Each vulnerability scanning system contains plug-ins able to detect thousands of possible vulnerabilities, ranging from major SQL injection flaws in web applications to more mundane information disclosure issues with network devices. ## Patch Management Applying security patches to systems should be one of the core practices of any information security program, but this routine task is often neglected due to a lack of resources for preventive maintenance. One of the most common alerts from a vulnerability scan is that one or more systems on the network are running an outdated version of an operating system or application and require security patches. ## Legacy Platforms Software vendors eventually discontinue support for every product they make. This is true for operating systems as well as applications. Once they announce the final end of support for a product, organisations that continue running the outdated software put themselves at a significant risk of attack. Organisations continuing to run the unsupported product are on their own from a security perspective, and unless you happen to maintain a team of operating system developers, that's not a good situation to find yourself in. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. The solution for organisations running unsupported operating systems *is simple in its phrasing but complex in implementation*. “Upgrade to a version of Windows that is currently supported” is a pretty straightforward instruction, but it may pose a significant challenge for organisations running applications that simply can't be upgraded to newer versions of Windows. In cases where the organization simply must continue using an unsupported operating system, best practice dictates isolating the system as much as possible, preferably not connecting it to any network, and *applying as many compensating security controls as possible*, such as increased monitoring and implementing strict network firewall rules. ## Weak Configurations Vulnerability scans may also highlight weak configuration settings on systems, applications, and devices. These weak configurations may include the following: - The use of *default settings* that pose a security risk, such as administrative setup pages that are meant to be disabled before moving a system to production. - The presence of *default credentials and unsecured accounts*, including both normal user account and unsecured root accounts with administrative privileges. Accounts may be considered unsecured when they either lack strong authentication or use default passwords. - *Open ports* and services that are *not necessary to support normal system operations*. This will vary based on the function of a server or device but, in general, a system should expose only the minimum number of services necessary to carry out its function. - *Open permission*s that allow users access that violates the principle of least privilege. ## Error Messages Many application development platforms support *debug modes* that give developers crucial error information needed to troubleshoot applications in the development process. Debug mode *typically provides detailed information* on the inner workings of an application and server, as well as supporting databases. Although this information can be useful to developers, it can inadvertently assist an attacker seeking to gain information about the structure of a database, authentication mechanisms used by an application, or other details. Solving this issue requires the cooperation of developers and *disabling debug* modes on systems with public exposure. Developers should be encouraged to conduct their testing only on systems dedicated to that purpose, and it would be entirely appropriate to enable debug mode on those servers. ## nsecure Protocols Many of the *older protocols* used on networks in the early days of the Internet were *designed without security in mind.* They often failed to use encryption to protect usernames, passwords, and the content sent over an open network, exposing the users of the protocol to eavesdropping attacks. Telnet and FTP are such protocols. The solution for this issue is to simply *switch to a more secure protocol*. Fortunately, encrypted alternatives exist for both Telnet and FTP. System administrators can use Secure Shell (**SSH**) as a secure replacement for Telnet when seeking to gain command-line access to a remote system. Similarly, the Secure File Transfer Protocol (**SFTP**) and FTP-Secure (**FTPS**) both provide a secure method to transfer files between systems. ## Weak Encryption Encryption is a crucial security control used in every cybersecurity program to protect stored data and data in transit over networks. As with any control, however, *encryption must be configured securely* to provide adequate protection. When you implement encryption, you have two important choices to make: - The algorithm to use to perform encryption and decryption - The encryption key to use with that algorithm If you use a weak encryption algorithm, it may be easily defeated by an attacker. If you choose an encryption key that is easily guessable because of its length or composition, an attacker may find it using a cryptographic attack.