Run a scanning programme against your whole lab

applied · 90 min · Objective 2.1

Task

Stop running scans and start running a scanning programme: a defined scope, a schedule, credentials that work, an external perspective, and a coverage figure you can defend. Objective 2.1 is implementing vulnerability scanning, and the implementation is everything around the scan.

Steps

  1. Define the scope from the independent inventory in the discovery lab, not from the scanner's own list of known hosts. Write down the number of assets in scope.
  2. Configure credentialed scanning for every asset, and prove authentication succeeded on each -- this is a separate check from the scan completing.
  3. Add an external perspective: scan the lab subnet from a position outside the host firewall on each VM, and compare what is reachable against what the inventory claims is exposed.
  4. Add passive discovery running continuously, so assets that appear between scans are seen.
  5. Schedule: decide the frequency per asset class and write down the reasoning, including which assets you will not scan actively and what you will do instead.
  6. Produce the programme's coverage statement: assets in scope, assets scanned, assets authenticated, and the three gaps between those numbers.
  7. Break one thing quietly -- remove a credential -- and confirm your coverage statement catches it on the next run. If it does not, the statement is decorative.

Verify

wc -l < /tmp/active.txt
awk -F, 'NR>1{print $1}' /tmp/scan-cred.csv | sort -u | wc -l
grep -ci "credentialed checks.*yes\|authentication success" /tmp/scan-cred.log
grep -ci "credentialed checks.*no\|authentication fail" /tmp/scan-cred.log

Four numbers: in scope, scanned, authenticated, failed to authenticate. The second must equal the first or you have unscanned assets; the third must equal the second or you have uncredentialed results being counted as clean. After step 7 the fourth must be non-zero -- a coverage statement that still reports full authentication after you removed a credential is measuring nothing.

Notes

The three gaps are the deliverable. "1,100 findings" is a number; "62 assets in scope, 58 scanned, 41 authenticated, 1,100 findings" is a finding, because it says how much of the estate the eleven hundred describes.

Passive discovery matters most here. Everything else in this programme measures assets you already knew about.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.