{"id":4817,"date":"2022-12-14T23:49:08","date_gmt":"2022-12-15T04:49:08","guid":{"rendered":"https:\/\/consultdts.com\/?p=4817"},"modified":"2024-01-22T13:55:34","modified_gmt":"2024-01-22T18:55:34","slug":"nist-800-171-vulnerability-scanning","status":"publish","type":"post","link":"https:\/\/consultdts.com\/article\/nist-800-171-vulnerability-scanning\/","title":{"rendered":"Vulnerability scans: an essential tool for multilayer security in NIST 800-171"},"content":{"rendered":"

Sound cyber security takes diligence across all fronts, especially when the focus is on protecting Controlled Unclassified Information (CUI). NIST published special guidance in NIST SP 800-171 to protect confidentiality and establish standards for protecting sensitive federal data used in non-federal information systems. Defense contractors with access to CUI in the performance of their federal contract must comply with the controls in NIST SP 800-171 selected by their federal customer and demonstrate adequate security.<\/p>\n

Vulnerability scanning is essential to a contractor\u2019s compliance efforts. The frequency you conduct vulnerability scans depends on many factors. Any major system, organization, or infrastructure change is a prime target, along with compliance requirements and your overall security goals. Here\u2019s how to inject the right cadence of NIST vulnerability scanning frequency into your information security program.<\/p>\n

What is a vulnerability scan, and why does it matter?<\/b><\/h2>\n

We went to the source for cyber standards. According to NIST, a vulnerability scan is just what it sounds like: a technique to identify hosts\/host attributes and associated vulnerabilities. Vulnerability scanning is a valuable tactic for any organization to identify and remediate system gaps and misconfigurations before attacks happen.<\/p>\n

Often, vulnerability scans are confused with penetration tests. However, they\u2019re different tools, each with their own value. With a vulnerability scan, you have an automated process to find issues in your systems \u2013 like a missing patch or risky software \u2013 at the pace you set. Penetration testing, on the other hand, involves manual and automated simulations where a fictitious bad actor, the penetration tester, is trying to breach your network and get access to sensitive accounts and data.<\/p>\n

\"Nist<\/p>\n

How do you perform a vulnerability scan?<\/b><\/h2>\n

Vulnerability scanning software automates the process of scanning everything from network devices, servers, and workstations to applications and databases. Typically, scanning reports will list the identified vulnerabilities, rank their criticality, and suggest the associated remediation.<\/p>\n

Vulnerability scans are conducted with a variety of tools to search systems for various security vulnerabilities.<\/p>\n

Vulnerability scanning and penetration testing with NIST 800-171<\/b><\/h2>\n

NIST SP 800-171 establishes crucial standards for organizations striving for stronger security across systems. Here are the essential requirements to meet:<\/p>\n

Requirement 3.11.2<\/strong>: In addition to specifying periodic vulnerability scans, NIST describes scans as soon as new vulnerabilities are identified. Organizations should also recognize that customer software applications may require more extensive approaches, including static analysis, binary analysis, and dynamic analysis.<\/p>\n

By NIST definition, a vulnerability scan shall include:<\/p>\n