Overview
Vulnerability scanning is the process of inspecting digital systems to identify weaknesses in software, hardware, or configurations. These weaknesses — known as vulnerabilities — can be exploited by attackers if left unaddressed. Scanning is a core component of proactive security and vulnerability management programs.
Terminology
| Term | Definition |
|---|---|
| Vulnerability | A weakness in software, hardware, or configuration that can be exploited |
| Patching | The process of fixing a vulnerability through software or configuration changes |
| CVE | Common Vulnerabilities and Exposures; unique identifier assigned to vulnerabilities by MITRE |
| CVSS | Common Vulnerability Scoring System; standardized scoring of vulnerability severity |
| Authenticated Scan | Scan performed using host credentials; provides deeper visibility |
| Unauthenticated Scan | Scan requiring only an IP address; simulates external attacker perspective |
| Attack Surface | The total set of points where an attacker could attempt to exploit vulnerabilities |
Core Concepts
Types of Vulnerability Scans
| Type | Requires | Focus | Depth |
|---|---|---|---|
| Authenticated | Host credentials | Post-access vulnerabilities, configs, installed apps | Deep |
| Unauthenticated | IP address only | Externally exploitable vulnerabilities | Surface-level |
| Internal | Network access | Vulnerabilities exploitable from inside the network | Varies |
| External | Internet access | Vulnerabilities exploitable from outside the network | Varies |
CVE (Common Vulnerabilities and Exposures)
Unique identifiers assigned to known vulnerabilities by MITRE. CVE Example
CVE format: CVE-YEAR-DIGITS
- CVE — fixed prefix
- Year — year the vulnerability was discovered
- Arbitrary Digits — four or more unique identifying numbers
CVSS (Common Vulnerability Scoring System)
Measures the severity of vulnerabilities based on impact, ease of exploitation, and other factors.
| Score Range | Severity |
|---|---|
| 0.0 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
Common Vulnerability Scanning Tools
| Tool | Type | Notes |
|---|---|---|
| Nessus | Proprietary | Extensive scanning options; enterprise on-premises deployment |
| Qualys | Cloud-based | Compliance checks, asset management, and vulnerability scanning |
| Nexpose | Subscription | Risk scores based on asset value and impact; continuous discovery; on-premises and hybrid |
| OpenVAS | Open-source | Basic vulnerability scanning for small organizations or individual systems |
Tool-specific usage documented in Related Tools below
Related Concepts
- Vulnerability Management
- Patching Strategies
Related Techniques
Related Tools
- OpenVAS
- Nessus
References / Images
- CVE Example
- MITRE CVE database: https://cve.mitre.org
- CVSS scoring guide: https://www.first.org/cvss