Vulnerability Assessment CSH 6 Chapter 46 Vulnerability Assessment

Topics in CSH 6 Chapter 46 ØScorekeeper of Security Management ØTaxonomy of VA Technologies

Scorekeeper of Security Management Ø Introduction to Vulnerability Management Ø What is Vulnerability Management? Ø What is Vulnerability Assessment (VA)? Ø Where does VA Fit into Security Management? Ø History of VA 3 Copyright © 2020 M. E. Kabay. All rights reserved.

Introduction to Vulnerability Management Ø Information security tightly integrated into risk management Ø Vulnerability management critical component of risk management Ø Significant evolution from 1960 s through 2000 s 4 Copyright © 2020 M. E. Kabay. All rights reserved.

What is Vulnerability Management? Ø Assessing deployed IT systems Ø Determine security status Ø Determine corrective measures Ø Manage application of corrections Ø Vulnerability assessment (VA): critical element in vulnerability management Ø Synergy between VA & other elements of security Ø Four key functions (see next slide) 5 Copyright © 2020 M. E. Kabay. All rights reserved.

Four Key Functions of Vulnerability Management Ø Inventory q Identify all systems in domain of interest q Operating systems, platforms, topology Ø Focus q Determine data required for assessment q Tune vulnerability assessment tools Ø Assess q Run automated & manual trests q Evaluate (assess) results to judge risk q Use security policy + best practices Ø Respond q Execute changes as required by assessment q Fix specific weaknesses 6 Copyright © 2020 M. E. Kabay. All rights reserved.

What is Vulnerability Assessment (VA)? Ø Analysis of security state of system q Gather data sample (e. g. , parameters on selected firewalls) q Store data for future reference q Compare with reference standards q Identify discrepancies between current state & recommended standards or goals Ø Examples of tools q MS Baseline Security Analyzer üFor Windows 2000/XP & NT 4 üSee http: //www. techspot. com/tweaks/mbsa/index. shtml q Server VAM http: //www 2. stillsecure. com/products/svam 1. html 7 Copyright © 2020 M. E. Kabay. All rights reserved.

Sample Screen Shots from Baseline Security Analyzer 8 Copyright © 2020 M. E. Kabay.

FAB (Features and Benefits) of a VAS (Server VAM) 9 http: //www 2. stillsecure.

Where does VA Fit into Security Management? (1) Ø When systems 1 st deployed, can establish baseline security state Ø When security breaches suspected, can focus on likely attack paths Ø May be able to see if vulnerabilities have been exploited Ø VA can identify areas where newly reported vulnerabilities should be patched Ø Records of VA scans can be archived q. Serve for audits q. Compliance with certifications 10 Copyright © 2020 M. E. Kabay. All rights reserved.

Where does VA Fit into Security Management? (2) Ø Support auditability q. Independent review of system records q. Determine adequacy of controls q. Ensure compliance with policy & procedures q. Detect breaches of security q. Recommend changes or guide recommendations Ø Auditability in turn supports q. Incident handling & recovery q. Adjustment of security policies to meet needs 11 Copyright © 2020 M. E. Kabay. All rights reserved.

Brief History of VA (1) Ø Manual security audits established in 1950 s Ø Auditability defined 1970 s for USAF study Ø Eugene Spafford and Dan Farmer (Purdue) q. COPS VAS for UNIX q. Late 1980 s Ø Internet Security Scanner (ISS) – early 1990 s q http: //www. cert. org/advisories/CA-1993 -14. html 12 Spaf Dan Weitse Some Famous Security Experts Copyright © 2020 M. E. Kabay. All rights reserved.

Brief History of VA (2) Ø SATAN (Security Administrator Tool for Analyzing Networks) q Farmer & Wietse Venema q Posted 1995 q http: //www. porcupine. org/satan/ q http: //www. cerias. purdue. edu/about/history/coast/satan. php Ø NESSUS q http: //www. tenable. com/products/nessus q Free for individual use http: //www. tenable. com/products/nessus-homefeed Ø NMAP q Net. MAPper q http: //nmap. org/ 13 See “Alphabetical List of Vulnerability Assessment Products” http: //www. timberlinetechnologies. com/products/vulnerability. html Copyright © 2020 M. E. Kabay. All rights reserved.

Taxonomy of VA Technologies Ø VA Strategy & Techniques Ø Network Scanning Ø Vulnerability Scanning Ø Assessment Strategies Ø Strengths & Weaknesses of VAS Ø Roles for VA in System Security Management 14 Copyright © 2020 M. E. Kabay. All rights reserved.

VA Strategy & Techniques Ø Network scanning Ø Vulnerability scanning Ø Password cracking Ø Log review Ø Integrity checking Ø Virus detection Ø War dialing Ø War driving Ø Penetration testing 15 Copyright © 2020 M. E. Kabay. All rights reserved.

Network Scanning Ø Port scanner q. ICMP feature q. Identify hosts in network address range q. E. g. , GRC Shields. UP! (see next slide)* q. Identify visible & open ports q. Can spot undocumented equipment on network * https: //www. grc. com/x/ne. dll? bh 0 bkyd 2 16 Copyright © 2020 M. E. Kabay. All rights reserved.

GRC Shields. UP! Port Scanner Ø Explanations of each visible (blue) port available q. Risky because can be seen by attackers Ø Open ports shown in red q. Dangerous q. May be exploited 17 Copyright © 2020 M. E. Kabay. All rights reserved.

Vulnerability Scanning (1) Ø Heart of VA systems Ø Beyond port scanning q. Analyze data to recognize known vulnerabilities q. May also attempt to correct problems Ø Identifies deeper details q. Software versions q. Applications q. Configurations Ø Current DB of known vulnerabilities especially valuable 18 Copyright © 2020 M. E. Kabay. All rights reserved.

Vulnerability Scanning (2) Ø Typically slower than simpler port scanners Ø Some scanning / testing may disrupt operations; e. g. , q. DDo. S testing Ø False positive rates q. May be high q. Require more human judgement Ø Vulnerability DB must be updated frequently 19 Copyright © 2020 M. E. Kabay. All rights reserved.

Assessment Strategies Ø Credentialed monitoring q. System data sources üFile contents üSystem configuration üStatus information q. Nonintrusive q. Host-based Ø Noncredentialed monitors q. Simulate system attacks q. Record responses q“Active” approaches superior for networkrelated vulnerability assessment 20 Copyright © 2020 M. E. Kabay. All rights reserved.

Strengths & Weaknesses of VAS (1) Benefits Ø Save time & resources Ø Training novices Ø Updated for new info Ø Address specific problems Ø Benchmark security of systems to document progress toward goals Ø Systematic & consistent q. Serve as quality assurance measures q. Routinely applied after making changes 21 Copyright © 2020 M. E. Kabay. All rights reserved.

Strengths & Weaknesses of VAS (2) Ø Weaknesses Ø Not sufficient to secure system Ø May diagnose, not fix Ø If not up to date, may mislead users Ø May reduce performance of operational / production network or system Ø May be abused for malicious purposes 22 Copyright © 2020 M. E. Kabay. All rights reserved.

Roles of VA in Security Management ØWhen new programs are installed ØAfter significant changes

Penetration Testing Ø Introduction to Pen Testing Ø Penetration Test Goals Ø Attributes of

Introduction to Pen Testing Ø VAS offer partial evaluation of vulnerabilities Ø Actually testing for vulnerabilities by penetrating barriers is useful adjunct Ø Penetration testing aka “pen testing” Ø Pen testers aka “Red Team” from US Government parlance in capture/defend computer games Ø Pen tests must be carefully planned & executed Ø ALWAYS and ONLY with full authorization! 25 Copyright © 2020 M. E. Kabay. All rights reserved.

Penetration Test Goals Ø Model real-world attacks closely q. Break out of policy bounds q. Out-of-the-box thinking q. Criminal-hacker techniques Ø Test simultaneous security measures Ø Identify potential access paths missed by VAS Ø BUT q. Must not compromise production q. Should produce unambiguous results for management 26 Copyright © 2020 M. E. Kabay. All rights reserved.

Attributes of Pen Tests Ø Testing models q. Zero knowledge q. Full knowledge Ø Scope q. Physical q. Communications q. Systems q. Social engineering Ø Sophistication q. Wide range of techniques 27 Copyright © 2020 M. E. Kabay. All rights reserved.

Social Engineering Ø Trickery & deceit applied to employees q. Often used by real criminals q. But may have serious legal, psychological, & morale implications Ø Obtain legally binding authorization Ø STRONGLY RECOMMEND that organization’s staff be fully prepared to defend against social engineering attacks q. Otherwise will waste resources (too easy) q. Cause guilt, embarrassment, anger, and distress in tricked employees 28 Copyright © 2020 M. E. Kabay. All rights reserved.

Managing Pen Testing Ø Document & approve scenarios in advance Ø Minimize damage to production / operations Ø Do not cause distress Ø Do not target / humiliate employees who have been involved in security failures! Ø Don’t strive to “win” at all costs: q“To leave a tested organization in worse condition than the test team found it is a hollow victory for all involved. ” 29 Copyright © 2020 M. E. Kabay. All rights reserved.

Review Questions 1. Distinguish between an IDS and a VAS. 2. If you wanted to check a system to see if it were protected against known attacks, would you use an IDS or would you use a VAS? 3. How do VAS support security audits? 4. In which decade were the first automated VAS developed? 5. Explain why the data store and analytical engine of an IDS should be situated off the system being monitored. 6. Compare and contrast credentialed vs. noncredentialed VAS monitoring. 7. Why should pen testers be careful in their use of social engineering? 30 Copyright © 2020 M. E. Kabay. All rights reserved.