External Vulnerability Assessments
We utilize third-party scanning tools such as Nessus, Qualys, or other similar third-party vulnerability scanners. These applications allow for a quick, automated scan of your organization’s external footprint for known vulnerabilities. Generally, the final report(s) turned over to the client will include:
- High-level executive summary of the most critical vulnerabilities
- General best practices recommendations for vulnerability remediation
- Raw output from the vulnerability scanning application
In some cases, that may be all your organization is looking for at the time, which makes the assessment an efficient way to obtain those results. However, a few questions that should be asked are:
- What about unknown vulnerabilities and/or misconfigurations?
- Do we have hosts/accounts that have been compromised already?
- Did we whitelist the scanning service or allow our IDS/IPS to block the traffic?
- Did we obtain results for all IP addresses that were in-scope?
- How accurate were the results that were presented to us?
If you are uncomfortable with answering some of the above questions or prefer a more in-depth picture of your organization’s external footprint, we recommend an External Penetration Test.