Performance of automated network vulnerability scanning at remediating security issues

Computers and Security

Volumn 31, Issue 2, 2012, Pages 164-175

  Holm, Hannes ^a  

^a ROYAL INSTITUTE OF TECHNOLOGY   (Sweden)

Author keywords

Network security; Security tools; Vulnerabilities; Vulnerability detection; Vulnerability remediation

Indexed keywords

ENTERPRISES NETWORKS; FALSE ALARMS; NETWORK VULNERABILITY; SECURITY HOLES; SECURITY ISSUES; SECURITY TOOLS; USABLE SECURITY; VULNERABILITIES; VULNERABILITY DETECTION; VULNERABILITY SCANNER;

POLLUTION; REMEDIATION; SCANNING;

NETWORK SECURITY;

EID: 84857364659     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2011.12.014     Document Type: Article

References (42)

1. Aminaza SecurITree 2011 http://www.amenaza.com/
2. Mandy Andress Network vulnerability assessment management Network World 2004
3. B. Arkin, S. Stender, and G. McGraw Software penetration testing Security & Privacy, IEEE 3 1 2005 84 87 (Pubitemid 40325588)
4. Beyond Security AVDS 2011 http://www.beyondsecurity.com/
5. Markus Buschle, Hannes Holm, Teodor Sommestad, Mathias Ekstedt, and Khurram Shahzad A tool for automatic enterprise architecture modeling CAISE'11 Forum 2011
6. Core Security Core impact 2011 http://www.coresecurity.com
7. Critical Watch FusionVM 2011 http://www.criticalwatch.com/products/ vulnerability-management-overview.aspx
8. A. Doupé, M. Cova, and G. Vigna Why Johnny can't pentest: an analysis of black-box web vulnerability scanners Detection of Intrusions and Malware, and Vulnerability Assessment 2010 111 131
9. eEye Retina network security scanner 2011 http://www.eeye.com/html/ products/Retina/
10. E. Fong, and V. Okun Web application scanners: definitions and functions System Sciences, 2007. HICSS 2007. 40th Annual Hawaii International Conference on 2007 IEEE 280b
11. E. Fong, R. Gaucher, V. Okun, and P.E. Black Building a test suite for web application scanners Hawaii International Conference on System Sciences, Proceedings of the 41st Annual 2008 IEEE 478
12. Jeff Forristal, and Greg Shipley Vulnerability assessment scanners Network Computing 2001
13. GFI GFI LANguard 2011 http://www.gfi.se/lannetscan/
14. Hannes Holm, Teodor Sommestad, Jonas Almroth, and Mats Persson A quantitative evaluation of vulnerability scanning Information Management & Computer Security 19 4 2011
15. J. Homer, and X. Ou SAT-solving approaches to context-aware enterprise network security management IEEE JSAC special issue on Network Infrastructure Configuration 2009
16. K. Ingols, M. Chu, R. Lippmann, S. Webster, and S. Boyer Modeling modern network attacks and countermeasures using attack graphs 2009 Annual Computer Security Applications Conference 2009 IEEE 117 126
17. S. Jajodia, S. Noel, and B. O'Berry Topological analysis of network attack vulnerability Managing Cyber Threats 2005
18. Kelly M. Kavanagh, Mark Nicolett, and John Pescatore MarketScope for vulnerability assessment 2010 Gartner RAS Core Research Note G00173772
19. A. Lazarevic, L. Ertoz, V. Kumar, A. Ozgur, and J. Srivastava A comparative study of anomaly detection schemes in network intrusion detection Proceedings of the Third SIAM International Conference on Data Mining 2003 25 36
20. Lumension Patchlink scan 2011 http://www.lumension.com/vulnerability- management.jsp
21. S. Manzuik, K. Pfeil, A. Gold, and C. Gatford Network security assessment: from vulnerability to patch 2007 Syngress
22. McAfee McAfee vulnerability manager 2011 http://www.mcafee.com/us/ products/vulnerability-manager.aspx
23. R. McDougall, and J. Anderson Virtualization performance: perspectives and challenges ahead ACM SIGOPS Operating Systems Review 44 4 2010 40 56
24. P. Mell, K. Scarfone, and S. Romanosky A complete guide to the common vulnerability scoring system (CVSS), version 2.0 2007 Forum of Incident Response and Security Teams
25. nCircle nCircle IP360 2011 http://www.ncircle.com/index.php?s=products- ccm
26. X. Ou, S. Govindavajhala, and A.W. Appel MulVAL: a logic-based network security analyzer Proceedings of the 14th conference on USENIX Security Symposium vol. 14 2005 USENIX Association 8
27. Qualys QualysGuard enterprise 2011 http://www.qualys.com/products/risk- compliance/qgent/
28. S. Quinn, D. Waltermire, C. Johnson, K. Scarfone, and J. Banghart Technical specification for the security content automation protocol (SCAP): SCAP version 1. 0 2010
29. Rapid7 NeXpose 2011 http://www.rapid7.com/nexpose/uvm.jsp
30. Saint corporation SAINT 2011 http://www.saintcorporation.com/products/ software/saintScanner.html
31. Skybox Security Skybox 2011 http://www.skyboxsecurity.com/
32. Ryan A. Skousen Information assurance report-vulnerability assessment 2009 http://iac.dtic.mil/iatac/download/vulnerability-assessment.pdf
33. Stephenson Peter Vulnerability assessment SC Magazine 2010 http://www.scmagazineus.com/vulnerability-assessment/grouptest/203/
34. Still Secure ProtectPoint 2011 http://www.stillsecure.com/services/ vulnerability-management.php
35. Symantec SecureFusion portal 2011 http://www.gideontechnologies.com/ SecureFusion-portal.asp
36. Tenable Nessus 2011 http://www.nessus.org/nessus/
37. Trustwave Trustwave 2011 https://www.trustwave.com/vulnerabilityScanning. php
38. G. Wang, and T.S.E. Ng The impact of virtualization on network performance of amazon ec2 data center INFOCOM, 2010 Proceedings IEEE 2010 IEEE 1 9
39. Chenxi Wang, Stephanie Balaouras, and Lindsey Coit The Forrester Wave™: vulnerability management, Q2 2010 2010 Forrester Research
40. R.M. Warner Applied statistics: from bivariate through multivariate techniques 2008 Sage Publications, Inc
41. S.M. Welberg Vulnerability management tools for COTS software-a comparison 2008 Twente
42. K. Ye, X. Jiang, S. Chen, D. Huang, and B. Wang Analyzing and modeling the performance in xen-based virtual cluster environment 12th IEEE International Conference on High Performance Computing and Communications (HPCC) 2010 IEEE 273 280