3.1.1. Asset Discovery and Scan Configuration
💡 First Principle: You cannot scan — or protect — what you don't know exists. Asset discovery is the prerequisite to vulnerability scanning, because unknown assets are unmanaged assets, and unmanaged assets are typically the least patched and most exploitable.
Asset Discovery Techniques:
Map scans (network scanning) send packets across IP ranges to identify which addresses have live hosts. Tools like Nmap (nmap -sn 10.0.0.0/24) perform host-discovery sweeps — note that -sn skips port scanning entirely; service and OS detection require separate flags (-sV, -O). The goal is building an inventory: what devices are on the network, what IPs do they have, and (with the deeper scans) what operating systems do they run?
Device fingerprinting identifies device type and OS from response characteristics: TCP/IP stack behavior, open port patterns, banner information, SNMP OID values. Nmap's OS detection (-O flag) uses TCP/IP fingerprinting; network management systems use SNMP to query device identity directly.
Special Considerations for Scan Configuration:
| Consideration | What It Means | Implication |
|---|---|---|
| Scheduling | When to scan | Scan during maintenance windows for sensitive systems; avoid peak business hours for aggressive scans |
| Operations | Impact on running services | Aggressive scans can spike CPU, fill logs, trip IDS/IPS rules, or crash fragile services |
| Performance | Scan speed and network load | Throttle scan rate for bandwidth-constrained or sensitive environments |
| Sensitivity levels | Some systems can't be disrupted | Medical devices, OT/ICS, legacy systems — treat with passive-only or extremely gentle scans |
| Segmentation | Can the scanner reach the target? | Scanners need network access to targets; firewalls and VLANs may require scanner placement in each segment |
| Regulatory requirements | PCI DSS, HIPAA, FedRAMP mandate specific scan types and frequencies | Quarterly external scans for PCI DSS; continuous monitoring for FedRAMP |
Internal vs. External Scanning:
- Internal scanning — Scanner inside the network perimeter. Finds vulnerabilities visible to an attacker who has already gained internal access (lateral movement paths, internal services). More findings because internal systems are less hardened.
- External scanning — Scanner outside the perimeter (or from a DMZ position). Finds what an external attacker sees: internet-facing services, open ports, exposed panels. Required by PCI DSS.
⚠️ Exam Trap: Internal scanning doesn't replace external scanning — they answer different questions. "What can an attacker who's already inside see?" vs. "What can an attacker on the internet see?" Both are required for a complete vulnerability management program.
Reflection Question: A vulnerability scanner is placed in the corporate IT network and configured to scan all subnets. It successfully scans all IT servers but returns no results for the manufacturing floor. What is the most likely cause, and what architectural change would fix it?
