-: Scoping your scans.
So we talked about that your scans have to be scoped
if you have a really large network
like I used to have because you can't get through everything
in a single period of time, so you can scope your scans.
Scoping is gonna determine how big or how small
of an area of your network you're gonna scan,
the extent of the scan.
What networks and what systems are gonna be included?
Generally, I try to group them into like things,
so I might do all my servers at once
and all of my clients at once
or all of my clients for one department
and then all my clients for another department.
How will you test your system
if it even is on the network at all?
Well, one of the ways that we can do this
is do a network scan and do like a ping sweep
or we can do a sin sweep or something of that nature
and most of these tools have that capability
built in for you.
Just give it the IP range and off it goes.
What test will be performed against the system
during a scan?
Well, there's a lot of different tests that can be performed
but you can turn those on or off using plugins
and a tool like Nessus or QualysGuard
and we'll talk more about that in the future.
The importance of your scope.
You have to develop a scope properly
and gain agreement from staff and management
because if you're gonna start scanning the
human resource systems, the human resource department
should know that and what time that's gonna happen
because it does have an impact on their systems.
While you're scanning a particular client
it does slow down that client's use
because it has to answer all of those requests
that you're scanning from.
So it does use memory, it does use CPU cycles
and things like that.
So you wanna ensure that you're not the one causing issues
during your scanning efforts.
And so if you're gonna be going after a server,
the file server and it's in the middle of the workday,
that can actually take down the server
because you're putting too much of a load on it
with all off your scans.
So you need to do it at the proper time
and the proper pace and scoping allows you to do that.
Now, the other thing you wanna look at is
minimizing your scope.
Your network segmentation is gonna allow you
to minimize your scope for compliance scans
because we talked about earlier PCI DSS as a good example.
They require that anything that processes credit cards
be scanned once a quarter and once a year externally.
Now if I have my entire network
all tied together in one big group
and only one machine does the credit card processing,
how much of the network do I need to scan
to meet compliance?
Well, all of it?
Some may have 100 machines
but only one's processing credit cards,
I gotta scan all 1000 machines.
So instead, I can segment my network and say okay,
this piece over here, these one or two machines
do my credit card processing.
These other 900 and some odd machines don't.
I can put a network segmentation between them
and by doing that I can minimize my scope
down to just what is required
for that regulation.
This is a great thing to do when you have PCI DSS, FISMA,
FISMA the whole network is government
so that's not gonna help much but FERPA
you can do this with, HIPAA you can do this with
and actually it will break your network into pieces
and the other good thing is if somebody breaks into your
regular client network, they're not gonna get into
your credit card database
because there's a segmentation there, right.
This is a good practice and I highly recommend
you consider it in building out your
vulnerability management program and your network design.
That's the idea of Scoping Scans, right.
We can scope big, we can scope small,
it's gonna depend on you, your risk appetite
and how much capacity your organization has.
And so as you go through and think about this,
think about how can I segment my networks
and how can I scope them down into smaller chunks
so I can do them at different intervals
to meet the requirements for those networks.