I am confused about Operating Systems scanner vs Network Scanner. Usually a network scanner such as Nessus can already check for operating systems vulnerability. So what does an operating system scanner do? Any ideas? thanks.
A network scanner interrogates the target over the network:
- determines open ports via (semi-)exhaustive search
- determines software and versions, if possible, based on banners and behavior
- checks for known vulnerabilities (e.g., does /CFIDE/administrator exist)
but it is limited by only having network access. The banner printed on port 22 will identify the SSH version, but this can be misleading - if the OS vendor has backported security fixes (common practice), then the banner may indicate an older, vulnerable version when in fact the software is newer enough to be invulnerable to those issues.
An operating system scanner uses local credentials to access the system from the inside.
- determines listening ports looking at the OS tools (e.g. netstat)
- queries exact software installations and versions
- queries installed patches and file versions to see if vulnerabilities are patched
The operating system scanner is much more complete and accurate as a result.
There are a number of scanners that fall into this category to various degrees. I can't recommend one (so many and so different) but they fall into two main categories:
Scanners or scanning services that performs "authenticated", "trusted", or "credentialed" scans; these will generally check OS configuration, patches, and installed software.
- Qualys trusted scan
- Rapid7 Nexpose authenticated scan
Tools which authenticated users run locally:
- Microsoft Baseline Security Analyzer (checks versions and patches for MS products)
- Qualys BrowserCheck (checks browsers, limited (web-related) software, OS patches, and certain OS configuration details like firewall and AV configured)
This latter "tools" category tends to be more limited in scope; for the fullest coverage, look for a scanner that supports either enterprise or cloud-based scope. (Arguably no one is going to sink the time and money into a tool that they sell for individual system users; the money is in the people who need to use it to protect entire networks).