Category hub: Security tools and testing methods

In one sentence: Vulnerability scanning is an automated check of your systems and websites for known weaknesses, such as missing updates and risky settings, that gives you a list to fix.

What it is

A vulnerability scanner is a program that checks systems against a large list of known problems. It looks for missing security updates, outdated software, weak settings and exposed services, and reports what it finds.

The NCSC has guidance on choosing and using automated scanning tools for organisations of all sizes. It says a scan does not need to be run by an external partner and staff should not need special training. The NCSC calls the things scanned “assets”: routers, servers, websites, applications and similar items.

How it works

1. Find the assets. The scanner is told what to check, or discovers devices on a network.
2. Probe them. It identifies software and versions and compares them with known weaknesses. Some scans log in for a deeper view. Web scanners test a site from outside.
3. Report. Each finding gets a severity rating, often a CVSS score.
4. Triage. People decide what matters. The NCSC says to weigh business impact and risk, not only the score.
5. Fix and re-check. Updates are applied, or settings changed, and the scan is run again.

The NCSC stresses that scanning only reduces risk as part of a wider vulnerability management programme: discovering systems, classifying assets, detecting, triaging, fixing and giving researchers a way to report problems.

Who it affects and how badly

• Sole trader to 10 staff. Fewer systems, but websites and routers still need checking. A free scan shows what is visible from outside.
• 10 to 250 staff. Accountancy, legal, construction, retail and care providers have servers, laptops and cloud accounts that drift out of date. The NCSC warns a first full scan may list hundreds or thousands of findings, so start with the systems that matter most.
• 250 plus and regulated firms. Banks, insurers, healthcare and councils usually need regular scanning for frameworks such as Cyber Essentials Plus, ISO 27001 or PCI DSS. A missed known flaw can mean a breach, a failed audit or lost contracts.

A scan does not tell you whether a flaw can really be used against you.

Real examples

• WannaCry and the NHS, 2017. The National Audit Office found that before the attack NHS Digital had carried out on-site cyber security assessments at 88 of 236 trusts and none had passed. The attack affected NHS services between 12 and 19 May 2017. Regular scanning is one way to see which machines lack updates.
• The NCSC says a scan is particularly useful to highlight when updates are not being installed.

How to detect it

You run scans yourself, but you may also see other people’s scans of you.
– Firewall or web server logs showing many connection attempts or pages requested quickly from one address.
– Intrusion detection alerts and a rise in 404 errors on your site.
– Your own scheduled scans, labelled so they are not mistaken for attacks.

How to fix or prevent it

These steps make scanning useful.
1. Build an asset list first. You cannot scan what you do not know about.
2. Scan the whole estate at least monthly, as the NCSC advises, and internet-facing services more often.
3. Scan both the outside view and the inside view.
4. Use authenticated scans where you can.
5. Triage by business impact, exposure and known exploitation, not only CVSS.
6. Apply updates and re-scan to prove the fix worked.
7. Record any decision to leave a weakness unfixed, with an owner.
8. Back scanning with a penetration test now and then. The NCSC notes third-party tests are a good way to check the process works.

Related terms

• Penetration testing methodology
• Nmap
• CVE
• CVSS
• CISA KEV
• Exploited in the wild
• Nessus

FAQ

How often should I run a vulnerability scan?
The NCSC advises assessments across the whole estate at least every month, and more often for externally reachable services.

Does a scan need a specialist?
The NCSC says it does not need to be run by an external partner and staff should not need special training. Interpreting results takes judgement.

Is a vulnerability scan the same as a penetration test?
No. A scan checks for known weaknesses automatically. A penetration test tries to breach the system, as the NCSC defines it, using an attacker’s tools and techniques.

Sources

• https://www.ncsc.gov.uk/guidance/vulnerability-scanning-tools-and-services
• https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/carry-out-assessments
• https://www.ncsc.gov.uk/collection/vulnerability-management
• https://www.nao.org.uk/wp-content/uploads/2017/10/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.