I’ve Done an Information Security Scan. Now What?

ByDaniel Gottilla

I’ve Done an Information Security Scan. Now What?

Most companies already know that doing regular information security scans is good business. After all, by being proactive with your IT network, you can find weaknesses before they are exploited by hackers, malware, or simply overuse by legitimate customers. However, part of using information security scans effectively means doing more than getting that regular update: it also means doing something about it.

Vulnerability scanners and other information security scans have become a common part of almost any company that deals with technology and communication. Today’s most popular scans are faster, more accurate, and more effective at finding weaknesses than ever before – and they can be implemented by the most rudimentary IT staff.

However, one of the biggest problems with these information scans is that they only solve half of the problem. They are adept at discovering weaknesses and problems, and alerting you to them. They are not programmed to actually deal with these problems or even tell you how to go about doing it on your own.

That’s why any good vulnerability management plan will help you determine not only where your weaknesses are, but what you can do about them. For example, you will need to determine:

• How important/dangerous are each of the scan findings and how to prioritize them accordingly.
• What types of remediation strategies are available, and which ones are the best fit for you.
• How to patch, reconfigure, or upgrade your network to “fix” the problems determined by the scan.
• What the next steps are in keeping the system secure and up-to-date.

That’s why many companies turn to IT consultants or professional IT firms that specialize in vulnerability management for help. While it certainly is possible (and cost-effective) for companies to run their own information security scans, it can really help to have that professional guidance to make sure all the findings are addressed appropriately. In this way, information scanning is a lot like breaking a bone; while the x-ray technician may be great at discovering where the problem lies, you really want the doctor to set the bone. It’s the only way to heal properly and efficiently.