Configuring scan credentials
Performing authenticated scans using credentials gives you access to more comprehensive assessments of your network and assets than unauthenticated scans would. Authenticated scans can check for software applications, packages, and verify patches. Assets in the scanned site use the credentials to authenticate the scan engine the same way they would an authorized user.
Topics in this section explain how to set up and test credentials for a site as well as shared scan credentials, which you can use in multiple sites. Certain authentication options, such as SSH public key and LM/NTLM hash, require additional steps, which are covered in related topics. You can also learn best practices for getting the most out of credentials, such as expanding authentication with elevated permissions.
Shared credentials vs. site-specific credentials
Two types of scan credentials can be created in the application depending on the role or permissions of the user creating them::
- Shared credentials: Can be used across multiple sites.
- Site-specific credentials: Can be used only with the site they are configured for.
The range of actions that a user can perform with each type depends on the user’s role or permissions, as indicated in the following table:
| Credential Type | How it is created | Actions performed by Global Admin or User with Manage Site permission | Actions performed by Site Owner |
|---|---|---|---|
| Shared | A Global Administrator or user with the Manage Site permission creates it on the Administration > Vulnerability Management > Console Administration > Scans > Shared Credentials > Manage shared credentials for scans page. | Create, edit, delete, assign to a site, restrict to an asset. Enable or disable the use of the credentials in any site. | Enable or disable the use of the credentials in sites to which the Site Owner has access. |
| Site-specific | A Global Administrator or Site Owner creates it in the configuration for a specific site. | Within a specific site to which the Site Owner has access: Create, edit, delete, enable or disable the use of the credentials in that site. | Within a specific site to which the Site Owner has access: Create, edit, delete, enable or disable the use of the credentials in that site. |
Credentials and the expert system
The application uses an expert system at the core of its scanning technology in order to chain multiple actions together to get the best results when scanning. For example, if the application is able to use default configurations to get local access to an asset, then it will trigger additional actions using that access. The Vulnerability Management and Expert Systems blog outlines the benefits of this approach and can be found here: Vulnerability Management and Expert Systems . The effect of the expert system is that you may see scan results beyond those directly expected from the credentials you provided; for example, if some scan targets cannot be accessed with the specified credentials, but can be accessed with a default password, you will also see the results of those checks. This behavior is similar to the approach of a hacker and enables to find vulnerabilities that other scanners may not.