3.1.2. Scanning Approaches: Credentialed, Active, and Agent-Based
💡 First Principle: Each scanning approach answers a different question about your attack surface — matching the approach to the question avoids both false confidence (passive only) and unnecessary operational risk (aggressive active on sensitive systems).
Credentialed vs. Non-Credentialed Scanning:
Non-credentialed scanning probes from the outside — testing which services respond and how, checking for exposed version information, and testing for specific vulnerabilities that can be detected without authentication. This reflects what an unauthenticated external attacker sees.
Credentialed scanning authenticates to the target system (using service account credentials) and inspects it from the inside — checking installed software versions, patch levels, configuration files, registry values, and local security settings. Finds far more vulnerabilities than non-credentialed but requires managing scan credentials securely.
| Dimension | Non-Credentialed | Credentialed |
|---|---|---|
| Perspective | External attacker | Authenticated insider / attacker post-compromise |
| Findings | Exposed services, banners, unauthenticated vulns | Patch status, software inventory, local config issues |
| Credential risk | None | Scan credentials must be protected; if stolen, grant broad access |
| Coverage | Surface-level | Deep — finds 3–5x more vulnerabilities typically |
| Best for | External attack surface assessment | Internal patch and configuration compliance |
Active vs. Passive Scanning:
Active scanning sends packets and probes — definitively testing whether a vulnerability exists by attempting to exploit it or sending specific payloads. Passive scanning only observes network traffic, inferring vulnerability status from banners, protocol behavior, and software versions seen in traffic.
Passive scanning has zero operational risk (it never touches the target system) but misses many vulnerabilities that only appear under active probing. Active scanning finds more but can cause disruption on sensitive systems.
Agent-Based vs. Agentless Scanning:
Agent-based: a lightweight software agent runs on each target system, continuously reporting vulnerability status to a central console. Benefits: no remote-scan credentials to manage, continuous assessment (not point-in-time), works even when systems aren't on the network. Limitation: requires deployment and maintenance on every managed endpoint.
Agentless: the scanner connects remotely via credentials (WMI, SSH, SNMP). Benefits: no software to deploy. Limitations: requires credential management, point-in-time assessment, network access to each target.
Static vs. Dynamic Analysis:
In the context of vulnerability management (not just malware analysis):
- Static analysis examines code or binaries without execution — source code review, binary analysis, checking for known vulnerable function calls
- Dynamic analysis tests running applications — fuzzing, penetration testing, DAST (Dynamic Application Security Testing)
Fuzzing automatically generates malformed or unexpected inputs and feeds them to an application to find crashes, unexpected behavior, and memory corruption vulnerabilities. Tools like AFL (American Fuzzy Lop) are used in secure development pipelines.
Reverse engineering disassembles binaries to understand their behavior without source code — used when assessing closed-source software, analyzing malware, or evaluating hardware firmware.
⚠️ Exam Trap: Passive scanning is not inherently "better" — it's safer for sensitive targets but less thorough. The exam will present scenarios where passive scanning is the correct choice (OT/ICS environment where active scanning could disrupt industrial processes) and scenarios where its limitations make it insufficient (needing to verify actual patch levels, not just infer from banners).
Reflection Question: A healthcare organization needs to scan both corporate IT workstations and connected medical devices (infusion pumps, imaging systems). Should the same scanning approach be used for both? Justify your answer in terms of the specific risks each environment presents.
