In today’s digital world, cybersecurity is crucial if you want to detect and prevent unauthorised access to your computer systems and networks. If cybercriminals are able to gain access to your data, this can have a serious impact on your business and could cost you your reputation as well as a huge fine.
But before you panic, there is good news. As cybercriminals become increasingly sophisticated, so do the tools used to try and stop these hackers. Amongst the different security measures, you can take is vulnerability scanning.
If you’ve not heard of vulnerability scanning before, let alone used this technique in your business, then this guide is for you.
What is vulnerability scanning?
Let’s first look at what vulnerability scanning actually is. Put simply; this is the use of software tools to help identify and report any security issues (also known as vulnerabilities) that are or could affect your systems. But it’s not quite as simple as that. Typically, vulnerability scanners require thousands of automated tests, and by probing and gathering information about your systems in this way, these tools can identify any holes (or vulnerabilities) in your systems that could be exploited by hackers.
Once these vulnerabilities have been identified, businesses can begin taking precautions and bolstering their security efforts to protect the important data within. However, this is not a one-off process, and vulnerability scanning must be an ongoing part of your security strategy, frequently conducted to spot and fix any weaknesses within your systems.
The key differences between vulnerability testing and penetration testing
While we’re building on our understanding of what vulnerability scanning is, it’s important to point out that this is not the same as penetration testing. Although the definitions may seem similar, there are some vast differences. These include:
- Vulnerability scanning only identifies potential vulnerabilities, whereas a penetration test exploits these
- The scope of vulnerability scanning is business-wide and therefore requires automated tools to manage the high number of assets. It covers a much wider scope than penetration testing
- Vulnerability scanning is automated, whereas there is no automated penetration testing. It requires the use of different tools, as well as an extremely experienced person to conduct the test
- As such, the cost of vulnerability scanning is typically much lower than penetration testing
Who is vulnerability scanning for?
Now, you might be wondering whether vulnerability scanning is something you need to be doing in your business, well let us help you. Although the news headlines tend to focus on the larger, more widely known organisations that are subject to huge security breaches, every business, no matter how big or small, is a target.
So, though you may not think you have anything worth hacking, that your insurance has you covered, or that your business is too small to be a target – this is not the case. And as such, you could also be subject to large fines should you be the victim of a data breach.
Therefore, every business must develop a comprehensive security strategy to mitigate security risks, and vulnerability scanning should be a part of this.
The different types of vulnerability scanning
There are three main types of vulnerability scanners, which perform different security tasks. This is because different attack vectors require different vulnerability scanners. For example, attackers could get in through internal network vulnerabilities or unpatched software, but in order to identify these, different scans will be needed.
The three main types of vulnerability scanners include:
- Network-based vulnerability scanners: These scan the systems across your network to look for open ports and services
- Agent-based vulnerability scanners: This requires the installation of software onto each device that needs to be scanned so that a local vulnerability scan can be done and a report can be generated
- Web-application vulnerability scanners: These are specialised vulnerability scanners that focus on finding weaknesses in your web applications and website
How often should you scan your systems?
If you’re planning on adding vulnerability scanning to your security strategy (and you should be), you might be wondering how often you need to run these scans. Well, this will partly depend on what you’re scanning and why you’re doing it, but for the most part, you want to run these scans fairly regularly and definitely at least once a month, if not more.
However, if you’re a fast-moving tech company or your code or infrastructure changes on a daily basis, you should run a scan after each change that is implemented, even if this is fairly minor. And if you’re running vulnerability scans for compliance reasons, then the specific regulations should outline just how often you need to perform vulnerability scans on your systems.
How do you know what to scan?
Businesses are complex and unique, and they are made up of a whole host of different systems, software, applications and devices – so how do you know what you need to be scanning? In this final section of the guide, we’re going to help you work this out.
In the first instance, deciding what to include in your scan can be quite tricky, but there are a number of ways you can tackle this issue. In fact, there are three key scoping strategies that your business can use to help you plan your vulnerability scans most effectively. These are:
1. An exposure-based strategy
Unfortunately, any of your systems that are accessible over the internet are effectively exposed and vulnerable to an attack 24/7. As even the most unskilled hacker can find these weaknesses on the internet, this is something you need to address. Therefore, taking an exposure-based strategy could be the best place to start.
2. A sensitivity-based strategy
If your business handles a lot of sensitive customer information and this is stored in one central location, it makes sense to run vulnerability scans on the systems where the most sensitive data is stored. This helps to ensure that these important systems are as hardened to an attack as possible.
3. A coverage-based strategy
Finally, you could take a coverage-based approach. Essentially, this means covering as many systems as possible with your vulnerability scanning. In particular, you should focus on systems where gaining access to one system could lead to a breach in others.
