{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/vulnerability-scanning","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/vulnerability-scanning/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/vulnerability-scanning/"},"term":{"en":"Vulnerability scanning","da":"Sårbarhedsscanning"},"aka":{"en":["vulnerability scan"],"da":["vulnerability scanning","sårbarhedsscan"]},"domain":["security"],"cluster":"controls","layer":"host","status":"current","era":1995,"summary":{"en":"An automatic, repeated check of systems against a list of known weaknesses, producing a report of what was found.","da":"Et automatisk, gentaget tjek af systemer mod en liste over kendte svagheder, som giver en rapport over fundene."},"body":{"formal":{"en":"The use of a tool that contacts each system on the network, identifies its software, version and settings, and matches them against a public list of known weaknesses, producing findings with a severity score.","da":"Brug af et værktøj, der kontakter hvert system på netværket, finder dets software, version og indstillinger og sammenligner dem med en offentlig liste over kendte sårbarheder, så man får fund med en alvorsgrad."},"plain":{"en":"Like a mechanic plugging a reader into your car that lists every known fault code - quick and thorough, but it only finds problems already on its list.","da":"Som når mekanikeren sætter en læser i bilen, der viser alle kendte fejlkoder - hurtigt og grundigt, men den finder kun problemer, der allerede står på listen."},"inPractice":{"en":"Every Sunday night a scan runs across all of a municipality's servers; on Monday the IT operations manager gets a report showing two machines still running an old version with a known serious flaw.","da":"Hver søndag nat kører en scanning over alle kommunens servere; mandag får den IT-driftsansvarlige en rapport, der viser, at to maskiner stadig kører en gammel version med en kendt alvorlig fejl."},"whyItMatters":{"en":"New weaknesses are announced every day; regular automatic checks are the only practical way to know which of your systems are affected before attackers do.","da":"Der offentliggøres nye svagheder hver dag; jævnlige automatiske tjek er den eneste praktiske måde at vide, hvilke af ens systemer der er ramt, før angriberne gør."}},"deepDive":{"en":"Network vulnerability scanning dates from SATAN (Security Administrator Tool for Analyzing Networks), released by Dan Farmer and Wietse Venema in 1995, followed by Nessus in 1998; when Nessus became proprietary in 2005, the open-source fork became OpenVAS, today maintained by Greenbone. A scan runs in stages: host discovery (ICMP, TCP and ARP probes), port scanning, service and version fingerprinting from banners and protocol behaviour, and then vulnerability checks, which are either version-based (the detected product and version are matched to CVE records, typically via CPE identifiers from the NVD) or active (a benign probe that tests for the flaw directly, such as a specific request that a vulnerable server answers differently).\n\nThe distinction between unauthenticated and authenticated (credentialed) scans is fundamental. An unauthenticated scan sees only what an attacker on the network sees and must infer versions from banners, which produces both false positives - Linux distributions such as RHEL backport security fixes without changing the upstream version string - and false negatives for client-side software that exposes no port. An authenticated scan logs in over SSH, SMB/WinRM or an agent and reads installed package lists, registry keys and configuration directly, which is far more accurate and also enables configuration compliance checks against CIS Benchmarks via SCAP content. Agent-based scanning covers laptops that are rarely on the corporate network. Further variants are external attack-surface scanning of internet-facing assets, web application scanning (DAST), container image and registry scanning, and cloud configuration scanning.\n\nFrequencies are commonly set by frameworks: CIS Controls v8 Safeguard 7.5 asks for authenticated and unauthenticated scans of internal assets at least quarterly and 7.6 for scans of externally exposed assets at least monthly; PCI DSS v4.x requirement 11.3 requires internal and external scans at least every three months, with external scans performed by an Approved Scanning Vendor (ASV). Leading programmes scan continuously and trigger ad-hoc scans when a high-profile CVE is published.\n\nFindings carry CVSS scores (v3.1 is still the most common, v4.0 was published by FIRST in November 2023), but CVSS measures severity, not risk. Scanners are only as current as their plugin feeds and the vulnerability data behind them; the NVD enrichment backlog that began in 2024 showed how dependent version matching is on upstream CPE data. Scans can also disrupt fragile systems - older printers, medical devices and OT controllers can crash under aggressive probing - so scan policies, windows and exclusions must be agreed with system owners. Scanning is one input to a vulnerability assessment, which adds validation, context and prioritisation, and it is distinct from a penetration test, which exploits and chains findings to prove impact.","da":"Sårbarhedsscanning af netværk går tilbage til SATAN (Security Administrator Tool for Analyzing Networks), som Dan Farmer og Wietse Venema udgav i 1995, efterfulgt af Nessus i 1998; da Nessus blev proprietær i 2005, blev open source-forgreningen til OpenVAS, som i dag vedligeholdes af Greenbone. En scanning forløber i trin: opdagelse af værter (ICMP-, TCP- og ARP-forespørgsler), portscanning, fingeraftryk af tjenester og versioner ud fra bannere og protokoladfærd og derefter sårbarhedstjek, som enten er versionsbaserede (det fundne produkt og versionen matches mod CVE-poster, typisk via CPE-identifikatorer fra NVD) eller aktive (en harmløs forespørgsel, der tester direkte for fejlen, fx en bestemt forespørgsel, som en sårbar server besvarer anderledes).\n\nSkellet mellem uautentificerede og autentificerede (credentialed) scanninger er grundlæggende. En uautentificeret scanning ser kun det, en angriber på netværket ser, og må udlede versioner af bannere, hvilket giver både falske positiver - Linux-distributioner som RHEL backporter sikkerhedsrettelser uden at ændre upstream-versionsnummeret - og falske negativer for klientsoftware, der ikke eksponerer en port. En autentificeret scanning logger ind via SSH, SMB/WinRM eller en agent og læser installerede pakker, registreringsnøgler og konfiguration direkte, hvilket er langt mere præcist og også muliggør tjek af konfigurationsoverholdelse mod CIS Benchmarks via SCAP-indhold. Agentbaseret scanning dækker bærbare, der sjældent er på virksomhedens netværk. Andre varianter er scanning af den eksterne angrebsflade mod internettet, scanning af webapplikationer (DAST), scanning af container-images og registries samt scanning af cloudkonfiguration.\n\nFrekvenserne fastsættes ofte af rammeværkerne: CIS Controls v8 Safeguard 7.5 kræver autentificerede og uautentificerede scanninger af interne aktiver mindst kvartalsvist og 7.6 scanning af eksternt eksponerede aktiver mindst månedligt; PCI DSS v4.x krav 11.3 kræver interne og eksterne scanninger mindst hver tredje måned, hvor de eksterne udføres af en Approved Scanning Vendor (ASV). De mest modne programmer scanner løbende og igangsætter ekstra scanninger, når en højprofileret CVE offentliggøres.\n\nFund får en CVSS-score (v3.1 er stadig mest udbredt, v4.0 blev udgivet af FIRST i november 2023), men CVSS måler alvor, ikke risiko. En scanner er aldrig mere opdateret end sine plugin-feeds og de sårbarhedsdata, der ligger bag; den efterslæb i NVD's berigelse af CVE'er, der begyndte i 2024, viste, hvor afhængig versionsmatchning er af CPE-data fra kilden. Scanninger kan også forstyrre skrøbelige systemer - ældre printere, medicoudstyr og OT-styringer kan gå ned ved aggressive forespørgsler - så scanningspolitikker, tidsvinduer og undtagelser skal aftales med systemejerne. Scanning er ét input til en sårbarhedsvurdering, som tilføjer validering, kontekst og prioritering, og adskiller sig fra en penetrationstest, der udnytter og kæder fund sammen for at bevise konsekvensen."},"edges":[{"type":"requires","to":"security/vulnerability","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/vulnerability-assessment","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"CIS Critical Security Controls v8 - Control 7","tier":"standard","publisher":"Center for Internet Security"},{"title":"NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment","tier":"standard","publisher":"NIST"}],"draft":true}