RAgress761951 (Community Member) asked a question.
Scanning old .net desktop applications which are only used by business internally
Our org has couple of very old (10-11 yrs) old desktop applications written in .NET / MS-SQL with no third party integration, these are critical apps and are used by internal staff (business only) and they have to be on a VPN to use them, these apps are in containment meaning we are not enhancing or pushing out new versions of the app.
Question
- Do we need to scan these app in VeraCode for vulnerabilities
- If we find critical issues should we fix it, since no external actor should have access to the apps
- If external actors are able to exploit, doesn't that mean that the network itself is compromised.
We need to allocate significant budget and resources on this and hence we are trying to understand weather they are worth scanning in the first place.
.png){kind=logo}
hello @RAgress761951 (Community Member)
The first thing that I advice you is look with your colleagues how critical are these application to your organization.
You mentioned that they are important but only used internally, so, analyzing it, maybe the bussiness criticality of this app go down because only a person who is into internal network could exploit it, right? we see that some companies are exploited in other layers and unfortunately, some internal systems are vulnerable and the attackers can "destroy" and stop the operations
Other point that I would sugest you is: how difficult would be an attacker (external and internal like insider) exploit these apps?
Finally, looking at the security perspective, these apps must be scanned by Veracode. So, you can talk internaly and talk with commercial and sales team that provided Veracode to you, and help you to include the most important internal apps. You don't need to have bugdet to include all apps as once, instead, you can buy in a progressive way