Vulnerability Scanning

Vulnerability scanning identifies vulnerabilities on your network that could potentially be exploited by people or malware. We utilize top-of-the-line scanning software that is updated with the latest vulnerabilities.

The scanning consists of two portions: external and internal scanning. We perform the external vulnerability scan by scanning the Internet facing-systems utilizing external static IP addresses that are established with your Internet Service Provider (ISP). The external vulnerability scan identifies any vulnerability that can be seen and exploited from the public Internet by an unauthorized individual or malware. The internal vulnerability scan is performed on-site and each device on the internal network is tested. The internal vulnerability scan identifies any vulnerability that can be exploited by an individual or malware within the internal network.

We analyze the results of the external and internal vulnerability scans and identify the vulnerabilities with predetermined CVSS base scores. The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and impacts of IT vulnerabilities. CVSS base scores are calculated using various metrics such as access complexity and authentication.

A clear and concise report will be provided identifying the vulnerabilities and solutions. For each vulnerability identified, a list of affected devices and other pertinent information will be provided.

Depending on your regulatory requirements or internal security policy, we can perform vulnerability scanning at your requested interval. At a minimum, we recommend performing external and internal vulnerability scans on an annual basis. We can perform external and/or internal vulnerability scans on monthly, quarterly or annual intervals.

Vulnerability tests are a form of passive intrusion and do not attempt total vulnerability verification (penetration testing) on your network. Passive intrusion does not utilize such aggressive intrusion methods as does penetration testing.