How do you do validation testing?

[Tony_Kiser]

Hi all,

I'm wondering if any of you do your own validation testing of security patces for PAN-OS and vulnerabily signatures.  Example being, do you confirm your edge is vulnerable to a specific CVE, and then after patching do you confirm it's no longer vulnerable, and if so (any version of this kind of thing) what tools or processes do you use to do this?

[OtakarKlier · Accepted solution]

Hello,

External/Internal scanning is recommned and sometimes required depending if your company falls into a specific group, i.e. PCI, FIMSA, etc. There are tools that can be used for this purpose, both free and paid. Qualys, Tennable, and Rapid7 are examples of paid services. Free services include the Kali linux distribution, however I'm sure a quick google search can find more. 

Hope that helps.

[BPry]

@OtakarKlier pretty much nailed it here. There are a metric ton of free/open source material to test your network. Kali is probably the most popular however it really comes down to what you need to actually test your network against and how comfortable you are in doing so. Paid services are, of course, going to be a little bit more user friendly and won't take as much time to research and learn how to use as something like Kali does. That being said if you Google pretty much anything that you want to do with Kali, there is probably an article with the steps you will need to take layed out for you.