1.5 Vulnerability scanning concepts

Question 1

Passively test security controls

Answer 1

Vulnerability scan, non intrusive.

Question 2

Intrusive vs. non-intrusive

Answer 2

Non-intrusive: purely passive techniques on a session or agent. ex. vulnerability scanners.
Intrusive: An exploitation framework uses vulnerabilities identified by a scanner and launches scripts to attempt to exploit them.

Question 3

Credentialed vs. non-credentialed

Answer 3

Credentialed: given a user account with logon rights.

Non-credentialed: proceeds without being able to logon.

Question 4

Vulnerability Scanner

Answer 4

Examines an organization’s systems, applications, and devices and compares the scan results to configuration templates plus lists of known vulnerabilities.