Senior Network Engineer at a government with 5,001-10,000 employees
Real User
2020-07-13T14:21:23Z
Jul 13, 2020
No single product will detect all vulnerabilities. That is why in security we use the concept of "defense in depth". So for example, on the outside of the network, at the Internet/Enterprise edge, we should have a Next Generation Firewall (NGFW). Palo Alto or Cisco Firepower for example. These firewalls contain excellent vulnerability scanners, as well as URL filtering, DLP, anti virus, malicious file blocking, etc. Inside the network you want to protect endpoints with something like Symantec Enterprise Security. And you want to regulate access to switchports and wireless with a NAC, such as Forescout or ISE or Clearpass, among others.
When managing these various products, be sure to turn on all the automation you can. Human eyes are too unreliable and even the best teams will miss something. You also need to be sure to allow the products to drop packets containing threat vectors, send resets to hostile actors, etc.
And it goes without saying that if you don't lock down physical access to your networking equipment your network is toast anyway.
Search for a product comparison in Vulnerability Management
Short answer: No. Long one: start with vulnerability assessment for your key systems. These are: a) anything accessible to the Internet, b) your end-user devices (PC, laptops, mobile). To cover these two (and more), I can recommend Qualys which we have been using, designing and managing for 20 years now. Additionally, to really get your external perimeter clean (that includes DNS and email), I strongly recommend Hardenize.
You wont find a single tool that will report on all the vulnerabilities that can crop up in your infrastructure. Such a tool would need to cover too many areas (On-Prem or Cloud, Network, Database(s)....). A better approach is to start by assessing what you absolutely must protect to protect your business. Work out what is critical and how it can be compromised. Then select tools to help you mitigate the risks. I would also recommend using tools that give you a Risk Assessment in an easily understood format. Some tools give pages and pages of data and leave you to figure out what it all means. If your are Public Cloud based, I would suggest you use a specialist tool such as SecureCloudDB to keep track of assets as they can spin up and down very quickly in the Cloud... so they can be part of your infrastructure without your knowledge. Equally, if you're not careful, they can come and go before you have had a chance to spot them.
Information Security Manager at a retailer with 10,001+ employees
Real User
Top 10
2022-07-11T22:11:29Z
Jul 11, 2022
Yes, and this answer is valid for any 'vulnerability analysis software' and company, independently of port/size/tool.
You can use all tools of the world and 'does not detect the entire spectrum of threats.
Threats are dynamic and assets (both software and hardware) change every day. More important than a tool (#1 out of #999 at a scoreboard) is your continuous process.
No. I think products work on vulnerability analysis have 2 streams, web application and endpoints/appliances. They don't concentrate on both at the same level. For application you can look into fortify and for endpoints/appliances you can try qualys, tenable and rapid7.
It depends on the capabilities and reliability of the vulnerability analysis tool. In case of the tool has a high reliability and a low percentage of false positives and false negatives, it may be appropriate to have a single tool.
If such as vulnerability analysis on software or application as static code analysis or purpose of SDLC review, I think currently Checkmarx , Micro Focus or Veracode should consider to this. if this is your requirement.
What kind of 'vulnerability analysis' tool are you referring to? Static code analysis for code? If so there are a couple tools that cover most languages pretty well, Checkmark and Veracode. Or are you looking for vulnerability management tools like Qualys, Tenable or Rapid7?
Threat Intelligence Platforms help organizations identify, analyze, and mitigate cyber threats through comprehensive data aggregation, real-time threat detection, and actionable insights.
These platforms offer advanced capabilities to gather threat data from multiple sources, enabling security teams to make informed decisions and respond promptly to potential threats. They integrate with existing security infrastructure and provide customizable dashboards for easier monitoring.
...
No single product will detect all vulnerabilities. That is why in security we use the concept of "defense in depth". So for example, on the outside of the network, at the Internet/Enterprise edge, we should have a Next Generation Firewall (NGFW). Palo Alto or Cisco Firepower for example. These firewalls contain excellent vulnerability scanners, as well as URL filtering, DLP, anti virus, malicious file blocking, etc. Inside the network you want to protect endpoints with something like Symantec Enterprise Security. And you want to regulate access to switchports and wireless with a NAC, such as Forescout or ISE or Clearpass, among others.
When managing these various products, be sure to turn on all the automation you can. Human eyes are too unreliable and even the best teams will miss something. You also need to be sure to allow the products to drop packets containing threat vectors, send resets to hostile actors, etc.
And it goes without saying that if you don't lock down physical access to your networking equipment your network is toast anyway.
Short answer: No. Long one: start with vulnerability assessment for your key systems. These are: a) anything accessible to the Internet, b) your end-user devices (PC, laptops, mobile). To cover these two (and more), I can recommend Qualys which we have been using, designing and managing for 20 years now. Additionally, to really get your external perimeter clean (that includes DNS and email), I strongly recommend Hardenize.
Happy to discuss in more detail as needed.
You wont find a single tool that will report on all the vulnerabilities that can crop up in your infrastructure. Such a tool would need to cover too many areas (On-Prem or Cloud, Network, Database(s)....). A better approach is to start by assessing what you absolutely must protect to protect your business. Work out what is critical and how it can be compromised. Then select tools to help you mitigate the risks. I would also recommend using tools that give you a Risk Assessment in an easily understood format. Some tools give pages and pages of data and leave you to figure out what it all means. If your are Public Cloud based, I would suggest you use a specialist tool such as SecureCloudDB to keep track of assets as they can spin up and down very quickly in the Cloud... so they can be part of your infrastructure without your knowledge. Equally, if you're not careful, they can come and go before you have had a chance to spot them.
Yes, and this answer is valid for any 'vulnerability analysis software' and company, independently of port/size/tool.
You can use all tools of the world and 'does not detect the entire spectrum of threats.
Threats are dynamic and assets (both software and hardware) change every day. More important than a tool (#1 out of #999 at a scoreboard) is your continuous process.
No. I think products work on vulnerability analysis have 2 streams, web application and endpoints/appliances. They don't concentrate on both at the same level. For application you can look into fortify and for endpoints/appliances you can try qualys, tenable and rapid7.
It depends on the capabilities and reliability of the vulnerability analysis tool. In case of the tool has a high reliability and a low percentage of false positives and false negatives, it may be appropriate to have a single tool.
If such as vulnerability analysis on software or application as static code analysis or purpose of SDLC review, I think currently Checkmarx , Micro Focus or Veracode should consider to this. if this is your requirement.
What kind of 'vulnerability analysis' tool are you referring to? Static code analysis for code? If so there are a couple tools that cover most languages pretty well, Checkmark and Veracode. Or are you looking for vulnerability management tools like Qualys, Tenable or Rapid7?