Frontline Sentinel: Improving IT Security with Vulnerability Assessments & Threat Intelligence Aug 12, 2012 – Matthew Pascucci
Threats to your IT & Network Security
are growing daily; and these threats come from an increasingly large number
of sources. These threats are real and have the potential to destroy your
business. Luckily, there are ways to minimize these threats and even prevent
future IT security breaches.
One of the first things to do is perform a network security
vulnerability assessment. A vulnerability assessment will help you identify
any potential threats and vulnerabilities currently being posed to your
network. Network & IT security vulnerability assessments have become a
standard best practice, and most regulatory groups recommend or even require
institutions to have a policy or plan that include them. The publisher of the
PCI-DSS set of requirements, The PCI Security Council, is among these
regulatory groups that now require organizations to perform assessments on a
quarterly basis.
Although this task seems very daunting, it can often be a
painless and routine process. Many organizations and businesses are choosing
to outsource vulnerability assessments and scans to reputable IT Security
firms that can consolidate all these scans inside one easily accessible
location that includes scan scheduling, report review, and remediation
recommendations. Outsourcing helps reduce the load on in-house IT
departments, and leaves this highly important task to security
experts.
Perimeter E-Security(http://Perimeterusa.com), a leading IT
Security and Network firm recommends the following 3 types of network
vulnerability scans:
External Scans: External vulnerability
scans utilize cloud-based scanners to perform scans on any external-facing
devices. Scans completed from this perspective can help organizations
understand what someone trying to break into your network would be
seeing.
Internal Scans: Internal assessment scans
are performed inside of your network, and will expose potential
vulnerabilities that an individual would see if they are past edge devices.
Scanner software can often be provided that will be installed on a virtual
machine or dedicated device, and can even be loaded on an as-needed basis on
a shared device.
PCI Scans: A
PCI scan is an external scan that includes the Statement of Attestation and
Self-Assessment Questionnaire required by the PCI-DSS set of requirements.
This scan also offers additional reporting including an overview of the
current status of your PCI compliance, along with any additional areas that
are currently out of compliance.
Going even further, Vulnerability Assessments are often
offered as on-demand or managed services to fit varying budgets and IT plans.
There will most likely be an option that is just right for the needs of your
organization. Vulnerability assessments are critical to your IT security, and
the best thing to do is start somewhere. If you neglect these security
assessments, you could be leaving a gaping hole in your network that is just
waiting to be exploited by intruders.
Matthew Pascucci is a freelance writer and
information security practitioner. You can follow him at @matthewpascucci or
his blog atwww.Frontlinesentinal.com.
