What is a Vulnerability Scanner?Published March 18, 2020 • 4 min read
A vulnerability scanner scans a network or system, including operating systems, for known weaknesses. A vulnerability scanner can also uncover such issues as improper file sharing, system misconfigurations, and outdated software.
Because of the many threats against networks and web applications, it’s important for IT administrations to use vulnerability scanners to detect these flaws. Organizations should use vulnerability scanners to conduct vulnerability scans at least once a month, but more frequently as needed for critical or high-risk systems. Best practices recommend that one or more dedicated resources from the information security team review the results of the scan and patch or remediate identified vulnerabilities immediately based on criticality.
Vulnerability scanners, which are linked to preset databases of known cybersecurity flaws, ranging from free, open-source tools to very sophisticated enterprise systems. Malware scanners, on the other hand, scan for malicious software, not necessarily the vulnerabilities they can exploit.
Network vulnerability scanners scan systems that sit on networks and detect the cybersecurity flaws that network-based attacks can exploit. The vulnerability scanners that run on individual networks can do additional vulnerability scanning to find cybersecurity vulnerabilities that an individual with access to the network can exploit.
There are also managed services available that conduct regular vulnerability scanning as well as vulnerability scanners that run on individual systems.
Other vulnerability scanners and security tools include:
- Port scanners – software applications that probe a host or server for network ports that are open.
- Web application security scanners – programs that talk with web applications to identify areas of exposure.
- For more specific information and relevant examples, see the Open Web Application Security Project (OWASP)’s a list of Vulnerability Scanning Tools.
- Network enumerators – programs that retrieve data about users and groups on networked computers.
How vulnerability scanners work
Vulnerability scanners can detect cybersecurity threats early, identify unauthorized devices on a network, identify the authorized devices on a network by device type, as well as identify the operating system and the last security patch that was applied.
Some vulnerability scanning tools look for anything that can indicate that a system has been compromised, such as any changes in the system and/or critical system files.
The first step in vulnerability scanning is to use vulnerability scanning tools to detect system weaknesses across the network. Certain vulnerability scanning tools are specifically geared to identify missing firmware updates or software patches.
The next step in vulnerability scanning is to categorize the vulnerabilities to organize action items in order of importance for IT administrators. As part of this step, vulnerability scanning tools compare the cybersecurity flaws they identify to the updated databases of known cybersecurity vulnerabilities.
Not all vulnerability scanning tools uncover cybersecurity issues as well as enable administrators to address them automatically. Some vulnerability scanning tools just focus on monitoring, not vulnerability management, which means the administrators have to determine how to address any cybersecurity issues.
Some vulnerability scanning tools address problems with devices, such as misconfigurations, likely reaching many devices at the same time. In addition to saving administrators time, these vulnerability scanning tools automate responses, better-enabling organizations to mitigate cybersecurity risks across their networks.
When the vulnerability scanning is finished, the findings of the vulnerability scanning are detailed in a report. This enables an organization to hire a network security company to help reinforce its cybersecurity and remove the existing vulnerabilities if needed.
Many vulnerability scanning tools are supported on a variety of operating systems and platforms such as Windows, Linux, and Mac OS. Examples of open-source vulnerability scanning tools are Metasploit Framework (Kali Linux is the preferred OS) and OpenVAS, while examples of commercial network security scanners are Nessus and Nexpose.
There are differences between vulnerability scanning, vulnerability assessments, penetration testing, and vulnerability management.
Both vulnerability scanning and vulnerability assessments are used in network security. However, a vulnerability assessment is not a scan. Rather, a vulnerability assessment is a one-time project with a definitive start date and end date.
A vulnerability assessment identifies, quantifies, and ranks different cybersecurity vulnerabilities that may exist within a system, a network, or a web application.
Vulnerability scanning tools, on the other hand, scan a network, system, or web application for known cybersecurity flaws. They then match any cybersecurity vulnerabilities with the ones in the databases of known cybersecurity vulnerabilities to determine whether any exist or not.
A vulnerability assessment identifies the cybersecurity risks and vulnerabilities in networks, systems, including operating systems, hardware, and web applications. Vulnerability assessments provide organizations with the data necessary to analyze and prioritize cybersecurity risks for remediation.
Vulnerability assessments typically leverage tools, such as vulnerability scanners, to identify threats and flaws within an organization’s IT infrastructure that represent potential vulnerabilities or risk exposures.
A vulnerability assessment is a key part of vulnerability management, helping companies to protect their systems and data from breaches and unauthorized access. However, unlike a vulnerability assessment, a vulnerability management process doesn’t have a set start and end date.
Rather, it is a continuous information security risk process that aims to manage an organization’s cybersecurity vulnerabilities long-term.
A penetration test is different from a vulnerability scan, as the goal of a penetration test is to identify business processes that aren’t secure, security settings that aren’t strong enough, or other cybersecurity weaknesses that a cybercriminal could exploit.
Organizations don’t have to conduct penetration tests as often as they conduct vulnerability scanning, but they should conduct penetration tests on a regular basis.
A vulnerability management process consists of ongoing cybersecurity vulnerability assessments, meaning that as soon as one vulnerability assessment is concluded, another vulnerability assessment begins. The goal is to identify anything that has changed since the last vulnerability assessment.
Vulnerability scan reports can be used as evidence of an effective vulnerability management program in the context of an audit.
Vulnerability management audits require aggregating and reviewing large volumes of evidence sourced from disparate systems and owners. Some vulnerability scanners fully automate security assessments for compliance auditors and can reduce the time between audits from once a year or once a quarter to monthly, weekly, or even daily.