Overview:
Scan for vulnerabilities in the information system and applications periodically and when new vulnerabilities affecting the system are identified.
Action Items:
3.11.2[a]
Determine if: the frequency to scan for vulnerabilities in organizational systems and applications is defined.
3.11.2[b]
Determine if: vulnerability scans are performed on organizational systems with the defined frequency.
3.11.2[c]
Determine if: vulnerability scans are performed on applications with the defined frequency.
3.11.2[d]
Determine if: vulnerability scans are performed on organizational systems when new vulnerabilities are identified.
3.11.2[e]
Determine if: vulnerability scans are performed on applications when new vulnerabilities are identified.
POTENTIAL ASSESSMENT METHODS AND OBJECTS
1
Examine: Risk assessment policy; procedures addressing vulnerability scanning; risk assessment; system security plan; security assessment report; vulnerability scanning tools and associated configuration documentation; vulnerability scanning results; patch and vulnerability management records; other relevant documents or records].
2
Interview: Personnel with risk assessment, security assessment and vulnerability scanning responsibilities; personnel with vulnerability scan analysis and remediation responsibilities; personnel with information security responsibilities; system or network administrators].
3
Test: Organizational processes for vulnerability scanning, analysis, remediation, and information sharing; mechanisms supporting or implementing vulnerability scanning, analysis, remediation, and information sharing].
Related Documents (document name and content will vary by organization):
1) Risk assessment policy
2) procedures addressing vulnerability scanning
3) risk assessment
4) system security plan
5) security assessment report
6) vulnerability scanning tools and associated configuration documentation
7) vulnerability scanning results
8) patch and vulnerability management records
9) other relevant documents or records
Additional Guidance:
Organizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned need to be readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms.
Scanning tools that facilitate interoperability include, for example, products that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Security assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning. NIST Special Publication 800-40 provides guidance on vulnerability management.
Article ID: 187
Created: September 26, 2022
Last Updated: September 26, 2022
Author: Matthew Burdick
Online URL: http://www.compliancewiki.org/article/nist-800-171-vulnerability-scanning-3-11-2-187.html