-: Authenticated scanning.
Let's talk about one of the options you'll find
inside your vulnerability management programs,
and that's authenticated or credentialed scanning.
When we talk about credentialed scanning
or authenticated scanning,
what we're really talking about is making sure
that your program has administrative rights
to the server you're trying to scan
and do your vulnerability assessment on.
Now why would you want to do that?
Well, it's because firewalls,
intrusion protection systems and other security devices
can prevent the scan from being successful
if you're doing a non-credentialed
or non-authenticated scan.
Because it looks at it as if it's an attacker
coming into the server.
So if you use an authenticated scan by giving permissions
it can overcome this issue.
This is gonna provide the scanner with rights
so that it can read the server
and see what patches it has installed,
what the configuration files are
and other things like that.
Now one of the things you want to do as a best practice
is even though you're gonna give it these rights,
you want to give it read only rights,
because it doesn't need to be able to write to the server.
And that way if the tool is compromised
or somebody gets this account
they can do less damage.
The scanner can access the operating system,
the databases, the applications on the server
and other things with this credentialed scan,
giving it the rights that it needs.
Now here on the screen I'm gonna show you
what it looks like in Nessus.
In Nessus, when you click on the credentials button
inside the adding of a policy
you can then give it the user name and password
for either the SNB account and other domain
or SNB accounts, which really works in Windows credentials.
If you're doing a Linux system,
drop down the credential type to the Linux credentials
and you can provide that root user name and password,
or a super user user name and password.
Again, it's a really simple concept,
but it's really important when you're setting up
your program to determine, am I gonna do things
in a non-credentialed scan or a credentialed scan?
If you're doing it in a non-credential scan,
you're getting the viewpoint
of what an attacker's gonna see.
If you're doing a credentialed scan
you're gonna see what an insider threat
or a system administrator could see.
That's the idea.
Now when you look at QualysGuard
it does an authenticated scan as well.
And you can see here they just call it log in credentials.
You'll give it the user name,
you'll give it the password and you'll hit save.
And it will know what that is in the future scans
when you do those scans across the network.
The other thing you can do is what's called
an agent-based scan.
And agent-based scans require you install
a small software agent onto the server
or clients that you want to scan.
And this gives it an inside out perspective
because it's actually gonna look at the host itself
or the server itself, and then outward onto the network.
It's gonna do all the scans internally,
it can do monitoring of files and registration settings
and things like that.
It can actually be combined with an intrusion detection
or intrusion protection system
sometimes with these agent-based scans.
And they're gonna take all of this data it gets
and then send it back to a centralized server,
so that you can then look at all of these things
across the enterprise and see where
your vulnerabilities exist.
So this is actually gonna work on each individual client
and then send those things back to a central server,
as opposed to starting at a server
and doing a scan of your own network.
It's kind of a backwards approach here.
Now.
The good thing about this is it can get very detailed
information because it has that software
sitting on the host itself.
The bad thing about this is you're often gonna
get into a fight with system administrators
because they don't want you installing
this agent on their systems for fear that it's gonna
take up resources and processor cycles
or just cause problems for them in general.
So if you are gonna install an agent-based product
you are gonna have to go through
the change management process of your organization,
get approval and get it pushed out to all of the end points.
And it does take up some resources for memory,
processors and disk space.
So you have to keep that in mind as well.
And that's the idea here
when we talk about authenticated scans.
(fuzzy digital tones)