Vulnerability assessment technology has evolved significantly since the initial release of SATAN about a decade ago. SATAN was a dictionary based UNIX security testing tool designed to help system administrators identifying common security problems. Second generation vulnerability scanners built upon hard-coded decision trees followed shortly. Predefined decision trees allowed minimizing the necessary probes depending on operating system and application. Their lack of flexibility however made them quickly obsolete.

Modern scanner architectures are built as inference based systems, not requiring any agent software on the target systems. They learn about each target system individually while selective probes are being exchanged with the target system. The inference based architecture is centred around highly multi-threaded engines for scanning thousands of vulnerabilities simultaneously on any system on a network. Modern scanner architectures also support multiple levels (trusted and un-trusted) of vulnerability assessment against any given target system. Un-trusted vulnerability assessments simulate the scenario of an attacker without prior knowledge about the target system, while trusted assessments leverage credentials to log into the target systems for auditing configuration and patch information. An important criterion for measuring the effectiveness of a vulnerability scanner is the comprehensiveness and accuracy of its vulnerability knowledge base. Also, the ability to report and communicate vulnerability findings in a standardized manner from the vulnerability scanner to other applications (i.e. patch distribution or configuration management) is a critical requirement.

Read this full article at Security Park

Only registered users can write comments.
Please login or register.

Powered by AkoComment!