Security Tip: Scan Your Network For Vulnerabilities

If you think you have your computers and your network locked down pretty well you might be humbled by running a vulnerability scanner on it. This is a program that probes computers on the network for potential vulnerabilities and perhaps even gives you instructions on fixing them.

There are many excellent commercial scanners and even Microsoft has a free tool, the Microsoft Baseline Security Analyzer, which scans single systems or ranges of systems across a network for common system misconfigurations and missing security updates. This is well-worth running, but not a replacement for scanning for known vulnerabilities.

Third party scanning tools, such as Retina from eEye, the ISS Security Scanner, and AppDetective by Application Security, Inc., scan for a large number of known issues and are updated as new issues are discovered. You can specify a particular system to scan or give them an address range and they will find all systems and scan them.

I tested the free NeWT Security Scanner from Tenable Network Security and gave it my complete internal address range. It found one computer I had forgotten about and issues on some I wasn't aware of. Click here to see the scanner at work .

That was a scan I ran from inside the network, so the vulnerabilities were from the perspective of a user already inside the network. But the Servgate security appliance at the perimeter of my network would prevent many of these attacks, so it also makes sense to run the scanner from outside my network and tell it to scan my outside IP address.

This I did as well and the results were exactly what I wanted and expected them to be. A few ports were open, but only ones I specifically opened, like port 25, port 80 and IKE.

The fact that my network is more accessible on the inside than the outside is not surprising, and indicates a deliberate decision: It's the outside that I care about more for security, but one needs to be conscious of the inside as well. If some malware were to get loose on the inside, or if a hacker were to gain entry to my network, vulnerabilities and weak protections on the inside of the network could allow damage to spread further than necessary.

Such scanners can generate a flood of warnings, many of them just telling you that you did something (like open port 80 on your web server) that you plainly intended to do. So don't assume the scanner knows more than you, especially when it gives the warning a low priority. Take information from these programs as advice.