Instructor: Scan Reports. 2 2
In this lesson, we're going to start looking 3 3
at some scan reports 4 4
from our different vulnerability assessment tools. 5 5
Now, these scan reports are going to contain 6 6
color-coded vulnerabilities in terms of their criticality. 7 7
This allows you to very quickly identify 8 8
what is the most important things 9 9
that need to draw your attention. 10 10
For example, here on the screen, you can see a list 11 11
of several different vulnerabilities 12 12
that are being displayed. 13 13
Here are just the first six vulnerabilities 14 14
we're going to look at, and you can see the severity of them. 15 15
These are all classified as high 16 16
because they have a 10.0 or 9.3 rating 17 17
as far as criticality is concerned. 18 18
Now, if I clicked on that specific vulnerability, 19 19
it will actually give me additional details 20 20
about that vulnerability, such as how it's detected, 21 21
what can be done to fix it, 22 22
and what could be used to exploit it. 23 23
All of this is valid information 24 24
that you should be reviewing, 25 25
so you can make a determination 26 26
of what you're going to do to mitigate this risk. 27 27
Now, at any time if you want to look 28 28
at your previous scan reports, 29 29
you can do that by going back through your dashboard 30 30
of your vulnerability assessment tool. 31 31
Now again, these reports should be treated 32 32
as highly confidential, 33 33
and you should limit the access to them 34 34
to a specific group of administrators 35 35
that have the rights to look at them 36 36
because these are the keys to the kingdom. 37 37
These scans have now already told the attacker 38 38
what is on your network that is vulnerable. 39 39
So if an attacker got their hands on this scan report, 40 40
they would know exactly what to attack 41 41
and how easily to get into your network. 42 42
Now, one of the things I see a lot of people do 43 43
is they try to use automation for everything in the network. 44 44
Now, automation is a great thing to use 45 45
and it can really free up a lot of your analyst time, 46 46
but automation by itself cannot do everything for you. 47 47
For example, one of the things I see commonly done 48 48
is that people will set up these tools 49 49
to automatically scan the network, which is a good thing, 50 50
and then automatically send out those reports 51 51
via email or send an alert via email or text message 52 52
if the scan finds some non-compliant item. 53 53
Now, this is a good thing to do in theory, 54 54
but you have to be careful here 55 55
because this automatic distribution of these scan results 56 56
does make it harder for you to preserve confidentiality. 57 57
It's harder to maintain control 58 58
over all of those scan reports 59 59
when you start sending them out to everyone, 60 60
and so you want to make sure 61 61
that if you're using automation, 62 62
you really think through who's getting that, 63 63
how you're protecting it, 64 64
and are you encrypting that data 65 65
as you start sending it out. 66 66
For this reason, a lot of organizations 67 67
will do automated scans, 68 68
but those reports will stay in a centralized location 69 69
and then will have to be looked at manually 70 70
and those will be sent out additionally to the right people 71 71
in a secure method so they can look at them. 72 72
Now, this brings us to the idea of manual distribution. 73 73
When you're dealing with manual distribution reports, 74 74
this can allow you to have better control 75 75
over the contents of those reports 76 76
because you're making sure only what you want 77 77
is being seen by others, and in addition to that, 78 78
it gives your analysts a chance to explain the results. 79 79
Now, what I mean by this is you can take that report 80 80
and you can go brief it up to the senior leadership. 81 81
This might be your executives or your managers 82 82
or whoever it is that you need to brief. 83 83
Now, instead of just giving them a report 84 84
with facts and figures, you can explain to them, 85 85
"Yes, there is this vulnerability. 86 86
It affects 50% of our systems 87 87
and it's really critical because of this reason 88 88
and here's what I recommend we do to fix it." 89 89
This gives you a chance to start getting that narrative 90 90
and be able to control exactly what's going to be done 91 91
as you move forward into the future.