Description:   

Organizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned are readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers) and in source code reviews. Vulnerability scanning includes: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms.  To facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated, scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention, and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of system vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD).  Security assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning. [SP 800-40] provides guidance on vulnerability management. 


Priority: High   


Category:  Vulnerability Management 


Services Associated with AWS:   

  • WS Security Hub (AWS Security Hub provides continuous monitoring and centralized visibility into security and compliance posture across AWS accounts It integrates with various vulnerability scanning tools and provides insights into the security posture of AWS environments) 


Objective Evidence:   

  • Administrative: documented policies, standards & procedures
  • Administrative: supporting documentation to demonstrate how IT Asset Management (ITAM) is implemented
  • Administrative: supporting documentation of a Vulnerability & Patch Management Program (VPMP) that addresses vulnerability scanning operations
  • Administrative: supporting documentation to demonstrate the scoping of vulnerability scanning operations
  • Administrative: supporting documentation of role-based security training being performed
  • Administrative: supporting documentation of professional competence by individual(s) performing Attack Surface Management (ASM) roles
  • Technical: screenshot of vulnerability scanning tool 


Possible Technology Considerations : 

  • IT Asset Management (ITAM)
  • Configuration Management Database (CMDB)
  • Vulnerability Scanning Solution 


What needs to be answered :  


Are systems periodically scanned for common and new vulnerabilities? Are previously undocumented vulnerabilities risk assessed and documented? Are reports regarding the scans made available to system owners and company management in a timely manner? Are vulnerability scans performed on a defined frequency or randomly in accordance with company policy? Is the list of scanned system vulnerabilities updated on a defined frequency or when new vulnerabilities are identified and reported? 

  • Periodic Vulnerability Scanning for Organizational Systems and Applications
    Description: This check ensures that organizations periodically scan their systems and applications for vulnerabilities, as well as perform scans when new vulnerabilities affecting those systems and applications are identified. Vulnerability scanning is essential to identify potential vulnerabilities and address them promptly to mitigate risks.     


More Details:   

Frequent vulnerability scans conducted by IT administrators.