Vulnerability scanning: finding weaknesses before attackers do

Most successful attacks do not use secret, never-seen-before techniques. They use known weaknesses that were never fixed: an old version of a web server, a default password left in place, a service exposed to the internet by mistake. Vulnerability scanning is the routine of looking for those known weaknesses in your own systems, regularly and systematically, so that you find them before someone else does.

The shared language: CVE

When a security flaw in a product is disclosed publicly, it usually receives a CVE identifier, such as CVE-2021-44228. The CVE Program, run with the support of the US government, gives each publicly known vulnerability one unique name so that vendors, researchers, scanners and defenders all talk about the same thing. The US National Vulnerability Database (NVD) then enriches each entry with affected product versions and a severity score.

How severe? CVSS

The Common Vulnerability Scoring System (CVSS), maintained by FIRST, rates a vulnerability from 0.0 to 10.0 based on how it can be exploited (over the network or only locally, with or without credentials, with or without user interaction) and on its impact on confidentiality, integrity and availability. Scores are grouped into bands: low, medium, high and critical.

CVSS measures how bad a flaw could be, not how likely it is to hit you. Two complementary signals help prioritise: CISA’s Known Exploited Vulnerabilities catalog lists flaws actually being used by attackers, and FIRST’s Exploit Prediction Scoring System (EPSS) estimates the probability that a vulnerability will be exploited. A “medium” flaw on the KEV list, on a system facing the internet, often deserves faster action than a “critical” one buried on an isolated machine.

What a scanner actually does

Tools such as Tenable’s Nessus or the open-source OpenVAS, developed by Greenbone, follow the same broad approach. They discover which hosts are reachable and which services they expose, identify the software and versions behind those services, and compare what they find with a large, regularly updated database of vulnerability checks linked to CVEs. The result is a report listing each finding, its severity and suggested fixes.

• Unauthenticated scans look at a system from the outside, as an attacker on the network would see it.
• Authenticated (credentialed) scans log in and inspect installed software and settings directly, which finds far more and produces fewer guesses.
• Agent-based scanning runs a small program on each machine, useful for laptops that are rarely on the office network.

Reading results with judgement

Scan reports are a starting point, not a verdict. False positives happen: a scanner may flag a version number even though the vendor back-ported the fix, or misidentify a service. False negatives happen too: a scanner only knows the checks in its database and cannot see a flaw nobody has reported yet. Every finding needs a quick human check before it becomes work, and the absence of findings never means “secure”.

Scanning as a routine

1. Keep an up-to-date inventory: you cannot scan what you do not know exists.
2. Scan on a schedule (monthly at minimum, more often for internet-facing systems) and after major changes.
3. Prioritise with context: exploitation in the wild (KEV), exposure to the internet and the value of the asset, not CVSS alone.
4. Hand findings to the patch management process, covered in the next lesson, and re-scan to confirm the fix.

The same idea on a single Mac

You do not need an enterprise scanner to benefit from the idea. On a Mac, the most common known weaknesses are simply outdated apps. FireAI, with its optional threat data turned on, looks up the exact version of well-known apps it has seen connecting in the NIST NVD and CISA’s list of known exploited flaws, and lists the apps that need an update. Only the product name and version are sent for that lookup. It does not scan your network or other computers; it tells you which of your own apps are running versions with known flaws.