Vulnerability scanning
In addition to auditing, which only validates controls, you need to ensure you have an on-going vulnerability scanning program. This will provide a lot of insight into your environment and will help to surface any vulnerabilities or weaknesses that exist. Let's take a look at what a vulnerability scan involves.
Preparing for a vulnerability scan
These scans or assessments look for, and identify, known vulnerabilities within your environment or systems. For example, a vulnerability scan may detect that a version and/or file that has been identified has a known vulnerability. Once a scan is complete, a report is generated that highlights any identified vulnerabilities and improvement actions. They are typically scheduled to run automatically. The following is a list of common types of vulnerability assessments that are used:
- Network/wireless assessments
- Web application assessments
- Application assessments
- Database assessments
- Host...
