Domain 2 Automated Vulnerability Scanners

This set of flashcards covers terminology related to automated vulnerability scanning tools, their types, potential issues, and relevant scoring systems.

Automated vulnerability scanning tools

Tools like Nessus or Qualys that scan environments for vulnerabilities in systems.

Credentialed scan

A scan where the scanning tool has the necessary credentials to log into the system, allowing for a deeper inspection.

Uncredentialed scan

A scan where the scanning tool does not have login credentials, simulating an attacker's view.

False positive

A result indicating a vulnerability exists when there is none; it shows incorrect detection.

Baseline

A documented configuration standard for how a system should be securely configured.

CVE (Common Vulnerability and Exposure)

An open-source dictionary that provides a unique identifier for reported vulnerabilities for consistency across tools.

CVSS (Common Vulnerability Scoring System)

A scoring system that rates vulnerabilities on a scale from 0 to 10 to help prioritize remediation efforts.

False negative

A scan result that indicates no vulnerabilities when there are actually vulnerabilities present, posing a serious risk.

Vulnerability

A weakness in a system that can be exploited to compromise its security.

False positives vs False negatives

False positives are false alerts of vulnerabilities, whereas false negatives are missed vulnerabilities that pose a significant danger.