Re: 3rd party security scan of our system

[John Jones <chianime@xxxxxxxxx>]

Do you mean a vulnerability scan?  If so, there are differing kinds.  Some
are "non-intrusive" where the scanner probes to see what OS is running,
what services are running and their versions, and tries to determine if
some kinds of exploits are viable (for instance, if the web server is
running, are the pages vulnerable to an XSS).  Basically a port scan with
some intelligence.

More in-depth would be a scan that looks deeper for exploits.  It may be
set to not worry about being non-intrusive.  If there's bad code facing the
network, it might find it and report it as vulnerable.  In unusual
instances, the probing process can cause a service to crash.

Still more in depth is a credentialed scan.  In addition to the above, it
will look for services (telnet, web, ftp) that allow signon, use the
supplied credentials, and then perform more tests.

If you move from a vulnerability scan to an assessment, a human may sign in
with the credentials and poke around to see what they can do.  Get OS
access, elevate privileges (OS and/or app), potentially do naughty things
(but in practice they stop before pulling the trigger), access restricted
data, and so on.



On Fri, Sep 20, 2013 at 1:13 PM, J Franz <franz400@xxxxxxx> wrote:

> Any hints as to what is covered by such a scan/test?
> (answer offline if preferred).
> This is a large system with 3,000 users.
> Jim
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.