Day 27 - Validation via Vulnerability Scanning

Published: 2008-10-27
Last Updated: 2008-10-31 02:05:23 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)

The second day in our "recovery" phase: A system isn't exactly "safe" after the malware is removed. What you actually need to figure out is how the system got compromissed in the first place, and how to prevent a future compromisse. As already pointed out, just removing the malware will just get you back to getting exploited again.

What software and what tricks do you use to:

  • make sure the vulnerability was remidiated?
  • acertain some level of confidence that the malware didn't leave behind any backdoors?
  • Nessus, a popular vulnerability scanner, has recently changed licenses. Did this affect you (or not)? Are there any alternatives?
  • How do you continually monitor systems as new vulnerabilities and patches are released all the time.
     

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: Awareness2008
0 comment(s)

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]

Diary Archives