Educator: Scan Sensitivity. 2 2
In this lesson, 3 3
we're going to talk about scanner sensitivity 4 4
and when I talk about the scan sensitivity, 5 5
this is the amount and intensity 6 6
of vulnerabilities to test against a target. 7 7
As I mentioned before, 8 8
when you start scanning your network 9 9
for these vulnerabilities, 10 10
the vulnerability tool is actually going to try 11 11
to exploit these different vulnerabilities for you. 12 12
And you can actually have these things called safe scan 13 13
or not safe scan. 14 14
If you're doing a safe scan, 15 15
it won't actually try any vulnerabilities 16 16
that it thinks might corrupt your system 17 17
or crash your system. 18 18
If you do a not safe scan, 19 19
it will throw that out the window 20 20
and it will try everything it has 21 21
to find every vulnerability possible. 22 22
Now, again, this is one of those things you have to decide 23 23
when you're setting up your profiles. 24 24
One of these profiles is known as a scan template. 25 25
A scan template is going to define the settings used 26 26
for each vulnerability scan. 27 27
Now, there's lots of different types of vulnerability scans 28 28
that we're going to talk about. 29 29
We're going to talk about four basic ones here in this lesson. 30 30
We're going to talk about a discovery scan, 31 31
a fast or basic assessment scan, 32 32
a full or deep assessment scan, and a compliance scan. 33 33
When we talk about a discovery scan, 34 34
this is used to create and update 35 35
an inventory of your assets, 36 36
and it does this by conducting an enumeration 37 37
of your network by mapping it out 38 38
and it finds all of the different targets 39 39
without scanning for any vulnerabilities. 40 40
Think about this like an Nmap scan. 41 41
Essentially, your vulnerability management tool 42 42
is going to go out and do a ping sweep of the entire network 43 43
and find out who's up and who's down, 44 44
which ones have which ports open. 45 45
That's the idea of using a discovery scan. 46 46
These tend to be very fast, 47 47
at least in comparison to the other types of scans, 48 48
but they are not very in-depth. 49 49
They are mostly used for enumeration. 50 50
The next one we're going to talk about 51 51
is a fast or basic assessment scan. 52 52
This is a scan that contains options 53 53
for analyzing hosts for unpatched software vulnerabilities 54 54
and configuration issues. 55 55
Now, when we talk about this fast or basic assessment scan, 56 56
it looks something like this. 57 57
When you go to set it up, 58 58
you're going to give it a name, give it a description, 59 59
give it a place to save, 60 60
list out the targets that you want to use, 61 61
all the different IP addresses, 62 62
and then, you're going to go ahead and save it and off you go. 63 63
You'll pick out which plugins you want, 64 64
which credentials if you want to use a credentialed 65 65
or non-credentialed scan, 66 66
and it will go out and do its scan. 67 67
It's going to find anything that has a minor vulnerability 68 68
and any kind of minor configuration issues. 69 69
Now, these aren't really in-depth, 70 70
but they are going to do a basic scan, 71 71
meaning it's going to look at a couple of plugins. 72 72
When you do this under the plugins tab, 73 73
you'll actually select which ones you want to use. 74 74
If you're doing a more intense scan, 75 75
you'll select every single plugin, 76 76
but for a fast or a basic scan, 77 77
it's going to use the information 78 78
it got from the discovery scan. 79 79
It'll know that this is a Windows system 80 80
versus a Linux system, for instance, 81 81
and it will select the right plugins for that host. 82 82
Because if you're going to be scanning a Linux system, 83 83
there's no reason to have the Windows plugins enabled, 84 84
so you'll disable those, 85 85
and that will save you a lot of time. 86 86
That's the idea of a fast or a basic scan. 87 87
Now, the next one we can do is what's known 88 88
as a full or deep scan. 89 89
Now, when you deal with a full or deep assessment scan, 90 90
this is a comprehensive scan 91 91
that forces the use of more plugin types. 92 92
It's going to take you you a lot longer 93 93
to conduct this host scanning 94 94
and it has more risk of causing a service disruption. 95 95
For instance, you might turn off that safe scan function 96 96
and test every single plugin you have 97 97
even though they may crash a system. 98 98
Now, full and deep assessment scans 99 99
will ignore your previous scan result 100 100
and they are going to fully rescan every single host. 101 101
This is actually one of the nice things 102 102
about some of the fast or basic scans 103 103
is that if you've done a scan on that host before 104 104
and it already knows that this vulnerability doesn't exist 105 105
because you've patched it, 106 106
it'll skip that and save you some time. 107 107
Now, a full or deep scan won't do that. 108 108
It will ignore any previous scan you did 109 109
and it scans everything as if it was the first time, 110 110
really intrusively and really in-depth. 111 111
The last type of scan we have 112 112
is what's known as a compliance scan. 113 113
Now, a compliance scan is a scan 114 114
that's based on a compliance template or a checklist, 115 115
and this is going to ensure the controls 116 116
and configuration settings are properly applied 117 117
to a given target or host. 118 118
Now, what's a great example of a compliance scan? 119 119
Well, the one I'd love to think about is PCI DSS. 120 120
Here, for example, 121 121
you can see a template for a PCI DSS quarterly external scan 122 122
that you can run inside a Nessus. 123 123
There's really no configuration you have to do 124 124
except tell it, give it a name, give it a description, 125 125
and tell it which target you want to hit, 126 126
and it will go out and it will do that scan for you. 127 127
It's going to know exactly which plugins to look for, 128 128
exactly which configurations to look for 129 129
because this is a scan 130 130
that anybody who uses credit cards 131 131
has to run across their networks once a quarter. 132 132
And so, this is something that is very well known 133 133
and so they build it right into the tool. 134 134
This is the idea of using a compliance scan 135 135
using a template like this. 136 136
Now, some external compliance organizations 137 137
require scanning frequencies at a certain time. 138 138
I've already mentioned PCI DSS is one of them. 139 139
This is actually one 140 140
that they like to ask about on the exam sometimes. 141 141
If you see PCI DSS on the exam, 142 142
the answer is a quarterly scan. 143 143
If they ask, 144 144
which of these regulatory things requires a quarterly scan? 145 145
The answer is PCI DSS. 146 146
On the exam, 147 147
there is no other regulatory requirements 148 148
that they require you to memorize, 149 149
but for some reason, they'd love to ask PCI DSS, 150 150
and it's probably because almost every organization 151 151
uses it these days 152 152
because if you accept credit cards, 153 153
you fall subject to PCI DSS.