VULN-01

Are your systems and applications scanned with an authenticated user account for vulnerabilities (that are remediated) prior to new releases?

Explanation

This question is asking whether your organization performs authenticated vulnerability scanning on systems and applications before releasing new versions. Authenticated vulnerability scanning means the scanning tool logs into the system being tested with actual user credentials (as opposed to unauthenticated scanning, which only tests from an external perspective). Authenticated scanning provides a more comprehensive view of vulnerabilities because it can detect issues that are only visible once logged in. The question specifically asks if these scans are performed before new releases and if discovered vulnerabilities are remediated (fixed) before the release goes live. This is important for security assessments because: 1. Pre-release scanning helps identify security issues before they reach production environments 2. Authenticated scanning finds more vulnerabilities than unauthenticated scanning 3. The remediation component ensures identified issues are actually fixed 4. This practice demonstrates a mature security program with security integrated into the development lifecycle To best answer this question, you should: - Clearly state whether you perform authenticated vulnerability scanning - Explain your scanning process and tools used - Describe how scanning fits into your release cycle - Outline your remediation approach (especially for critical vulnerabilities) - Mention any exceptions to your scanning policy

Example Responses

Example Response 1

Yes, we perform authenticated vulnerability scanning on all systems and applications prior to new releases Our DevSecOps pipeline includes mandatory authenticated scans using Tenable.io and OWASP ZAP with dedicated scanning accounts that have standard user permissions Critical and high vulnerabilities must be remediated before release approval, while medium vulnerabilities require remediation within 30 days post-release Low vulnerabilities are tracked but remediated based on resource availability Our Security team reviews all scan results, and our Change Advisory Board requires clean scan results (or approved exceptions with compensating controls) before authorizing production deployment We maintain scan reports for all releases for at least 12 months.

Example Response 2

Yes, our organization conducts authenticated vulnerability scanning as part of our release management process We use a combination of Qualys for infrastructure scanning and Veracode for application scanning, both configured with dedicated service accounts that have appropriate access levels Our CI/CD pipeline automatically triggers these scans during the QA phase, and our release policy mandates that all critical and high vulnerabilities must be remediated before proceeding to production Medium vulnerabilities require documented risk acceptance from the application owner and CISO if not addressed pre-release We also perform quarterly authenticated scans on production environments to ensure ongoing security posture All scan results are documented in our vulnerability management system and tracked to resolution.

Example Response 3

No, we currently do not perform authenticated vulnerability scanning prior to new releases Our security testing process primarily relies on unauthenticated scanning using Nessus, which we recognize provides limited visibility into potential vulnerabilities We are in the process of implementing a more comprehensive vulnerability management program that will include authenticated scanning capabilities Our roadmap includes deploying Rapid7 InsightVM within the next quarter and updating our release management procedures to require authenticated scans with remediation of critical findings before release approval In the interim, we mitigate this gap through manual security code reviews for critical applications and third-party penetration testing on an annual basis.

Context

Tab
Infrastructure
Category
Vulnerability Management

ResponseHub is the product I wish I had when I was a CTO

Previously I was co-founder and CTO of Progression, a VC backed HR-tech startup used by some of the biggest names in tech.

As our sales grew, security questionnaires quickly became one of my biggest pain-points. They were confusing, hard to delegate and arrived like London busses - 3 at a time!

I'm building ResponseHub so that other teams don't have to go through this. Leave the security questionnaires to us so you can get back to closing deals, shipping product and building your team.

Signature
Neil Cameron
Founder, ResponseHub
Neil Cameron