Network Security¶
Network Security covers weaknesses in your infrastructure — servers, network devices and the services running on them. It holds three distinct kinds of assessment.
Three kinds of assessment¶
| What it is | |
|---|---|
| VA — Vulnerability Assessment | Automated scanning, usually on a schedule, usually high volume. Findings arrive from tools such as Qualys, Tenable, Nessus or Nexpose. |
| PT — Penetration Testing | Human-led testing. Lower volume, higher depth, and each finding is written by the tester. |
| Segmentation | Verification that networks that should be separated actually are — commonly a PCI DSS requirement. |
They are separated because they behave differently. A VA audit may carry thousands of machine-generated findings; a PT audit may carry a dozen carefully written ones. Reporting and workflow differ accordingly.
VA: the shape of the work¶
1 module and screen · 2 filter by status · 3 audit columns
- A scan runs in your scanning tool.
- Its results reach NxSAM, either by integration or by uploading the report.
- Findings are matched against what is already known, so a weakness seen before continues as the same record rather than becoming a new one.
- New findings are assigned SLAs by severity and become visible to asset owners.
- Owners remediate; a later scan confirms the fix; the finding is validated and closed.
The same weakness on ten hosts is ten findings
Network findings are per host. A missing patch across ten servers produces ten findings, because each host must be fixed and verified individually.
This is why VA counts are much larger than application counts, and why they move sharply when a widely-deployed component is patched.
Repeat scans and reopening¶
A finding fixed and validated, then seen again by a later scan, comes back as Reopen. Reopening is informative rather than a failure of process — it usually means a patch was rolled back, a host was rebuilt from an old image, or a configuration drifted.
Persistent reopening on the same host is worth investigating as a build or configuration problem rather than as a series of unrelated findings.
Working with high-volume findings¶
VA generates far more findings than anyone can address individually, so it is normally worked in groups:
- Filter by severity and by asset criticality together — Critical findings on production assets first.
- Group by vulnerability rather than by host when a single patch resolves many findings at once.
- Use SLA state to see what is genuinely urgent rather than merely numerous.
PT: what is different¶
Penetration test findings are written by people, so they carry narrative detail, reproduction steps and evidence. They are usually fewer, more severe, and more likely to need discussion before remediation.
The lifecycle is the same — findings are approved, assigned SLAs, remediated and validated — but the volume means each one is normally handled on its own merits.