Posted by Duncan Alderson on Aug 28
Hi Cribbar,I can see the auditors point but he may not be putting the best case forward.
If the organisation has a good security model in place with patching and hardening, there is still a need to scan the
whole environment. Look at it as a defence in depth scan. What happens if a rouge device is added to network? A change
on a device is added that has insecure consequences?
I know there can be other controls in place to stop this...