Validating Scan Observations on Web Security Manager Appliances

Alert Logic appliances are scanned by customers with a variety of network-based vulnerability scanners, and vulnerabilities are often reported in these scan results. Depending on what has been discovered, remediation or mitigation may be necessary, or may have already been applied in some cases. Utilize the information and table within this article to validate and/or dispute observations you encounter in your environment. 

Regarding Network Vulnerability Scanner Behavior 

It is important to note that there are many different network vulnerability scanners available in the market. Scanners vary in how they identify and classify vulnerabilities; however, one common challenge for scanners involves the inability to reliably enumerate software versions. This results in the potential for false alarms to be raised based on the scan results. 

Generic port scans can detect the services that are running and the ports that are open. This is true whether credentials are being used for scans or not. Since scanners only have access to the headers when running, it is difficult to determine which version of a given software application is running. 

For example, a customer may utilize Apache HTTPD as the chosen web server application. From scanning the customer’s web servers, the scanner may determine that Apache is running on the instance, but if it cannot enumerate the Apache version, it will report that the instance may have one or more of any of the Apache vulnerabilities ever identified. 

Managing Scanner Variability 

Due to the variability in the findings and results between vulnerability scanning engines, Alert Logic conducts scans against appliances with the Alert Logic vulnerability scanner. By standardizing the scans against the appliances with our own engine, Alert Logic can eliminate the variability of responding to scan results escalated using multiple scanning engines. Still, observations may be inferred from a detected OS version and may or may not be valid due to hardening and minimization of the OS to only serve specific functions of the applications running on the instance. 

Observation Validation 

Based on risk and impact, true positives should be either mitigated or remediated, the appliance should be upgraded to the latest version, and—depending on the purpose of the scan—invalid observations may need to be disputed. 

The table below lists detected and verified observations along with affected versions and mitigation / remediation actions: