Network Security Scanner - Bộ quét an ninh mạng: Phát hiện gì & Cách hoạt động
Network Security Scanner (Vulnerability Scanner) là công cụ tự động quét mạng, hệ thống, ứng dụng để phát hiện lỗ hổng bảo mật, cấu hình sai, và rủi ro tuân thủ.
Phát hiện được gì? (Detection Capabilities)
- Known Vulnerabilities (CVE): So sánh version dịch vụ/phần mềm với database CVE (NVD, Vendor advisory)
- Misconfigurations: Default credentials, Open ports không cần, Weak crypto (TLS 1.0/1.1, weak cipher), Exposed services (SMB, RDP, Database, Redis, Elasticsearch)
- Missing Patches / Updates: OS, Firmware, Application, Library, Container base image
- Weak Authentication: Default/weak passwords, No MFA, Anonymous access, Weak SSH config
- Information Disclosure: Banner grabbing, Directory listing, Error messages, Version disclosure, Sensitive files (.git, .env, backup)
- Compliance Gaps: PCI-DSS, HIPAA, GDPR, ISO 27001, CIS Benchmarks, STIG
- Malware/Backdoor Indicators: Known malicious files, webshells, suspicious scripts, C2 callbacks
- Network Architecture Issues: Flat network, No segmentation, Insecure protocols (Telnet, FTP, SNMPv1/v2c, HTTP)
Các loại Vulnerability Scanner
| Loại | Mô tả | Công cụ tiêu biểu |
|---|---|---|
| Network-based Scanner | Quét từ ngoài mạng, không cần agent. Scan IP range, port, service, vuln | Nessus, OpenVAS/GVM, Nexpose/InsightVM, Qualys VM, Rapid7, Nmap NSE |
| Host-based / Agent-based Scanner | Cài agent trên endpoint/server. Quét deep: registry, patch level, config file, running process | Qualys Cloud Agent, Rapid7 Insight Agent, Tenable.io Agent, Wazuh, Osquery, Microsoft Defender for Endpoint |
| Wireless Scanner | Quét bảo mật WiFi: Rogue AP, Weak encryption (WEP/WPA), WPS, Evil Twin, Client probe | Kismet, Aircrack-ng suite, Wifite, Ekahau, NetSpot, Acrylic WiFi |
| Application / Web Scanner (DAST/SAST/IAST/SCA) | Quét lỗ hổng ứng dụng web/API: OWASP Top 10, Business Logic, API Security | Burp Suite Pro, OWASP ZAP, Acunetix, Invicti, Checkmarx, SonarQube, Snyk, Semgrep |
| Database Scanner | Quét cấu hình DB, quyền user, patch level, sensitive data exposure | Imperva, Trustwave, AppDetectivePRO, SQLMap (specialized) |
| Cloud / Container Scanner | Quét IaC (Terraform, CloudFormation, K8s YAML), Container Image, Cloud Config (CSPM) | Wiz, Orca, Prisma Cloud, Aqua, Trivy, Checkov, tfsec, KICS, Kubescape |
Cơ chế hoạt động (How it works)
- Discovery / Reconnaissance: Host discovery (Ping sweep, ARP, SYN), Port scanning (SYN, Connect, UDP), Service enumeration (Banner grabbing, Version detection)
- Vulnerability Checks: Non-intrusive (Version check, Banner, Config) vs Intrusive (Exploit attempt, Credentialed scan, Fuzzing)
- Credentialed / Authenticated Scan: Đăng nhập SSH/WinRM/SNMP/DB/API để quét deep (Patch level, Registry, Config file, Installed software) - Độ chính xác cao hơn nhiều
- Correlation & Scoring: Map findings → CVE → CVSS Score (Base/Temporal/Environmental) → Risk Rating (Critical/High/Medium/Low/Info)
- Reporting: Executive Summary, Technical Findings, Remediation Guidance, Compliance Mapping, Trend Analysis
Top công cụ Vulnerability Scanner (2024)
| Công cụ | Loại | Licensing | Điểm mạnh |
|---|---|---|---|
| Tenable Nessus / Tenable.io | Network + Agent + Cloud | Proprietary (Free 16 IP) | Plugin nhiều nhất (~180k), CVSS, Compliance, IT/OT/Cloud, Industry standard |
| Rapid7 InsightVM / Nexpose | Network + Agent + Cloud | Proprietary | Real-time risk scoring (Risk Score), Remediation projects, Automation, Metasploit integration |
| Qualys VMDR | Cloud-native + Agent | Proprietary | No on-prem scanner needed, Continuous monitoring, Patch integration, Cloud/Container |
| OpenVAS / Greenbone GVM | Network (Open Source) | GPL (Free) | Miễn phí, plugin feed daily, Docker/VM appliance, Community support |
| Nmap + NSE Scripts | Network (CLI) | GPL (Free) | Linh hoạt, script vuln/custom, Foundation của nhiều scanner khác |
| Microsoft Defender Vulnerability Management | Agent-based (Built-in Win10/11/Server) | Included M365 E5 / Defender for Endpoint P2 | Zero deploy, Real-time, Integrated Defender stack, Software Inventory |
| Wiz / Orca Security / Prisma Cloud | Cloud-Native (Agentless + Agent) | Proprietary | Graph-based attack path, Cloud/Container/IaC, DSPM, CIEM |
| Trivy / Grype / Syft | Container/Image/IaC Scanner | Apache 2.0 (Free) | Fast, CI/CD integration, SBOM, Misconfig, Secret scanning |
Quy trình quét lỗ hổng chuẩn (Vulnerability Management Lifecycle)
- Scope & Planning: Xác định tài sản (Asset Inventory), Ưu tiên (Critical assets first), Lịch quét (Window, Bandwidth)
- Scan Configuration: Credentialed scan (SSH/WinRM/SNMP), Safe checks only (Production), Rate limiting, Exclusions
- Execution: Chạy quét (Scheduled / On-demand / Continuous)
- Analysis & Prioritization: Loại False Positive, Risk-based prioritization (CVSS + Threat Intel + Asset Criticality + Exploitability - EPSS), SLA remediation
- Remediation / Mitigation: Patch, Config change, Compensating control, WAF rule, Network segmentation, Accept risk (Documented)
- Verification: Re-scan targeted (Delta scan) xác nhận fix
- Reporting & Metrics: MTTR (Mean Time To Remediate), Vulnerability Aging, Risk Score Trend, Compliance Status
Quét lỗ hổng nội bộ (Internal Vulnerability Scan)
- Góc nhìn: Insider / Compromised host / Lateral movement
- Quét: Workstation, Server, Printer, IoT, Switch, Router, IP Phone, Camera, Building Management
- Credentialed scan quan trọng: Domain Admin / Local Admin / Service Account
- Phát hiện: Unpatched workstation, Weak local policy, Misconfigured service, Shadow IT, Rogue device
Lưu ý pháp lý & Đạo đức
- Chỉ quét hệ thống SỞ HỮU HOẶC CÓ SỰ CHO PHÉP VĂN BẢN
- Mỹ: Computer Fraud and Abuse Act (CFAA) - Quét trái phép có thể bị kiện dân sự/형 sự
- Việt Nam: Luật An ninh mạng, Luật An toàn thông tin - Tuân thủ quy trình thẩm định
- Bug Bounty: Chỉ test trong scope, tuân thủ rules of engagement (RoE)
Kết luận
Network Security Scanner là "chiếc kính hiển vi" cho tư thế bảo mật. Quan trọng không phải quét, mà: Credentialed Scan, Prioritization dựa trên rủi ro thực (Risk-based), Remediation kịp thời (SLA), Verification, Continuous Monitoring. Kết hợp Network + Host + Cloud + App + Container scanner để có bức tranh toàn cảnh (Unified Vulnerability Management).