We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard.
Qualys supply a scanner appliance for the internal network scanning, which obviously connects to the network. Our internal network is segmented into multiple subnets, each firewalled from the others. We have a network segment which is used for IT management (such as Snort and Splunk). It would seem to make sense to have the scanner appliance in this network segment. The obvious issue is that the scanner appliance needs full visibility into all the devices it will scan on the network, and I'm loathe to open up firewall ports if it can be helped. I know that someone will say that there should be a scanner appliance in each subnet, but that's not practical for us.
I can think of several possible network locations for the scanner appliance:
- In the management network
- At the most-protected segment of the network (scanning out to less-protected devices)
- At the least-protected segment of the network (scanning in to more protected devices)
- In an entirely separate subnet
So my question is that given that the appliance needs full (all ports open) access to all devices, where would you put the scanner appliance on your network and why?