Create and implement a vulnerability management program

If you, as an information security professional, are tasked with maintaining the cyber defenses of an information system (IS), this is a responsibility that you cannot carry out in a haphazard manner. Given the complexity of modern computer networks, a standardized approach to IT security is necessary to ensure that all facets of the IS are protected to the utmost. As with network connectivity troubleshooting, it is simply better to follow a plan of defined steps rather than attempt to achieve your goal in an unorganized way.

As you are aware, threats to the security posture of an IS come in many forms. Unpatched software, default software settings, unnecessary software installations, weak user account policies, porous physical access control, and the absence of effective emergency response plans can all be exploited by human attackers, malicious software (malware), or unfavorable (possibly disastrous) circumstances. All of these vulnerabilities (weaknesses which could be exploited by adversaries to compromise the security posture of an IS) are what you try to eliminate in the field of information security (also known as information assurance, or IA).

To help prevent occurrences of unauthorized IS access or data breach, a systematic methodology for identifying and remediating security weaknesses is required. Vulnerability management, when implemented in such a precise and thorough manner, becomes a vulnerability management program (VMP).

Benefits of a vulnerability management program

The main aim of any VMP is to ensure that current vulnerabilities within an IS are identified, evaluated, and resolved in a timely and cost-effective manner. This goal is achieved by successfully carrying out the following steps:

• Accurately identify vulnerabilities in the overall network infrastructure;
• Monitor and verify the remediation of the vulnerabilities;
• Examine the root causes of the vulnerabilities; and
• Modify standards, policies, and processes to fix those root causes to reduce the occurrence of future vulnerabilities.

Nscan

According to Nscan’s creator, Nscan “is a port scanner, which uses the connect() method to find a list of a host’s open ports. The difference from most of other ports canners is it’s flexibility and speed.” The current version is 0.9.1, seemingly last updated in 2008. In order to install the program, I had to right-click the .exe file and choose ‘Run as Administrator’.

Currently, the main Nscan website, nscan.org, is offline but appears to be mirrored here. This creates a problem because Nscan is distributed as shareware ($19.95), but when you try to register your copy during installation, it attempts to forward you to http://www.nscan.org/?index=register to obtain a serial key. However, since nscan.org is down you cannot obtain the key.

The Nscan product registration interface

The Nscan registration prompt. Attempts to register result in failed HTTP forwards to nscan.org (site down).

Nmap, the Network Mapper

Update: this article has been revised and expanded to fully reflect the capabilities of Nmap v6.x, released on 21 May 2012.

Nmap is the de facto industry standard network scanner. It can be installed on a variety of operating systems such as Windows, Mac, and Linux, and it can be used via a command line interface or with a graphical interface (the graphical interface itself is known as Zenmap).

Why is Nmap so popular? Because it’s fast, free, open source, and very capable as it can perform not just ping sweeps, but port scanning, service identification, and operating system detection as well. Furthermore the various types of scans it performs are highly configurable.

From the command line/shell prompt, Nmap is invoked with the command nmap. The default nmap command scans hosts with the standard TCP connect method and known ports.

Default Nmap scan on a Windows Server 2003 host.