Vulnerability Scanning and Patch Management

How do I know when patches are available and whether I need them?

The process by which patches are identified as available and needed has been revolutionized by contemporary vulnerability scanning technology. A vulnerability scanner typically works on a ‘point and shoot’ basis – attach it to your network and press ‘Go’ then wait for results.

Once a new vulnerability has been found, the developer behind the affected product will work to produce a patch. As soon as the fix is available, this information is appended to the CVE documentation on the NVD website (each new vulnerability is given a CVE identifier by the National Vulnerability Database (NVD) – see the "When is a Vulnerability Not a Vulnerability" white paper).

A good scanner will always be updated with the latest knowledge of vulnerabilities, delivered via a live internet-based feed for convenience. However, in between scans, organizations are left blind to changes that could increase their attack surface, such as software installations and configuration drift. Similarly, vulnerability scanners offer no breach detection capability.

» Learn more about Breach Detection and File Integrity Monitoring here

How does vulnerability scanning work?

The scanner is equipped with ‘White Hat’ hacking capabilities, to poke around in your network, thinking and acting like a hacker to actively identify and test exploitable vulnerabilities on your systems. The scanner is continually updated with new active test routines in order to sniff out all vulnerabilities. New and updated tests share the same feed as used to deliver CVE updates.

» Check out NNT Vulnerability Tracker stats here

Are all vulnerabilities fixed using a patch?

No! Some need to be mitigated, suspended rather than eliminated, via secure, hardened configuration settings. In some instance all that is left is to provide mitigation via a Workaround, some other measure that counteracts the vulnerability, for example firewalling to prevent the access required to exploit the vulnerability.

» See more about System and Configuration hardening here.