[Autogenerated] and way move to the other sort of scanning,
which is vulnerability.
Scanning, Yes.
Quarterly, internally and externally.
Yes.
This this is actually one of the most troublesome requirements.
Uh,
in that all the other requirements don't have sort of a historical
demonstration of compliance element to them,
right?
They can all be completely fallen down.
I show up, do the assessment, and they fix it all.
You know, go and sin no more.
Right?
Great.
Um, but if you have to say, did you have four quarterly passing scans?
Right.
And in the report on compliance, the external scan section in the summer,
he says, Tell me about your four passing scans right now.
I don't think the intent is that if you've missed the cue to
scan from six months ago that you are intended to sort of sit
in the non compliant penalty box, you know,
for whatever period of time it takes you to get this four passing scans.
Uh, but it kind of feels like it, right,
and and, you know, just so with internal scans,
um,
I have a lot of clients that maybe have a relatively
small internet facing sort of surface,
but a vast internal array of systems and their
internal scans are very problematic.
Where there there's always new vulnerabilities coming up and even as they
patch them and run the risk and new things sort of crop up.
And what comes out of that what what I see is A is a
really sort of common trouble spot.
Uh, is that maybe they run a scan and they get a scan output,
you know, file from whatever utility they're using,
Uh,
but then they're not like managing those findings in some
meaningful way scanning and putting in the right,
the scanning putting in the drawer or even if they're fixing stuff.
Uh, you know, the I run a scan and I find these vulnerabilities.
And then I fix those vulnerabilities.
And then I run or re scan to show that those error fixed and I
find new vulnerabilities like you have to have.
That's the way the world works.
It was the way the world works and you have to have.
I mean, you know,
you could do with a spreadsheet or you could do it with
something more sophisticated than that.
Some sort of mechanism to track that and to say Okay,
found this vulnerability on this date,
which means I have to have it fixed by this date,
right?
And then when I ran the scan at that point,
I found some new vulnerability that then has to be fixed on some later date.
And you have to be able to sort of roll forward with that.
And you have to be able to, you know,
manage your your sort of disposition of those vulnerabilities.
If you look at it and say that's a false positive,
right and you can substantiate that great,
right.
But you need some sort of records keeping to show That's a false positive,
right?
So as a necessity, you are looking for that management process.
Exactly.
Scam Re Mediate Scan re Mediate.
Is that a managed process,
or is it someone just with the scanner and put in the drawer?
Right.
Okay, Now I often got a lot of questions about vulnerability scanning.
So let's talk about external first.
It has to be a particular type of company that does it,
and to be correct, um,
on the one thing I often so I when I used to receive
reports on compliance for service providers.
I would actually check that.
The people in scanning, we're in CSV.
Right.
You'll be surprised at how often that isn't that you still the same?
Same problem.
You do see that problem every now and again,
or or even, uh,
some of those SVS have a couple of different kinds of
vulnerability scanning service options.
Right?
And some of them are like one of them is the CSV scanning,
and one of them is some other kind of vulnerable is can.
And there's nothing wrong with that.
But don't use the knot CSV stuff for the A S V requirement,
because that's a really tight requirement from the council is
because the council actually have a program.
Where, where they test the scanners actually doing the right job, right?
Yeah, Right now, Internal scans.
Who can do those?
Does that have to be a QC?
No, no, the the organization can do their own internal scans.
Uh, if they've got the people right, people,
the people who are qualified, who understand what they're doing,
who can operate the scanning utility and who are sort of usefully independent,
right?
You don't want the sys admin zones who are
responsible for managing those systems,
then also running the vulnerability scans.
So that could be that could be sort of tricky for organizations that
don't have a big enough sort of spread of I t.
People or who don't have a separate security department or something like that.
Because maybe you just don't have enough expertise.
These object is not to hand this to, you know,
the sales person say, hey,
run the scanning utility on that because then you don't
have somebody with the right expertise.
Okay, so there's independence from the people,
maintaining the controls, effectively qualified.
Right.
You qualify.
What, you mean qualified?
They've been on the course.
They they've got an exam.
They have to be able to demonstrate to the assessor some competence.
Okay, so when you go and do an assessment, you're looking at the scans.
We also interviewing the person doing the scanning, right?
Right.
And and generally I want to see how that scanner is configured, right?
Most scanners, most vulnerability scanners are signature based, right?
Which means there are more signatures tomorrow than there were today.
Right?
Are you getting those?
Are you configuring the scanner to use the sort of correct set of signatures.
It's very easy to configure it to use a limited set, right?
And maybe that's appropriate.
Right?
Maybe you don't want to have your scanner run with tests that
could affect the denial service condition,
right?
You don't generally want to do that.
You don't have to do that from API CSS compliance standpoint.
Uh,
but you do want to make sure that you're actually testing for
sort of a usefully broad set of vulnerabilities,
right?
A question that again, lots of people ask.
This applies to internal and external scans, credentials or not credentials.
Hmm.
There is not an express requirement in any of the
language for credential scanning, right?
Eso que s I?
You have to accept non credentials.
I think I have to accept non credential scans.
Um, does that make you happy?
No.
It's super frustrating.
There are.
There are often, you know,
loads of vulnerabilities that you won't find without credential.
Scans right on.
And you know that I look at my colleagues,
uh, in my company who are part of our federal practice,
which is the, uh, standard for assessing entities that provide services to the U.
S.
Government.
Right and federal expressly requires credential scans, right?
I think they looked at, you know,
the sort of absence of that express statement in PC ideas.
Hasn't said,
Let's not do that s o they get credentialed scans and they get
all this information and frustrating TIFF.
Is that something you've passed back to?
The council is because the, you know,
the council ask every three years of feedback.
All right.
You know, I think I think the number of people have asked for it.
So from a risk perspective, you advise only client 2D credential scans.
Yeah, well, I certainly would advise that.
Yeah, I think you get better data and and,
ah,
lot of the scanning utilities anymore can provide
some other very useful services.
If their credential, they can tell you how devices error configured.
Right?
You can use your scanning utility to get some
configuration management stuff to help you,
even with things like a requirement to or requirement six.
Right.
So you know that Ah,
lot of these things converge more more if you have more sophisticated tooling.
So why wouldn't you do that?