Narrator: Scanning workflow. 2 2
In this lesson, we're going to talk 3 3
about the basic assessment scan workflow. 4 4
Now, before you start doing your assessment scans 5 5
there are lots 6 6
of different questions that you have to answer 7 7
and this will make sure you're ready to conduct 8 8
that vulnerability scan. 9 9
These are things like who is going to conduct the scan? 10 10
Because you need to know which person's going to do it. 11 11
Is it going to be assistant administrator, 12 12
an internal employee, 13 13
an external employee, who's going to do it? 14 14
Then you need to answer when will the scan be performed? 15 15
Because you can't just conduct the scan anytime you want. 16 16
When you do a scan 17 17
it puts additional load on the network 18 18
and on the resources that you're targeting 19 19
as part of your scan. And so if you do this 20 20
at the primetime during the middle of the day 21 21
you can actually crash your own network by doing it. 22 22
So you have to make sure you figure out 23 23
when is the right time to perform that scan. 24 24
Also, which systems are going to be scanned? 25 25
Are you going to scan everything on the network 26 26
and are you going to do 'em all equally 27 27
or are you going to divide this up into smaller pieces? 28 28
This is an important question for you to answer. 29 29
Another question you have to ask yourself is 30 30
how will scanning impact the systems? 31 31
As I just said, when you scan these systems 32 32
some of them are going to have additional load placed on them 33 33
by these scans, and if you're doing a very in-depth scan 34 34
you can actually put additional load 35 35
on those systems that eats up memory or processor resources 36 36
and that can crash those systems. 37 37
So you need to be careful when doing scanning as well. 38 38
Another question we want to ask ourself is 39 39
does the system need to be isolated during the scanning? 40 40
Now, why is this important to ask? 41 41
Well, again, because you have to know how 42 42
the system is going to respond when you do these scans. 43 43
When I ask about should I isolate the system 44 44
the question here is really 45 45
can I scan it while it's in production? 46 46
Or do I need to take it off 47 47
of doing a real world job so I can scan it 48 48
and then put it back into the real world environment? 49 49
This is an important thing to consider because 50 50
it's going to have real world consequences to those actions. 51 51
And finally, who can assist you with scanning? 52 52
Now, I don't mean who's going to be your assistant here, 53 53
but if you start scanning a system 54 54
and you start seeing things that look unusual 55 55
who are you going to ask for help? 56 56
If I'm scanning the web server 57 57
I probably want to talk to the web developer. 58 58
If I'm scanning a database 59 59
I might want to ask the database administrator. 60 60
This is the idea of who can assist you 61 61
if you have problems during scanning. 62 62
Now, all of this then allows us to 63 63
start creating what will be our workflow. 64 64
As we start thinking about our workflow 65 65
and we have the answers from these questions 66 66
we can develop our own processes. 67 67
Now, for example, here is going to be a simple 68 68
seven step process that we're going to walk through 69 69
in this lesson. 70 70
You don't have to follow this step by step though. 71 71
This does not mean that this is the only way to do scanning. 72 72
This is just an example for you to consider. 73 73
First, we want to install the software 74 74
and patches to establish a baseline system. 75 75
So I have a brand new server. 76 76
I installed the operating system, 77 77
I installed the antivirus, I configured it. 78 78
I installed all the software patches and updates, 79 79
and now that system is what I think 80 80
a good system should look like. 81 81
At this point, I should move into my second step 82 82
which is to perform an initial scan of that target system. 83 83
So I have this brand new system 84 84
with everything I just installed and patched 85 85
I'm going to run a scan and that creates my baseline for me. 86 86
Everything else will be compared 87 87
against this baseline moving forward. 88 88
Now, the third step I'm going to do is analyze 89 89
the assessment reports based 90 90
on that baseline I just created. 91 91
So I installed all the software, I scanned that target 92 92
and now I'm going to go 93 93
through the report and see what the findings were. 94 94
Was everything installed properly? 95 95
Did I miss something? 96 96
Are there still vulnerabilities that I'm not aware of? 97 97
If so, we'll go into step four 98 98
where we're going to perform corrective actions based 99 99
on the reported findings. 100 100
So let's say I scan this new window system 101 101
that I just installed and I found out 102 102
that I'm running a vulnerable version of IIS, 103 103
well, I need to go to Microsoft update 104 104
and get the updates to patch that system 105 105
because I want to make sure I don't have vulnerabilities 106 106
in my system. 107 107
And then I move into number five 108 108
I'm going to perform another vulnerability scan and assessment. 109 109
So I've now installed this new system, 110 110
I've scanned this new system, I've analyzed the report, 111 111
I've patched things, and now I'm going to scan again. 112 112
Why? 113 113
Because now I want to make sure the fixes I put in 114 114
actually took place 115 115
and those things are actually solving the problem. 116 116
Now, after I do this, I'm now going to go into step six. 117 117
I'm going to document any findings 118 118
and create reports for my relevant stakeholders. 119 119
So now that I have this baseline, I've patched it, 120 120
I've fixed it, I've scanned it, I've fixed it 121 121
and I've done that a couple of times 122 122
I can now create a report and say, 123 123
"Stakeholders, here is the remaining vulnerabilities. 124 124
This is the risk that you're going to be accepting 125 125
if we put this device on the network." 126 126
And by doing that 127 127
I'm giving my stakeholders a chance to accept that risk 128 128
with knowledge of what that risk actually is. 129 129
I'm not just saying I'm putting the server on 130 130
but I'm putting the server on, 131 131
and here are the five or 10 vulnerabilities we can't fix yet 132 132
but here's the mitigations we've put in place 133 133
to minimize the risk from that. 134 134
And then that gets us to number seven, which is 135 135
conducting ongoing scanning to ensure continual remediation. 136 136
Now, this is a really important point 137 137
because when you do a scan and you take a vulnerability scan 138 138
across your network or across the target, 139 139
that is a point in time assessment. 140 140
Now what I mean is if I do that today, and today is Thursday 141 141
as I'm recording this and I go and I take a scan today 142 142
and then next Wednesday we get hacked 143 143
because there's some zero day that came out 144 144
and we didn't know about it. 145 145
Well, if we only scanned it last Thursday today 146 146
and Wednesday, the new vulnerability came out 147 147
and somebody could exploit it. 148 148
Well, again, they can do that 149 149
because it's a point in time assessment. 150 150
We always need to make sure we're continually 151 151
checking our systems. 152 152
Now, does that mean 153 153
that we're going to scan our systems every day? 154 154
Maybe, maybe not. 155 155
It'd be really uncommon 156 156
for you to scan your systems every day, though 157 157
I'll tell you that. 158 158
But we are going to cover more about scan frequency later. 159 159
But the idea here is that this is not a one and done. 160 160
I don't do it once when I install the system 161 161
and never touch it again. 162 162
I need to conduct ongoing scanning, whether that's weekly, 163 163
whether that's monthly, quarterly, or yearly, 164 164
whatever that frequency is based on your risk profile 165 165
you are going to conduct ongoing scanning and patching. 166 166
Which brings us to the mantra of IT. 167 167
Whenever you are stuck on the exam 168 168
and you start talking about vulnerability assessments 169 169
I want you to remember these three words, 170 170
scan, patch, scan. 171 171
Now what does that mean? 172 172
Well, that's really the workflow I just described. 173 173
We have a system, we scanned it, 174 174
we found some vulnerabilities, we patched them 175 175
and then we scanned it again to make sure 176 176
that the patches we put in place actually worked. 177 177
And we're going to continue to do that over 178 178
and over and over again. 179 179
If you do weekly scans in your organization 180 180
you should also be doing weekly patches. 181 181
If you're doing monthly patches 182 182
but weekly scans, then guess what? 183 183
You're going to find the same vulnerabilities four times 184 184
in a row until somebody gets around to patching 'em. 185 185
That's not going to be very effective for you. 186 186
So instead, you want to make sure your scanning cycle 187 187
and your patching cycle line up. 188 188
You want to scan something, find all the problems, 189 189
patch all the problems 190 190
and then scan again to make sure those are all been fixed. 191 191
And then we'll scan again next week 192 192
or next month or next quarter or whatever your frequency is.