Beyond NMAP Port Scanner: Better Device Detail without Device Interference

NMAP, which is shortened from “Networkmap” is an open-source (free) port scanner software program designed to scan networks for connected systems and details. NMAP is generally referred to as a “port scanner” because it relies heavily on detecting which ports are open to determine operating system (OS) and other details. While NMAP and some other port scanners are an excellent tools to use among a set of tools designed to discover, inventory, and manage connected devices, it is not as valuable a resource when used as a standalone solution.

Detriments of NMAP and other Port Scanning software

NMAP works well to determine details of the more traditional endpoint devices like servers, workstations, and virtual machines, but it is not without some detriments. But, when the software attempts the same types of tests (port scans with specially crafted packets) on the newer and larger class of connected devices that take the form of IoT, connected medical, SCADA, etc., those results are not so precise, and issues arise on devices themselves. When an NMAP ( or another port scanner) scan sends packets to these devices, they can easily cause the device to crash or cause other problems in how the device performs. These issues typically lead to the devices that cannot handle the NMAP scans simply being virtually segmented away from the primary network or blacklisted in the target lists. Either way is not a solution, merely a way to ensure the less traditional devices are left to fester in their insecurities and vulnerabilities.

Additionally, there can be a steep learning curve to master the ins and outs of configuring NMAP and other port scanner.

Beyond NMAP and other Port Scanners: IoTSecure Does Not Interfere with Devices

When IoTSecure set out to make a platform capable of scanning but cataloging for inventory, identifying issues, vulnerabilities, and securing devices, our goal was to develop something that could safely perform its tasks on any device, including sensitive and very resource-constrained IoT and medical devices. Our PortSafe® inspection can assess any networked device and identify vital statistics like manufacturer, OS, default passwords, and vulnerabilities without risk to the device’s availability.

Instead of simply dumping out a list of online devices IP addresses, MAC addresses, OSes, and other difficult to decipher devices like NMAP and other port scanners, the IoT Security Appliance (IoTSA, whether it be the IoT-mini or the IoT-max) first differentiates the devices that are already managed. A “managed device” is defined as any device that traditionally has security management, like a server or laptop. There is no need for the added control of these devices, so the IoTSA adds them to the inventory and focuses on the devices that need management, everything else.

Beyond Better Device Detail, Also Mitigate Threats

To take actions further:

1. If there is an issue causing the remediation to be impossible for technical or logistical reasons, the IoTSA is capable of protecting devices by segmenting them, blocking ports, or a plethora of other actions. Allowing the IoTSA platform a complete security solution for the devices currently sitting on the network unmanaged and raises the risk to the network.
2. The IoTSA can also be upgraded to help monitor unmanaged devices that don’t run agents. It provides automated, device-level anomaly and malicious behavior detection without the need for any tuning.

Integrating Results into Existing Tools and Processes

Unlike NMAP / other port scanners, the IoTSA platform is designed to complement the current security infrastructure and has full integration capabilities. This is typically done using our API to send the data gathered into the organization’s SIEM, NAC or send it over to their SOC/NOC to be integrated into their data for analysis and action as necessary. This means that the information gathered and analyzed by the IoTSA platform is not just “yet another source of data.” Instead, it integrates with your current systems to add value without causing any harm or confusion within the entire dataset.

Better Device Detail vs. NMAP / Port Scanners:
The IoT-mini^TM – It’s Free and Takes Just 5 minutes

Let’s be honest: we don’t expect you to read a blog post and be convinced that the IoT-mini and the IoTSA platform are suitable for your organization. That is why we created the IoT-mini FREE program wherein any qualified organization or IT/IS leader can request and get an IoT-mini completely free. The IoT-mini FREE can be plugged into any network (home, work, VLAN, etc.), anywhere on the network and it does not use TAP/SPAN Ports. It deploys in about 5 minutes and will assess the network for any devices, especially those defined as unmanaged.

Roughly 24-hours after your IoT-mini FREE is plugged in and registered. You will receive a Threat Report detailing everything we found, vulnerabilities, remediation strategies, and other crucial details that will help you better understand and protect the network, devices, data, and people using them.