scanners use regularly updated plugins or feeds, so keep them current before every run.

Planning a scan

1. Scope: which networks, assets and applications, including cloud and remote devices.
2. Frequency: driven by risk and by policy or compliance rules, and after major changes.
3. Timing: run heavy scans in agreed windows to avoid disrupting business.
4. Sensitivity: choose the checks and depth, and whether to include safe checks only.
5. Authorisation: get written approval, and warn operations and the security operations team.
6. Bandwidth and performance: avoid scanning that overloads slow links or fragile devices.

Scanning has limits. It finds known issues, so it does not detect unknown flaws (zero days) or design weaknesses.

Segmentation and scan reach. A scanner sees only what the network allows it to reach. Firewalls and virtual local area network (VLAN) boundaries can block probes, which hides hosts and produces false negatives.

• Place a scanner, or a remote scan engine, inside each segment that cannot be reached from the central scanner.
• Add firewall allow rules for the scanner address, including the ports that credentialed checks need.
• Use agents on hosts that no scanner can reach, such as roaming laptops or isolated zones.
• Tell the security operations team, because an intrusion prevention system may block or alert on scan traffic.
• Compare the results with the asset inventory to find segments that were never covered.