How often should IT asset vulnerability scans be carried out?

ANSWER

The answer to this question is: it depends.

Such operations are typically performed weekly for certain classes of IT assets. Many organisations scan their IT resources for potential vulnerabilities on a quarterly basis. In addition, it is good practice to perform vulnerability scans in the following cases:

• monitoring the most critical IT services (servers hosting key services for the organisation),
• deployment of new software or web services (prior to production deployment),
• development of existing applications or software with new functionality (prior to production deployment),
• deployment or addition of a new service, tool, or device, such as a server, workstation, or network device (e.g. a router).
• on an ad hoc basis in the event of an audit or suspected incident.

It is worth remembering that what is not vulnerable today may well be tomorrow!