Improving effectiveness and efficiency of vulnerability management by passive scanning method

The main purpose of detecting vulnerabilities is to identify vulnerabilities before systems are exploited. Identify and analysis of vulnerabilities is the most important part of vulnerability management. Through identifying known security flaws and weaknesses, vulnerability identification tools help security practitioners to remediate and manage the existing vulnerabilities on the systems. Thus, it is crucial that the results of such tools are complete, accurate, timely and they produce vulnerability results with minimum or no side-effects on the networks. Active and passive vulnerability scanning methods can be used to achieve this goal. This study was carried out to determine which vulnerabilities on the target system can be detected complete, accurately, timely and without side-effects by using active and passive scanning methods. In this study, it has been tried to conclude that, unlike active scanning, passive scanning method is more effective and efficient because it does not interact with target systems and uses existing information in the system. Fort his reason, a test environment has been set up to perform active and passive vulnerability scans, methods was examined empirically on test environment, and evaluated these two approaches with respect to efficiency and effectiveness. Active vulnerability scans were performed on Windows XP, Windows 7, Ubuntu Linux based systems and VLC Media Player, Curl, Samba, Putty ve Windows Media Player applications with Nessus, Nexpose and OpenVAS tools. A passive scanning model using NVD database was proposed and the application was developed for model. With this application, passive scans were performed on target systems. Two separate analysis methodologies have been proposed to exemine the scan results and determine True Positive, False Positive and False Negative states. In order to evaluate the results, the two methods were compared by calculating the accuracy and precision. According to the results obtained, 74% of active scans are below 50% in terms of accuracy. This means that multiple vulnerabilities were not accurate detected by active scanning tools in target systems. On the other hand, according to the accuracy rates, 90% of the passive vulnerability scan results were higher than the active scan and above 50%. According to this result, the tendency of the passive scanning method to find all the vulnerabilities in the system is more than the active scanning method. When the results were evaluated in terms of precision, 55% of the passive scanning results were higher than the active scanning. In addition, in 88% of the results, passive scanning method was identified more True Positive vulnerabilities than active scanning. As a results of analysis and examined related work, it has been observed that passive vulnerability scanning method returns more complete and accurate results with considerably shorter scanning periods and with no side-effects on networks, compared to the active vulnerability scanning method.