Detect and Scan Open Ports

Question

I am trying to understand two questions -

1. I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would detect open port however a Qualys/Nessus scan doesn't seem to detect. How can i make sure i get the best results when I run the scans everytime using these scanners? If I have to run NMAP on Public IP's in our AZURE environment, what would be the best practice to run these scans ?

2. how can I run scans on Cloud environment like Azure/AWS to detect for open ports on continuous basis?

Answer 1

I'll answer for Nessus and AWS.

Nessus has several options for performing port scans (e.g. netstat (WMI), SYN scan, TCP scan, and UDP scan). Some scans have specific requirements. For example:

• TCP scanning requires Nessus to be installed on Linux (otherwise this scan falls back onto a SYN scan)
• netstat (WMI) requires the target to be Windows
• Netstat 'scanner' requires the targets credentials and the target has netstat available

Assuming that you're meeting these requirements for proper scanning, then I believe you likely have a networking issue and would recommend some low-level testing of a specific example. For example, if you're performing a TCP scan and, using nmap, see port 22 open on your target, then attempt to telnet to that port at the target from your Nessus host to verify that it's accessible.

Best practice is to run port scans on both the internal and external networks to identify what's open both internally and externally. Running the scans on internal addresses within your VPC should be done from within the internal network. To protect against an attacker who has access to resources within your VPC, run the scan from within the VPC. To protect against an attacker positioned within your internal corporate network (e.g. with a direct connect to AWS), run the scan from within the corporate network (assuming this is outside of the VPC). Defense in depth would dictate performing each of these approaches and ensuring results meet your expectations.

One technique I've used to perform periodic scans: configure an AWS Lambda function to run periodically and perform the scan. It will take some scripting but is easy to configure and you have flexibility in where to send results.