Re: Scanning--more then one side to the argument

[Barrie Dempster <barrie () reboot-robot net>]

Sherman Hand wrote:
> There has been a on going discussion about the scanning results on our customers.
>
> Thought one says that "any" port on a standard nmap, showing as "open" is a security risk.
>
> Thought two says, no since some things need to show in a state of open.
>
> Should we be stating that through proactive scan, when we find any port
> showing as open, that it is a security issue waiting to happen?
>
> Or only if we can show a issue?
>
> Thoughts?
>
> Shand

Anything being "open" is a *potential* security issue. If you have a
service running there is the *potential* for it to have bugs. This is
contrasted with *actual* security issues where the port is open and the
listening service has a vulnerability.
Example:
If I run a public web server I would open a port, this has the
*potential* for security issues to occur, but as long as the service
isn't vulnerable there is no *actual* security issue.

Opening up running services does increase avenues of attack, increases
risk and is why we only run services that are necessary.

Is it a security issue waiting to happen? Yes absolutely, it can and
most likely will become a security issue.

This however is defining "security issue" as a definite attack vector.
You could also define "security issue" as "something we need to consider
in our security policy".

What exactly is the significance of the question? and in what context do
you have "security issue"

--
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

blog: http://zeedo.blogspot.com
site: http://www.bsrf.org.uk
CA: www.cacert.org

"He who hingeth aboot, getteth hee-haw" - Victor (Still Game)

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature