Technology

What Are the Uses for a Vulnerability Scanner?

Published

5 years ago

09/12/2020

Cyberattacks have become so common that you can expect to see news about a breach every week. Just recently, Twitter experienced a breach that affected high-profile US Twitter accounts. This attack highlights the need for proactive security measures, such as vulnerability scans.

Today’s hyper-connected world calls for extreme vigilance and knowledge of the ever-present threat of cyberattacks. These cyberattacks typically exploit vulnerabilities to breach your networks. What better way to prevent these attacks than to conduct regular vulnerability scans?

What Is a Vulnerability Scanner?

Your network is constantly exposed to threats, and loopholes that could result in catastrophic incidents for your business were threat actors to identify them. Vulnerability scanners simply help identify these threats early enough before threat actors can find them. You can rely on them to scan your system or network for vulnerabilities while comparing the results to pre-established vulnerability databases. Some common vulnerability scanners include ImmuniWeb, Tripwire IP360, Paessler PRTG, and Acunetix.

How to Effectively Use Vulnerability Scanners

For you to effectively use vulnerability scanners, you need to scan your system and network often. The databases that contain recently discovered vulnerabilities tend to be updated often. Ideally, having a team in charge of these scans is ideal.

Once you are done with a scan, the team will assess the ad hoc reports. If they identify an issue with your system, they will suggest a remedy for mitigating the risks involved. Most databases tend to suggest solutions for the vulnerabilities they expose.

Types of Vulnerability Scans

Cyberattackers target flaws or vulnerabilities in networks, systems, and web applications with the sole purpose of exploiting them. For example, when dealing with application vulnerability management, the developers will seek to identify vulnerabilities, such as SQL injection, cross-site scripting, security misconfiguration, failure to restrict URL access, and LDAP injection.

To identify such vulnerabilities, organizations employ different vulnerability scans based on their testing objectives. The most common vulnerability scans include:

External Vulnerability Scans

External scans aim to identify threats that can arise from outside our network, especially on the externally facing services. They are targeted at external IP addresses and ports.

For instance, they can help you assess new services and servers launched since the last time you conducted a scan and any threats associated with them. Some common threats you can find include having servers configured with deprecated services and unsecured transfer protocols. Ideally, you should perform these scans once each month to avoid over/underdoing them. A good example of these scanners is ImmuniWeb.

Internal Vulnerability Scans

Cybersecurity threats can originate from anywhere, even from within your network. Don’t focus all of your resources on external threats and forget that disgruntled employees can target your network. You could also have missed a threat that seeped through your defences. This kind of threat could open up your network to attacks.

You need to perform an internal vulnerability scan to identify these threats. It also seeks to identify vulnerabilities such as encryption weaknesses, missing patches, and configuration weaknesses.

Keep in mind that internal scans are more complicated compared to external scans as they seek to assess your internal assets. These assets include everything in your network, such as vulnerable software. An internal scan will focus on your network’s internal components, searching for possible vulnerabilities and any other points of exploitation. A good example of such scanners is the Paessler PRTG.

Environmental Vulnerability Scans

These scans are specific to certain IT environments, including mobile device-based environments, cloud-based environments, IoT devices, etc. Most of these environments are semi-isolated from the entire organization’s network, but they could wreak havoc to the rest of the network if a breach were to occur. Tripwire IP360 is a good example of such scanners.

For instance, IoT systems tend to be less secure than normal devices since most are designed with security as an afterthought. In turn, most manufacturers work overtime to identify security loopholes before sending out updates to patch these issues. A vulnerability scan will identify unpatched weaknesses in your IoT environment, which can be insightful in protecting your organization.

How Effective Is Vulnerability Scanning?

Vulnerability scanning is effective in identifying vulnerabilities in a network. In fact, 60 per cent of security breaches occur despite there being an existing patch for the ad hoc vulnerability. A scan generates a report of its findings, which you can use to patch the vulnerabilities. However, it’s more effective when combined with other cybersecurity measures, such as penetration testing and vulnerability assessment.

Vulnerability Scan vs. Penetration Test vs. Vulnerability Assessment

These three terms are often used interchangeably, but they don’t have similar meanings. For example, you might ask for a penetration test, but what you really need is a vulnerability assessment. To avoid this confusion, learn to differentiate the three.

What Is a Vulnerability Scan?

A vulnerability scan is run by automated software that tries to identify vulnerabilities in your network or system. It’s a simple process, as explained earlier. It merely identifies the vulnerabilities based on a database of vulnerabilities.

While these scans are important, you shouldn’t rely solely on them. This is because if you run a vulnerability scan and report indicates that your system has no vulnerabilities, it doesn’t necessarily mean that your system is fine. Vulnerability scans play an important role in improving an organization’s security, but they aren’t enough. You need a comprehensive cybersecurity strategy that includes vulnerability assessment and penetration testing.

What Is a Vulnerability Assessment?

A vulnerability scan will identify the weaknesses and flaws in your network, but it doesn’t explain the magnitude of these vulnerabilities. You’ll know your network has vulnerabilities, but you have no idea the extent of the damage that these vulnerabilities can inflict on your business.

To understand the damage that these vulnerabilities can cause, you need to conduct a vulnerability assessment, as it takes into account all the assets in your IT infrastructure.

The first stage of the vulnerability assessment is to match all the assets in your environment with their vulnerabilities. This will include your networks, hardware, software, web applications, etc.

Once you’ve matched assets with their vulnerabilities, you will start evaluating the effects the vulnerabilities can have on your business. This will typically require you to assess the impact a weakness can have and the probability of it occurring.

A vulnerability assessment is considered essential as it gives you an idea of what your system can handle, the threats it’s facing, and the magnitude of the threats.

What Is Penetration Testing?

The primary aim of vulnerability assessments and vulnerability scans is to identify vulnerabilities; in contrast, penetration testing seeks to exploit these vulnerabilities. Penetration tests are typically conducted by third parties several times a year as opposed to vulnerability scans, which are conducted more frequently.

Penetration testing begins by identifying weaknesses such as insecure business processes, vulnerable databases, etc. In the next phase, the penetration tester tries to exploit these vulnerabilities.

All three are important and should be part of your cybersecurity strategy. However, you should prioritize vulnerability assessments to keep up with ever-lurking cyberattackers. In contrast, penetration tests can be performed once or twice a year.

Wrapping It Up

Cyberattackers will always try to breach your security, and their primary target will be vulnerabilities that they can exploit. As long as you’re in a connected world, there is always a risk that your network will be hacked. Hackers will breach even the best defences as long as there is a weak link.

However, you can prevent these attacks by constantly scanning your IT infrastructure for vulnerabilities. Don’t stop there. Conduct a vulnerability assessment to help you identify these vulnerabilities, and rank them according to the degree of damage they can cause. Include penetration testing bi-annually or annually to test how your IT infrastructure would fare against an external attack.

Cyberattackers are constantly poking around your network looking for weaknesses, and if you don’t implement measures to strengthen your cybersecurity, they will eventually find these flaws and exploit them. You don’t need complex security measures; a simple vulnerability scan will act as a good starting point.

Technology

Telecom Operators to Issue 14-Day Notice Before SIM Disconnection

Published

2 days ago

03/03/2026

Adedapo Adesanya

By Adedapo Adesanya

Telecommunications operators in Nigeria will now be required to give subscribers a minimum of 14 days’ notice before deactivating their SIM cards over inactivity or post-paid churn, following a fresh proposal by the Nigerian Communications Commission (NCC).

The proposal is contained in a consultation paper, signed by the Executive Vice Chairman and Chief Executive Officer of the NCC, Mr Aminu Maida, and titled Stakeholders Consultation Process for the Telecoms Identity Risks Management Platform, dated February 26, 2026, and published on the Commission’s website.

Under the proposed amendments to the Quality-of-Service (QoS) Business Rules, the Commission said operators must notify affected subscribers ahead of any planned churn.

“Prior to churning of a post-paid line, the Operator shall send a notification to the affected subscriber through an alternative line or an email on the pending churning of his line,” the document stated.

It added that “this notification shall be sent at least 14 days before the final date for the churn of the number.”

A similar provision was proposed for prepaid subscribers. According to the Commission, operators must equally notify prepaid customers via an alternative line or email at least 14 days before the final churn date.

Currently, under Section 2.3.1 of the QoS Business Rules, a subscriber’s line may be deactivated if it has not been used for six months for a revenue-generating event. If the inactivity persists for another six months, the subscriber risks losing the number entirely, except in cases of proven network-related faults.

The new proposal is part of a broader regulatory review tied to the rollout of the Telecoms Identity Risk Management System (TIRMS), a cross-sector platform designed to curb fraud linked to recycled, swapped and barred mobile numbers.

The NCC explained in the background section of the paper that TIRMS is a secure, regulatory-backed platform that helps prevent fraud stemming from churned, swapped, barred Mobile Station International Subscriber Directory Numbers in Nigeria.

It said this platform will provide a uniform approach for all sectors in relation to the integrity and utilisation of registered MSISDNs on the Nigerian Communications network.

In addition to the 14-day notice requirement, the Commission also proposed that operators must submit details of all churned numbers to TIRMS within seven days of completing the churn process, strengthening oversight and accountability in the system.

The consultation process, which the Commission said is in line with Section 58 of the Nigerian Communications Act 2003, will remain open for 21 days from the date of publication. Stakeholders are expected to submit their comments on or before March 20, 2026.

Technology

Silverbird Honours Interswitch’s Elegbe for Nigeria’s Digital Payments Revolution

Published

3 days ago

02/03/2026

Modupe Gbadeyanka

By Modupe Gbadeyanka

The founder of Interswitch, Mr Mitchell Elegbe, has been honoured for pioneering Nigeria’s digital payments revolution.

At a ceremony in Lagos on Sunday, March 1, 2026, he was bestowed with the 2025 Silverbird Special Achievement Award for shaping Africa’s financial ecosystem.

The Silverbird Special Achievement Award recognises individuals whose innovation, vision, and sustained impact have left an indelible mark on society.

Mr Elegbe described the award as both humbling and symbolic of a broader journey, saying, “This honour represents far more than a personal milestone. It reflects the courage of a team that believed, long before it was fashionable, that Nigeria and Africa could build world-class financial infrastructure.”

“When we started Interswitch, we were driven by a simple but powerful idea that technology could democratise access, unlock opportunity, and enable commerce at scale.

“This recognition by Silverbird strengthens our resolve to continue building systems that empower businesses, support governments, and expand inclusion across the continent,” he said when he received the accolade at the Silverbird Man of the Year Awards ceremony attended by several other dignitaries, whose leadership and contributions continue to shape national development and industry transformation.

In 2002, Mr Elegbe established Interswitch after he was inspired by a bold conviction that technology could fundamentally redefine how value moves within and across economies.

Under his leadership, the company has evolved into one of Africa’s foremost integrated payments and digital commerce companies, powering financial transactions for governments, banks, businesses, and millions of consumers.

Today, much of Nigeria’s electronic payments ecosystem traces its foundational architecture to the systems and rails established under his leadership.

“Mitchell’s journey is inseparable from Nigeria’s digital payments evolution. His foresight and resilience helped establish foundational infrastructure at a time when the ecosystem was still nascent.

“This recognition affirms not only his personal legacy, but the broader impact of Interswitch in enabling commerce and strengthening financial systems across Africa,” the Executive Vice President and Group Marketing and Communications for Interswitch, Ms Cherry Eromosele, commented.

Technology

SERAP Seeks FCCPC Probe into Big Tech’s Impact on Nigeria’s Digital Economy

Published

3 days ago

02/03/2026

Adedapo Adesanya

By Adedapo Adesanya

The Socio-Economic Rights and Accountability Project (SERAP) has called on the Federal Competition and Consumer Protection Commission (FCCPC) to urgently investigate major global technology companies over alleged abuses affecting Nigeria’s digital economy, media freedom, privacy rights and democratic integrity.

In a complaint addressed to the chief executive of FCCPC, Mr Tunji Bello, the group accused Google, Meta (Facebook), Apple, Microsoft (Bing), X, TikTok, Amazon and YouTube of deploying opaque algorithms and leveraging market dominance in ways that allegedly undermine Nigerian media organisations, businesses, and citizens’ rights.

The complaint, signed by SERAP Deputy Director, Mr Kolawole Oluwadare, urged the commission to take measures necessary to urgently prevent further unfair market practices, algorithmic influence, consumer harm and abuses of media freedom, freedom of expression, privacy, and access to information.”

SERAP also asked the FCCPC to convene a public hearing to investigate allegations of algorithmic discrimination, data exploitation, revenue diversion, and anti-competitive conduct involving the tech giants.

According to the organisation, dominant digital platforms now act as private gatekeepers of Nigeria’s information and business ecosystem, wielding enormous influence over public discourse and market competition without sufficient transparency or regulatory oversight.

“Millions of Nigerians rely on these platforms for news, information and business opportunities,” SERAP stated, warning that opaque algorithms and offshore revenue extraction models pose both economic and human rights concerns.

The group argued that the alleged practices threaten media plurality, consumer protection, privacy rights, and the integrity of Nigeria’s forthcoming elections.

SERAP pointed to actions taken by the South African Competition Commission, which investigated Google over alleged bias against local media content, adding that the South African probe reportedly resulted in measures including algorithmic transparency requirements, compliance monitoring and financial remedies.

SERAP urged the FCCPC to take similar steps to safeguard Nigerian media and businesses.

The organisation maintained that if established, the allegations could amount to violations of Sections 17 and 18 of the Federal Competition and Consumer Protection Act (FCCPA), which prohibit abuse of market dominance and anti-competitive conduct.

SERAP stressed that the FCCPC has statutory authority to investigate and sanction conduct that substantially prevents, restricts or distorts competition in Nigeria.

It also warned that failure by the Commission to act promptly could prompt the organisation to pursue legal action to compel regulatory intervention.

Citing concerns reportedly raised by the Nigerian Press Organisation (NPO), SERAP said big tech companies have fundamentally altered Nigeria’s information environment, creating what it described as a structural imbalance of power that threatens the sustainability of professional journalism.

Among the allegations listed are: Algorithms controlled outside Nigeria determining content visibility, monetisation of Nigerian news content without proportionate reinvestment, offshore extraction of advertising revenues, limited discoverability of Nigerian websites and platforms, and lack of transparency in ranking and recommendation systems.

SERAP argued that declining revenues in the Nigerian media industry have led to shrinking newsrooms, closure of bureaus, and the emergence of news deserts, weakening journalism’s constitutional role in democratic accountability.

The organisation further warned that algorithmic opacity and data-driven micro-targeting could influence voter exposure to information ahead of Nigeria’s forthcoming elections, raising concerns about electoral fairness and transparency.