5 ms·

I can't help but feel the author is a little misguided about the purpose of security scanners. Security is a dynamic process, and scanners are a tool to help c

by jascii 6y ago

I can't help but feel the author is a little misguided about the purpose of security scanners. Security is a dynamic process, and scanners are a tool to help compare the current state of your systems with the policies you have set. Out of the box, the scanners can not be aware of your policies and will by necessity produce false positives.

vbezhenar 6y ago
In my experience those scanners were used for software certification. You're paying money, they run those scanners on your system, they spew meaningless warnings, you're doing meaningless actions (hopefully harmless) to mitigate those warnings and you've passed a certification, congratulations. Nobody checks whether those warnings make any sense, nobody checks what exactly did you do to mitigate those warnings, it's security theater. And that was extremely expensive scanner, I checked their website and they're selling it for big money. Probably other people find it more useful.
- dumpsterdiver 6y ago
  I've heard this sentiment repeated quite a bit by non-technical people who hover around the fringes of the security field (compliance officers and the like), that noone actually cares and we're just checking off boxes. That's not fair for those of us who really do care. As someone in offensive security, I can assure you that there's a huge difference between forgetting to check off a box to pay lip service and leaving a critical server wide open to hackers. The former will simply bounce back until you check it, the latter might put your company in the news or even out of business.
  - jascii 6y ago
    In my experience with compliance (mostly NIST 800-53) auditors will not just want to see scans, but more importantly an assessment of whether found issues were applicable and what actions are being taken to mitigate. Maybe I have just been lucky to work with particularly good auditors though.
- brendoelfrendo 6y ago
  > Nobody checks whether those warnings make any sense I mean, a professional does. I'm not sure who you're working with but mapping an automated finding to a real risk is par for the course. If anyone ever just hands you the output of a Nessus scan with no context, then you just wasted your money on their services.
whydoyoucare 6y ago
Most of the times these scanners are used to set the current state.

by jascii 6y ago

vbezhenar 6y ago

In my experience those scanners were used for software certification. You're paying money, they run those scanners on your system, they spew meaningless warnings, you're doing meaningless actions (hopefully harmless) to mitigate those warnings and you've passed a certification, congratulations. Nobody checks whether those warnings make any sense, nobody checks what exactly did you do to mitigate those warnings, it's security theater. And that was extremely expensive scanner, I checked their website and they're selling it for big money. Probably other people find it more useful.

dumpsterdiver 6y ago
I've heard this sentiment repeated quite a bit by non-technical people who hover around the fringes of the security field (compliance officers and the like), that noone actually cares and we're just checking off boxes. That's not fair for those of us who really do care. As someone in offensive security, I can assure you that there's a huge difference between forgetting to check off a box to pay lip service and leaving a critical server wide open to hackers. The former will simply bounce back until you check it, the latter might put your company in the news or even out of business.
- jascii 6y ago
  In my experience with compliance (mostly NIST 800-53) auditors will not just want to see scans, but more importantly an assessment of whether found issues were applicable and what actions are being taken to mitigate. Maybe I have just been lucky to work with particularly good auditors though.
brendoelfrendo 6y ago
> Nobody checks whether those warnings make any sense I mean, a professional does. I'm not sure who you're working with but mapping an automated finding to a real risk is par for the course. If anyone ever just hands you the output of a Nessus scan with no context, then you just wasted your money on their services.

whydoyoucare 6y ago

Most of the times these scanners are used to set the current state.