Installment four of fourteen, and we’re moving to the cloud: instances that spin up, do their job, and are never scanned.
On-premises, an aggregated view ages slowly. In the cloud it can be wrong within the hour. This is where reconciling beats collecting — asset intelligence keeps checking what is actually running against what each source claims is running, instead of freezing a snapshot and hoping.
An instance that lived for six hours and was never scanned still had an IP address, still had an open port, and still counted against whatever you thought you were protecting.
Yikes! It’s the cloud security equivalent of trying to hit an invisible moving target.
But don’t panic!
This is what SJULTRA can help you solve with CAASM (Cyber Asset Attack Surface Management) and cybersecurity observability.
Book your Free 30-day CAASM Trial
Gain Complete Visibility of Your Cybersecurity Assets with the SJULTRA CAASM free trial.
The Elusive Threat: Unscanned Cloud Instances
Here’s the deal: Your vulnerability assessment tools are fantastic at finding issues on instances they know about. But cloud computing often cycles faster than your tools can keep up: new instances can pop up faster than you can say “DevOps.” These unscanned instances could be:
- A test environment spun up and forgotten
- A new service launched without proper security checks
- An auto-scaled instance that appeared between scans
These invisible assets are like open doors in your cloud fortress. And the kicker? Your VA scanner won’t tell you about them because it doesn’t even know they exist!
Enter SJULTRA's Cybersecurity Observability Service
This is where SJULTRA’s CAASM services, becomes your cloud security superhero. It’s like giving your security team x-ray vision for your entire cloud infrastructure.
CAASM pulls data from multiple sources:
- Your vulnerability scanner console
- Cloud infrastructure admin consoles (AWS, Azure, GCP, you name it!)
By cross-referencing these sources, we can spot the cloud instances that should be scanned but aren’t. It’s like finding needles in a cloud-shaped haystack!
Let's get querying
Once we have CAASM set up (remember, SJULTRA offers a free 30-day trial), we can start hunting those elusive unscanned cloud instances.
Want to find all AWS instances not being scanned for vulnerabilities?
3. Query Languge (SQL):
This query finds Amazon instances not being scanned by any tool categorized as a Vulnerability Assessment Tool.
The result set may be very large, so we can cull the list and prioritize the most urgent instances needing attention.
Here’s how to find just those AWS instances not being scanned that also have a public IP Address.
In the Query Wizard:
What about only AWS instances that have known Common Vulnerabilities and Exposures (CVE®) and are not being scanned for vulnerabilities?
AQL:
This is a great example of extending and refining an AQL to build on the previous by only focusing on critical CVEs:
Finding Windows Devices Without a Vulnerability Scanner Solution
We've found the unscanned devices - now what?
Great, we’ve uncovered these hidden cloud instances. What’s next? This is where the “action” part of our cybersecurity observability comes in. We’ve got four aces up our sleeves:
- Notify: Send alerts via email, Slack, Syslog, or CSV (because who doesn’t love another alert about cloud security?)
- Create Incident: Generate tickets in systems like ServiceNow, Jira, or Zendesk
- Enrich Device or User Data: Use tools like Shodan, Censys, or Portnox to show what’s publicly known about the instance
- Update VA Coverage: Automatically add the cloud instance to the next scheduled vulnerability assessment scan
Summary
And there you have it, cloud security survivors!
That’s how we turn the elusive threat of unscanned cloud instances into a manageable, observable process. It’s not just about finding vulnerabilities; it’s about making sure we’re looking in all the right places, even as those places keep changing.
Remember, this is just 4 out of 14 standard use cases we help our customers with as part of our CAASM Concierge service. And guess what? You can get it for free!
What you don’t know can definitely hurt you in the cloud. But with the right tools and a bit of observability magic, we can keep those cloud instances in check.
Stay vigilant, keep querying, and may all your instances be scanned and secure!
Documentation and Videos
Read the documentation: Finding Devices Not Being Scanned For Vulnerabilities.
