Re: Distributed Vulnerability Scanning

[Graham Toal <gtoal () UTPA EDU>]

Christopher E. Cramer wrote:

> <>On Tue, 23 Aug 2005, Jeff Giacobbe wrote:


> <>In the end though, anybody on your network with enough smarts can
> set up
> their own Nessus client/server and start scanning away, so being able to
> delegate who can/can't scan your network (from the inside) is in some
> sense a moot point.
>
>
> a very good point to remember :)

unless you have a zoned internal network architecture where it's not
*possible*
for local admins to scan any segment other than their own area.  (Something
I'm sincerely hoping will be the case with the virtual firewall architecture
available from the PIX router blades.  If not, we wasted a lot of money
;-) )

I'm a firm believer in departments doing their own scanning because they
usually know best what would be considered anomalous in their area.  And
it reduces the load on Infosecurity :-)


G