Credentialed versus non-credentialed scans
There are two types of scans, credentialed and non-credentialed. Let's look at these in turn:
- Non-credentialed: A non-credentialed scan will monitor the network and see any vulnerabilities that the attacker would easily find; we should fix the vulnerabilities found with a non-credentialed scan first as this is what the hacker will see when he or she enters your network. For example, an administrator runs a non-credentialed scan on the network and he finds that there are three missing patches. The scan does not provide many details on these missing patches. The administrator installs the missing patches to keep the systems up to date as he can only operate on the information produced for him.
- Credentialed scan: A credentialed scan is a much safer version of the vulnerability scanner. It will provide more detailed information than a non credentialed scan. You can also set up the auditing of files and user permissions.
Note
Exam tip
:A credentialed scan...