Vulnerability scanning

AT&T cybersecurity consulting provides vulnerability assessment services, as part of our vulnerability and threat management services.  This assessment helps you to identify security vulnerabilities in your systems and infrastructure and to develop a remediation plan.

New and rapidly deployed technologies, changing workforces, and profit-driven malware are all affecting the way organizations must evaluate the effectiveness of existing security controls. While vulnerability scanning products and services are maturing to become the cornerstones of enterprise security posture assessments, the skill set of attackers continues to outpace such automated tools.

A vulnerability assessment is an important step to help reduce your risk. The AT&T cybersecurity consulting vulnerability assessment service provides you with an in-depth technical review of your current security posture, including analysis of data by experts and automated scanners.

Vulnerability scanning services helps determine your security posture by scanning IP addresses that support your operations and identifies network-connected devices such as servers, workstations, routers, and firewalls. The built-in asset management feature allows you to easily scan by region, line of business, or other criteria that meets your needs. The service uses various non-invasive and non-destructive tests to find vulnerabilities in the devices. Based on the number and severity of the vulnerabilities found, the service rates the risk associated with the device and the networks to which it connects. The rating is based on a complex algorithm that takes into account both the network security posture rating and the business risk associated with discovered vulnerabilities. When the service detects vulnerabilities, it can, based on predefined policies, automatically provide actionable alerts.

AT&T cybersecurity consulting—vulnerability scanning services provides these features:

• Unified web portal—allows your organization to schedule vulnerability scans, view results, and manage remediation workflow on both internal and external hosts. The unified web portal also allows for convenient 24x7 administration access to your vulnerability scanning solution.
• Policy compliance support—helps your team work towards compliance and compliance reporting with applicable corporate security policies, laws, and regulations. In addition, policy compliance support enables systematic validation to verify the effectiveness of your patch management programs.
• PCI compliance scanning—includes Approved Scanning Vendor (ASV) services that help work towards meeting Payment Card Industry Data Security Standard (PCI DSS) 3.2 control 11.2 mandating that organizations run internal and external network vulnerability scans at least quarterly and after any significant change in the network.
• Web application scanning—enables you to perform extensive testing of web applications against industry best practices, including the OWASP (Open Web Application Security Project) Top 10 Vulnerabilities. This can help discover, catalog, and identify critical web application vulnerabilities, malware, and misconfigurations.
• Customer-defined risk ratings—allows you to set a business risk level for your IP devices based on confidentiality, integrity, and availability—the triad which should be implemented in any kind of highly secure system. This helps organizations measure degrees of exposure based on impact to business therefore creating prioritized risks, allowing the IT staff to focus on the most critically exposed systems.
• Unified online reports—provides data collected from each scan engine managed by the vulnerability scanning services security operations center (SOC). These reports are available via a web portal for convenient, on-demand, and comprehensive reporting on your network security posture for in-scope devices.
• Scalable service options—applicable to organizations across different verticals and ranging in size from SMB to large enterprise by offering different levels of service beginning with the baseline that provides external and internal vulnerability scanning and reporting features. Each successive service level includes all of the features of the previous service level and adds more capabilities to target different aspects of organizational and regulatory requirements. As a result, organizations can easily select the best solution to meet their needs.
• Application Program Interface (API)—can provide valuable data programmatically via XML to other applications. Security Information and Event Management (SIEM), Intrusion Prevention System (IPS), Intrusion Detection System (IDS), and other security and compliance systems can initiate scans, obtain up-to-the-minute data about host assets, and perform various other tasks.

We provide the support you need by detecting security vulnerabilities in systems and identifying potential areas that are vulnerable to compromise or attack:

• External vulnerability assessment
• Internal vulnerability assessment
• On-demand scanning
• Quarterly scanning
• Physical scanner
• Virtual scanner

The following options are available with AT&T cybersecurity consulting—vulnerability scanning services:

Bronze service level—offers external and internal vulnerability scanning, and executive and technical reporting. This service level helps enhance your network security via an easily deployed solutions while improving your risk visibility and controlling costs.

Silver service level—provides you with all the features of the Bronze service level and adds remediation workflow management, trend reporting, activity reporting, and compliance scanning that includes PCI ASV scanning services. Silver service level provides more powerful scanning options with additional management and reporting capabilities.

Gold service level—provides you with all the features of the Bronze and Silver service levels and adds remediation prioritization/assignment, custom management summary reporting, and access to a personal security analyst. Gold service level provides vulnerability scanning and a management solution that includes expert consultation and customized support.