-: Maintaining Scanners.
So, just like any other software tool out there,
vulnerability management tools themself are vulnerable
to vulnerabilities.
And I know that seems a little silly, but it's true.
They are software programs.
They do have coding errors and they do have bugs.
Now, as those bugs are determined,
we do get software patches that will update those.
So, we wanna make sure we're always updating our tools
to the latest version,
to ensure that they're not vulnerable themself.
The other piece that we have to deal with
when maintaining our tools is making sure
they have the latest signatures and plug-ins available,
because, for instance, earlier this year,
when we had the Wanna Cry vulnerability that was known,
we need to make sure that our tool knew how
to scan for that particular vulnerability.
And the way it does that is through an updated plug-in
or an updated signature.
These can be automated when you can do automatic updates
once a week or once a day, but it is always a good procedure
to check and make sure that your tool does have
the latest version updated before you use it.
This just ensures
that you're gonna catch all of the vulnerabilities
that are known and that you're not gonna miss anything.
So, how do you update your scanner?
Well, you need to make sure you're doing regular patching
and it's critical to ensure the scanner is secured.
This is gonna implement our bug fixes in our software code,
patches, as well as ensuring any new features
and enhancements have been brought to the scanner.
And it will improve your scan quality.
The way you do this, for instance,
in Nessus is under the Configuration tab.
You'll see here there's a web proxy you can set up.
You can tell it what your user name and password is
and it will actually just go out,
collect the new signatures, collect the new plug-ins,
and update the scanner for you.
Now, when you look at this, there are vulnerabilities
that do exist.
This is an example of Nessus,
but if you pulled up Nexpose, OpenVAS, or Qualysguard
or any of the other vulnerability scanning tools,
you'll find that they had vulnerabilities, as well.
So, here, back in 2003,
you can see the first line item there, CVE-2003-0374.
It was a vulnerability to the Nessus scanner itself
and it allowed remote access and remote code execution.
This was a critical score of 10.
It was that important.
But, again, it's been fixed since 2003,
so if you have a plug-in or updated the scanner already,
it's already covered.
But this just gives you an idea.
You could actually look up your software tool
and look how many vulnerabilities exist for Nessus,
how many exist for Qualysguard, things like that,
so you'll know where you sit.
This is just to prove to you
that there are vulnerabilities out there for these scanners,
so it is important to update your plug-ins.
The plug-ins can be set to automatically update,
like we said, and it's usually a good idea to update them
at least daily.
This will give you the newest signatures
for the latest vulnerabilities and you can check that
from your settings page to see what version you're at.
In the example here on the screen,
you'll see that Nessus has Version 6.9.2
and that was current and it's running on a LINUX platform
and it is current and it was updated,
as of December 22nd, 2016.
Again, at the time, this was current.
This is just an older picture that I pulled up
to show you what this would look like.
You'd want to compare that to today's date
and make sure you have the latest version.
So, that's the idea.
You need to make sure you're maintaining your scanners.
Ensure that you're not having a vulnerable scanner
doing your vulnerability scans,
because you're gonna miss something.
So, ensure you always check it
and you could actually put in a policy that,
before you run the tool,
part of your standard operating procedure is to ensure
that it has the latest version of the definitions
of the plug-ins and of the scanning engine itself
to ensure you don't miss anything.