Skip to content

Preparing to scan production applications and networks

Web scan

The following preliminary steps should be followed to scan resources:

  1. The IP address of the scanner must be added to the white list on WAFs and other security tools that can block traffic.
  2. It is recommended to get permission from the resource owner to scan in the selected time interval, as:
    • Scanning creates additional load on the application, which may exceed the design load. This can be adjusted by the RPS parameter.
    • Scanning can cause many errors in the application's monitoring system, which may lead to a violation of the internal SLA of the operation service.
    • Requests to API elements of the scanned application that cause unwanted external reactions, such as sending emails, sms, sending requests to related systems, may appear. Such requests to APIs can be identified in advance with the resource owner and added to the list of URL restrictions.

Network scan

  1. Add the scanner's IP address to the allowlist on the WAF and other security tools that may block traffic.
  2. Obtain authorization. Always obtain written permission and approval from asset owners, management, and network administrators before scanning any IP address range.
  3. Clearly define the scanning scope. Specify the exact IP addresses, subnets, or hostnames. Do not scan unauthorized or external public infrastructure without explicit permission.
  4. Schedule scanning outside business hours. Perform network scanning during maintenance windows or off-peak hours to minimize the impact on production systems.
  5. Segment large networks. Divide large IP spaces into smaller segments to avoid routing a large volume of traffic through core corporate firewalls.