- [Instructor] We've already discussed
many of the basic concepts
of vulnerability scanning in this course.
Let's now take a moment to dive deeper
into a few advanced vulnerability scanning topics.
As you set up a vulnerability scan you need
to carefully consider the type of scan
that you will perform.
Most scanners allow you to choose between
intrusive and non-intrusive or dangerous and safe modes.
Scans run in non-intrusive or safe mode
will not perform tests that could themselves
disrupt system operation.
This is the safest way to go when you are worried about
damaging production services.
But this mode does not provide
an accurate picture of security
because it fails to show you if those attacks
would have been successful.
One way to balance these concerns
is to run tests against production systems in safe mode
but then clone those systems running dangerous mode scans
against the images.
When you run vulnerability scans
you'll receive detailed reports of issues
discovered during the scan.
Sometimes those reports contain errors.
There are two types of error common
in vulnerability scan reports.
False positive errors occur when the scanner
detects a vulnerability that doesn't actually exist.
System administrators should investigate
each false positive report,
and once they are satisfied that the result is erroneous,
mark it in the system so that it
is not reported on future scans.
False positives may be burdensome and annoying,
but the only real danger they pose
is that people will become desensitized
to vulnerability reports if too many are false alarms.
False negative errors, on the other hand,
are far more dangerous.
They occur when a scan does not report a vulnerability
that really does exist.
This may be due to a misconfiguration of the scanner,
or it might simply be a vulnerability
that the scanner doesn't know about yet.
These errors are quite dangerous
because a true security flaw exists,
but the system administrator doesn't know about it.
So far we've spoken about vulnerability scanning
as if it were occurring from an external perspective.
And most vulnerability scanners do work that way.
They aim to give a picture of the world
from the attacker's perspective,
identifying vulnerabilities
that are obvious over the network.
Sometimes the vulnerability scanner
needs to make assumptions about system configuration
because of this limited perspective.
It is also possible to run vulnerability scans
that have full details of system configurations.
These scans, called credentialed scans,
use read only accounts to gain access
to configuration information on the scan server.
They use the details of this configuration
to reduce false positives and identify vulnerabilities
that might not be easily detected over the network.
You'll want to become familiar
with these advanced vulnerability scanning topics.
Security professionals around the world
use these tools regularly to enhance
the security of their organizations.