CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.7  Auditing

Configuration and Log Analysis 1 More on Scanning Tools

A second type of auditing is vulnerability scanning, which may be accomplished by running system scanner programs from inside the organization, or may be accomplished by a penetration test in which someone attempts to gain access to system/network resources from outside the organization.

Some things that can be detected by scanners include:

• Servers running on each host (which might be unnecessary, and thus should be turned off).
  
  
• Vulnerability of services to known attacks (which imply that you should get an updated version of whatever software you’re using to provide that service, or possibly turn the service off until an update is available).
  
  
• Type of OS and service software running on a host (see also: OS Fingerprinting in section 1.4).
  
  
• System architecture (if you want to try a buffer overflow exploit that only works on x86-based Linux systems, you not only need to make sure that the host is running Linux and the appropriate version of the software you want to exploit… you also need to make sure it’s an x86 machine).
  
  
• Rogue hosts set up by users without the IT department’s authorization, whose configuration may or may not be known.
  
  
• Firewall rules in place (by examining TCP/IP replies, a scanner can sometimes differentiate between services that aren’t blocked by the firewall but aren’t running on a host, and services that are blocked by the firewall and may or may not be running on the host).
  
  
• Open file shares.
  
  
• Insecurely coded web pages.

If run against a single system, the scanning software may be run on the system itself (so that it has access to local files which might not be visible to external network connections), or it may run over the network. If run against a network, the software generally doesn’t even need to run on the same network being scanned. Why should you scan your network regularly? Simply, you should do this so that you know what the crackers know about your network, and have a chance to address it (hopefully) before THEY do.

Configuration and Log Analysis 1 More on Scanning Tools