SlideShare uma empresa Scribd logo

Enterprise Vulnerability Management: Back to Basics

•
•
Damon Small
Damon Small

Vulnerability Management is the lifecycle of identifying and remediating vulnerabilities in an organization's enterprise. A number of companies are starting to do this well, but in some cases, focus on advanced and emerging threats has had the unintended consequence of leaving Vulnerability Management unattended. Defense is actually hard work and people aren't doing it as well as they should! Considered in the context of asymmetric warfare, Blue Teaming is more difficult than Red Teaming. Coupled with the fact that most vulnerabilities do not actually suffer from advanced attacks and 0-days, Vulnerability Management must be the cornerstone of any Information Assurance Program. The speakers, Kevin Dunn and Damon Small, will describe the key elements of a mature Vulnerability Management Program (VMP) and the pitfalls encountered by many organizations as they try to implement it. Dunn and Small will include detailed examples of why purchasing the scanner should be one of the last decisions made in this process, and what the attendee must do to ensure the successful defense of company assets and data. This session will cover: - Vulnerability Management: What is it good for? - What is it not good for? - How do I make a real difference?

Tecnologia
1 de 32
Baixar para ler offline
Enterprise Vulnerability Management BSIDES AUSTIN - April 2016 Damon Small & Kevin Dunn - NCC Group
Agenda Welcome & Introductions 03 Session Overview 07 Session Definitions 08 Vulnerability Management 101 09 VulnerabilityAssessment Scans 10 Failing & Pitfalls 21 VMP: Making a Real Difference 22 Session Close 31 2
3 Welcome & Introductions NCC Group – A Global Security Firm • Formed in June 1999 showing immense growth over the past 16 years. • 1800 employees, in 30 office locations • North America, the United Kingdom, Europe and Australia. • We strive to provide Total Information Assurance for our clients. NCC Group in North America • Currently 8 offices in the NA: New York, Atlanta, Chicago, Austin, Seattle, San Francisco, Sunnyvale and Waterloo. • NCC Group combines the best of bread US security brands of iSEC Partners, Matasano, Intrepidus Group and NGS.
4 Welcome & Introductions NCC Group – Security Consulting • Attack & Penetration Focus • Applications • Mobile • Networks & Infrastructure • Physical Security • Embedded Systems • Red Teaming • Incident Response & Forensics • Enterprise Risk / VA Strategy
5 Welcome & Introductions Your Speakers – DAMON SMALL, Technical PM for NCC Group in NA • In IT since 1995; InfoSec since 2001 • Louisiana native: “Not from Texas but I got here as fast as I could!” • Studied music at LSU; grad school in 2005 for Information Assurance • Supported healthcare orgs. in the Texas Medical Center • Vulnerability Management Programs: o Two for Health Care orgs. o One for Oil & Gas o Workflow Analysis & Development o Scanner Platform Deployments
6 Welcome & Introductions Your Speakers – KEVIN DUNN, Technical VP for NCC Group in NA • Technical VP for NCC Group, based in Austin TX. • 14 year career focused on Attack & Penetration techniques & defenses • Prior to that security focused government/military background • Responsible for: o Regional Development & Management o Development of Strategic Technical Practices: § Strategic Infrastructure Security (SIS) § NA Computer Incident Response Team (NA-CIRT) • Specialist in Red Team / Black Ops engagements o (Forms of extreme penetration testing and attack modeling)
7 Session Overview Blue Team is Harder than Red Team! • You’re in charge of VM for your company • You have scanning sensors deployed • You have hardening plans in place • You have remediation strategies and goals • A pentest is commissioned from an outside firm • They prove traversal from the outside to the inside • They become Domain Admin on your network • They access your most critical data and systems.
8 Session Definitions • Vulnerability Assessment: The act of gathering information regarding vulnerabilities on specific hosts, often using scanning tools. (Does include penetration testing). • Vulnerability Management: A business process that includes the following key components: o Identification o Classification o Decision/Decision Record o Mitigation
9 Vulnerability Management 101 • A business process that includes: 1. Identifying Vulnerabilities (VA) 2. Promotes Patching / Hardening / Fix of Issues 3. Decision process regarding remediation activities: a. Fix it, accept it, or transfer the risk. b. Creates an auditable decision record, process for validation, and a process to periodically review “no action” remediation where risk is accepted. c. Decision process should be multi-disciplinary and represent all stakeholders (IT, business, InfoSec, etc.)
10 Vulnerability Assessment Scans Scanning - What is it Good For? • Identifying Vulnerabilities • Remediation Information • Software Inventory • Asset Management Scanning - What is it Not Good For? • Identifying Vulnerabilities • Going Beyond Patching • Workflow/Business Processes
11 Electrons/Photons going though wire/fiber What is being examined What tool can be used 1. Physical 2. Datalink 3. Network 4. Transport 5. Session 6. Presentation 7. Application MediaLayersHostLayers OSI Model The Right Tool for the Right Job
12 Patching vs. Hardening • Patching - Applying a software fix, update or upgrade. This is a code-level change, packaged typically as a binary. It usually comes from the software manufacturer / development team. • Hardening - Changing configuration settings to increase the security of something based on an understanding of which settings are ‘more secure’. Typically defined via some kind of ‘best practices document’. Hardening advice may come from a number of sources.
13 Over-Focus on Scanning / Patching Depth of System Hardening is Typically Shallow • Consider the following issues found on most Pentests! o MSSQL Weak SA Password o Tomcat Manager Weak Password o Jenkins Groovy Script Command Execution o Printer Default Credentials
14 Over-Focus on Scanning / Patching MSSQL Weak SA Password • A few simple steps to full control of server!
15 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
16 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
17 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • Jenkins Integration Manager (source code build env.)
18 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • When poorly configured visiting /script gets you to a ‘Script Console’
19 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • That’s OS command execution! You never know how many privs you have!
20 Over-Focus on Scanning / Patching Printer Default Credentials • Printers can be useful!
21 Failings & Pitfalls Common VMP Problems • Over-prioritization of Scanning - no workflow development • Scan All the Things - but do nothing with the results… • Generate False Positives - and lose credibility* • No Consideration for Network & Business Impact* • No Security Team & Support Org. Relationship • Mistaking VA (alone) as a DefensiveActivity
22 VMP: Making a Real Difference HIGHEST PRIORITIES • Asset Inventory Management • Decision & Remediation Workflows • Visualization & Metrics LOWER PRIORITIES • VulnerabilityAssessment Scanning • Penetration Testing • Buying Cool Toys
23 Scan Data Human Analysis Actionable Information Turning Data Into Information
24 VMP Process Overview Visualizing VMP Workflows • VMP workflows can be difficult to visualize without prior exposure! • Workflows and process will vary between organizations • For the purposes of this discussion we’ve created an example • Most of our workflows can scale up or down to your requirements • Bring on the HUGE diagram!
25
26 NIST Cybersecurity Framework • VMP allows you to IDENTIFY your assets. • VMP allows you to PROTECT via remediation. • VMP allows you to DETECT vulnerabilities. • VMP helps with effective RESPONSE. • VMP communication workflows help RECOVERY.
27 Considerations Analysis Methods & Opportunities for Improvement • Macro vs Micro Analysis o Vulnerabilities by Host o Hosts by Vulnerability • Minimizing False Positives o Confirmation of Issues from VMP Team § How? o Prior to Escalation to Support Org. o Maintain Credibility
28 VMP Design Checklist (1) Before You Purchase a Scanning Solution… • Do you know your environment? o Enterprise Planning o Asset Discovery • Do you know your stakeholders? o Business Units / Owners o Support Org. Teams • How will the data be consumed? o Consumers o Storage & Transmission o Format & Control
29 VMP Design Checklist (2) Before You Purchase a Scanning Solution… • How will we fit in with existing support workflows? o Scheduling / Change Control o Ticketing (Defect) o Hands on Keyboard o Outage Resolution • What skills or capabilities does our VMP team have? o VulnerabilityAssessment - Hands-on Experience o VulnerabilityAnalysis - Results Interpretation • How will we measure VMP success or failure? o Metrics / Feedback / Process Improvement
30 Okay! Now you can have lunch with a scanner sales person! J
31 Session Close • Scanners have been around for 20 years and yet we still don’t know how to use them, consume their data properly, or fix the things they find to satisfaction. Call to Action • Orgs - If you think the number and types of scans you do is the critical success factor, you are doing it wrong. • Be sure to consider your VMP design and workflows FIRST. • Scanner Vendors - Flinging packets is easy. Workflow integration, data aggregation, ticketing and tracking is much harder than it should be. Please help!
32 Ways to Stay in Touch Kevin Dunn Technical VP – NCC Group, Security Consulting E: kevin.dunn@nccgroup.trust L: https://www.linkedin.com/in/kevdunn T: @kdunn_ncc Damon Small Technical PM - NCC Group, Security Consulting E: damon.small@nccgroup.trust L: https://www.linkedin.com/in/damon-small-7400501 T: @damonsmall

Recomendados

Planning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management ProgramPlanning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management ProgramSasha Nunke
 
Vulnerability Management Program
Vulnerability Management ProgramVulnerability Management Program
Vulnerability Management ProgramDennis Chaupis
 
Vulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskVulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskAlienVault
 
Implementing Vulnerability Management
Implementing Vulnerability Management Implementing Vulnerability Management
Implementing Vulnerability Management Argyle Executive Forum
 
Patch and Vulnerability Management
Patch and Vulnerability ManagementPatch and Vulnerability Management
Patch and Vulnerability ManagementMarcelo Martins
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management ProgramBeyondTrust
 
Security Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsSecurity Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsYulian Slobodyan
 
NIST SP 800 30 Flow Chart
NIST SP 800 30 Flow ChartNIST SP 800 30 Flow Chart
NIST SP 800 30 Flow ChartJames W. De Rienzo
 

Recomendados

Planning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management ProgramPlanning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management ProgramSasha Nunke
 
Vulnerability Management Program
Vulnerability Management ProgramVulnerability Management Program
Vulnerability Management ProgramDennis Chaupis
 
Vulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskVulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskAlienVault
 
Implementing Vulnerability Management
Implementing Vulnerability Management Implementing Vulnerability Management
Implementing Vulnerability Management Argyle Executive Forum
 
Patch and Vulnerability Management
Patch and Vulnerability ManagementPatch and Vulnerability Management
Patch and Vulnerability ManagementMarcelo Martins
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management ProgramBeyondTrust
 
Security Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsSecurity Training: #3 Threat Modelling - Practices and Tools
Security Training: #3 Threat Modelling - Practices and ToolsYulian Slobodyan
 
NIST SP 800 30 Flow Chart
NIST SP 800 30 Flow ChartNIST SP 800 30 Flow Chart
NIST SP 800 30 Flow ChartJames W. De Rienzo
 
Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1Priyanka Aash
 
Vulnerability Assessment Presentation
Vulnerability Assessment PresentationVulnerability Assessment Presentation
Vulnerability Assessment PresentationLionel Medina
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations centerCMR WORLD TECH
 
Threat Modeling In 2021
Threat Modeling In 2021Threat Modeling In 2021
Threat Modeling In 2021Adam Shostack
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 ruleWalk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 ruleEnterpriseGRC Solutions, Inc.
 
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...robbiesamuel
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity frameworkShriya Rai
 
Building an Analytics Enables SOC
Building an Analytics Enables SOCBuilding an Analytics Enables SOC
Building an Analytics Enables SOCSplunk
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDEGirindro Pringgo Digdo
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONSylvain Martinez
 
Effective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehEffective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehReZa AdineH
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited ResourcesLogRhythm
 
Vulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingVulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingYvonne Marambanyika
 
Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)MetroStar
 
ISO 27001 2002 Update Webinar.pdf
ISO 27001 2002 Update Webinar.pdfISO 27001 2002 Update Webinar.pdf
ISO 27001 2002 Update Webinar.pdfControlCase
 
Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Denim Group
 
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Net at Work
 

Mais conteúdo relacionado

Mais procurados

Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center FundamentalAmir Hossein Zargaran
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Sqrrl
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1Priyanka Aash
 
Vulnerability Assessment Presentation
Vulnerability Assessment PresentationVulnerability Assessment Presentation
Vulnerability Assessment PresentationLionel Medina
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations centerCMR WORLD TECH
 
Threat Modeling In 2021
Threat Modeling In 2021Threat Modeling In 2021
Threat Modeling In 2021Adam Shostack
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalPriyanka Aash
 
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 ruleWalk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 ruleEnterpriseGRC Solutions, Inc.
 
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...robbiesamuel
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity frameworkShriya Rai
 
Building an Analytics Enables SOC
Building an Analytics Enables SOCBuilding an Analytics Enables SOC
Building an Analytics Enables SOCSplunk
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONSylvain Martinez
 
Effective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehEffective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehReZa AdineH
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited ResourcesLogRhythm
 
Vulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingVulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingYvonne Marambanyika
 
Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)MetroStar
 
ISO 27001 2002 Update Webinar.pdf
ISO 27001 2002 Update Webinar.pdfISO 27001 2002 Update Webinar.pdf
ISO 27001 2002 Update Webinar.pdfControlCase
 

Mais procurados (20)

Security Operation Center Fundamental
Security Operation Center FundamentalSecurity Operation Center Fundamental
Security Operation Center Fundamental
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
 
Vulnerability Assessment Presentation
Vulnerability Assessment PresentationVulnerability Assessment Presentation
Vulnerability Assessment Presentation
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
 
Threat Modeling In 2021
Threat Modeling In 2021Threat Modeling In 2021
Threat Modeling In 2021
 
Threat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formalThreat Hunting - Moving from the ad hoc to the formal
Threat Hunting - Moving from the ad hoc to the formal
 
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 ruleWalk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
Walk This Way: CIS CSC and NIST CSF is the 80 in the 80/20 rule
 
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
Boardroom to War Room: Practical Application of the NIST Cybersecurity Frame...
 
NIST cybersecurity framework
NIST cybersecurity frameworkNIST cybersecurity framework
NIST cybersecurity framework
 
Building an Analytics Enables SOC
Building an Analytics Enables SOCBuilding an Analytics Enables SOC
Building an Analytics Enables SOC
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATION
 
Effective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza AdinehEffective Security Operation Center - present by Reza Adineh
Effective Security Operation Center - present by Reza Adineh
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
 
Vulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingVulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration Testing
 
Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)Guide to Risk Management Framework (RMF)
Guide to Risk Management Framework (RMF)
 
ISO 27001 2002 Update Webinar.pdf
ISO 27001 2002 Update Webinar.pdfISO 27001 2002 Update Webinar.pdf
ISO 27001 2002 Update Webinar.pdf
 

Semelhante a Enterprise Vulnerability Management: Back to Basics

Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Denim Group
 
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Net at Work
 
[EMC] Source Code Protection
[EMC] Source Code Protection[EMC] Source Code Protection
[EMC] Source Code ProtectionPerforce
 
State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019Stefan Streichsbier
 
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldVulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldDenim Group
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa
 
Information Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security MetricsInformation Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security MetricsJack Nichelson
 
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsEmbracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsTom Cappetta
 
SLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshopSLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshopSLVA Information Security
 
API Training 10 Nov 2014
API Training 10 Nov 2014API Training 10 Nov 2014
API Training 10 Nov 2014Digital Bond
 
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the businessCisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the businessCisco Canada
 
Inside SecOps at bet365
Inside SecOps at bet365 Inside SecOps at bet365
Inside SecOps at bet365 Splunk
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchMcKonly & Asbury, LLP
 
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider DisciplineTroubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider DisciplineSagi Brody
 
State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019Stefan Streichsbier
 
Application Assessment Techniques
Application Assessment TechniquesApplication Assessment Techniques
Application Assessment TechniquesDenim Group
 
Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Skybox Security
 

Semelhante a Enterprise Vulnerability Management: Back to Basics (20)

Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
 
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
 
[EMC] Source Code Protection
[EMC] Source Code Protection[EMC] Source Code Protection
[EMC] Source Code Protection
 
State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019
 
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldVulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metrics
 
Information Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security MetricsInformation Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security Metrics
 
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsEmbracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
 
SLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshopSLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshop
 
API Training 10 Nov 2014
API Training 10 Nov 2014API Training 10 Nov 2014
API Training 10 Nov 2014
 
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the businessCisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
 
Inside SecOps at bet365
Inside SecOps at bet365 Inside SecOps at bet365
Inside SecOps at bet365
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect Match
 
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider DisciplineTroubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
 
The State of DevSecOps
The State of DevSecOpsThe State of DevSecOps
The State of DevSecOps
 
State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019
 
State of DevSecOps - GTACS 2019
State of DevSecOps - GTACS 2019State of DevSecOps - GTACS 2019
State of DevSecOps - GTACS 2019
 
Secure Iowa Oct 2016
Secure Iowa Oct 2016Secure Iowa Oct 2016
Secure Iowa Oct 2016
 
Application Assessment Techniques
Application Assessment TechniquesApplication Assessment Techniques
Application Assessment Techniques
 
Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?
 

Último

The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESmohitsingh558521
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Generative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersGenerative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersRaghuram Pandurangan
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rick Flair
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxhariprasad279825
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embeddingZilliz
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsNathaniel Shimoni
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxBkGupta21
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3
 

Último (20)

The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Generative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersGenerative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information Developers
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptx
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embedding
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directions
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptx
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
Moving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdfMoving Beyond Passwords: FIDO Paris Seminar.pdf
Moving Beyond Passwords: FIDO Paris Seminar.pdf
 

Enterprise Vulnerability Management: Back to Basics

  • 1. Enterprise Vulnerability Management BSIDES AUSTIN - April 2016 Damon Small & Kevin Dunn - NCC Group
  • 2. Agenda Welcome & Introductions 03 Session Overview 07 Session Definitions 08 Vulnerability Management 101 09 VulnerabilityAssessment Scans 10 Failing & Pitfalls 21 VMP: Making a Real Difference 22 Session Close 31 2
  • 3. 3 Welcome & Introductions NCC Group – A Global Security Firm • Formed in June 1999 showing immense growth over the past 16 years. • 1800 employees, in 30 office locations • North America, the United Kingdom, Europe and Australia. • We strive to provide Total Information Assurance for our clients. NCC Group in North America • Currently 8 offices in the NA: New York, Atlanta, Chicago, Austin, Seattle, San Francisco, Sunnyvale and Waterloo. • NCC Group combines the best of bread US security brands of iSEC Partners, Matasano, Intrepidus Group and NGS.
  • 4. 4 Welcome & Introductions NCC Group – Security Consulting • Attack & Penetration Focus • Applications • Mobile • Networks & Infrastructure • Physical Security • Embedded Systems • Red Teaming • Incident Response & Forensics • Enterprise Risk / VA Strategy
  • 5. 5 Welcome & Introductions Your Speakers – DAMON SMALL, Technical PM for NCC Group in NA • In IT since 1995; InfoSec since 2001 • Louisiana native: “Not from Texas but I got here as fast as I could!” • Studied music at LSU; grad school in 2005 for Information Assurance • Supported healthcare orgs. in the Texas Medical Center • Vulnerability Management Programs: o Two for Health Care orgs. o One for Oil & Gas o Workflow Analysis & Development o Scanner Platform Deployments
  • 6. 6 Welcome & Introductions Your Speakers – KEVIN DUNN, Technical VP for NCC Group in NA • Technical VP for NCC Group, based in Austin TX. • 14 year career focused on Attack & Penetration techniques & defenses • Prior to that security focused government/military background • Responsible for: o Regional Development & Management o Development of Strategic Technical Practices: § Strategic Infrastructure Security (SIS) § NA Computer Incident Response Team (NA-CIRT) • Specialist in Red Team / Black Ops engagements o (Forms of extreme penetration testing and attack modeling)
  • 7. 7 Session Overview Blue Team is Harder than Red Team! • You’re in charge of VM for your company • You have scanning sensors deployed • You have hardening plans in place • You have remediation strategies and goals • A pentest is commissioned from an outside firm • They prove traversal from the outside to the inside • They become Domain Admin on your network • They access your most critical data and systems.
  • 8. 8 Session Definitions • Vulnerability Assessment: The act of gathering information regarding vulnerabilities on specific hosts, often using scanning tools. (Does include penetration testing). • Vulnerability Management: A business process that includes the following key components: o Identification o Classification o Decision/Decision Record o Mitigation
  • 9. 9 Vulnerability Management 101 • A business process that includes: 1. Identifying Vulnerabilities (VA) 2. Promotes Patching / Hardening / Fix of Issues 3. Decision process regarding remediation activities: a. Fix it, accept it, or transfer the risk. b. Creates an auditable decision record, process for validation, and a process to periodically review “no action” remediation where risk is accepted. c. Decision process should be multi-disciplinary and represent all stakeholders (IT, business, InfoSec, etc.)
  • 10. 10 Vulnerability Assessment Scans Scanning - What is it Good For? • Identifying Vulnerabilities • Remediation Information • Software Inventory • Asset Management Scanning - What is it Not Good For? • Identifying Vulnerabilities • Going Beyond Patching • Workflow/Business Processes
  • 11. 11 Electrons/Photons going though wire/fiber What is being examined What tool can be used 1. Physical 2. Datalink 3. Network 4. Transport 5. Session 6. Presentation 7. Application MediaLayersHostLayers OSI Model The Right Tool for the Right Job
  • 12. 12 Patching vs. Hardening • Patching - Applying a software fix, update or upgrade. This is a code-level change, packaged typically as a binary. It usually comes from the software manufacturer / development team. • Hardening - Changing configuration settings to increase the security of something based on an understanding of which settings are ‘more secure’. Typically defined via some kind of ‘best practices document’. Hardening advice may come from a number of sources.
  • 13. 13 Over-Focus on Scanning / Patching Depth of System Hardening is Typically Shallow • Consider the following issues found on most Pentests! o MSSQL Weak SA Password o Tomcat Manager Weak Password o Jenkins Groovy Script Command Execution o Printer Default Credentials
  • 14. 14 Over-Focus on Scanning / Patching MSSQL Weak SA Password • A few simple steps to full control of server!
  • 15. 15 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
  • 16. 16 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
  • 17. 17 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • Jenkins Integration Manager (source code build env.)
  • 18. 18 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • When poorly configured visiting /script gets you to a ‘Script Console’
  • 19. 19 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • That’s OS command execution! You never know how many privs you have!
  • 20. 20 Over-Focus on Scanning / Patching Printer Default Credentials • Printers can be useful!
  • 21. 21 Failings & Pitfalls Common VMP Problems • Over-prioritization of Scanning - no workflow development • Scan All the Things - but do nothing with the results… • Generate False Positives - and lose credibility* • No Consideration for Network & Business Impact* • No Security Team & Support Org. Relationship • Mistaking VA (alone) as a DefensiveActivity
  • 22. 22 VMP: Making a Real Difference HIGHEST PRIORITIES • Asset Inventory Management • Decision & Remediation Workflows • Visualization & Metrics LOWER PRIORITIES • VulnerabilityAssessment Scanning • Penetration Testing • Buying Cool Toys
  • 24. 24 VMP Process Overview Visualizing VMP Workflows • VMP workflows can be difficult to visualize without prior exposure! • Workflows and process will vary between organizations • For the purposes of this discussion we’ve created an example • Most of our workflows can scale up or down to your requirements • Bring on the HUGE diagram!
  • 25. 25
  • 26. 26 NIST Cybersecurity Framework • VMP allows you to IDENTIFY your assets. • VMP allows you to PROTECT via remediation. • VMP allows you to DETECT vulnerabilities. • VMP helps with effective RESPONSE. • VMP communication workflows help RECOVERY.
  • 27. 27 Considerations Analysis Methods & Opportunities for Improvement • Macro vs Micro Analysis o Vulnerabilities by Host o Hosts by Vulnerability • Minimizing False Positives o Confirmation of Issues from VMP Team § How? o Prior to Escalation to Support Org. o Maintain Credibility
  • 28. 28 VMP Design Checklist (1) Before You Purchase a Scanning Solution… • Do you know your environment? o Enterprise Planning o Asset Discovery • Do you know your stakeholders? o Business Units / Owners o Support Org. Teams • How will the data be consumed? o Consumers o Storage & Transmission o Format & Control
  • 29. 29 VMP Design Checklist (2) Before You Purchase a Scanning Solution… • How will we fit in with existing support workflows? o Scheduling / Change Control o Ticketing (Defect) o Hands on Keyboard o Outage Resolution • What skills or capabilities does our VMP team have? o VulnerabilityAssessment - Hands-on Experience o VulnerabilityAnalysis - Results Interpretation • How will we measure VMP success or failure? o Metrics / Feedback / Process Improvement
  • 30. 30 Okay! Now you can have lunch with a scanner sales person! J
  • 31. 31 Session Close • Scanners have been around for 20 years and yet we still don’t know how to use them, consume their data properly, or fix the things they find to satisfaction. Call to Action • Orgs - If you think the number and types of scans you do is the critical success factor, you are doing it wrong. • Be sure to consider your VMP design and workflows FIRST. • Scanner Vendors - Flinging packets is easy. Workflow integration, data aggregation, ticketing and tracking is much harder than it should be. Please help!
  • 32. 32 Ways to Stay in Touch Kevin Dunn Technical VP – NCC Group, Security Consulting E: kevin.dunn@nccgroup.trust L: https://www.linkedin.com/in/kevdunn T: @kdunn_ncc Damon Small Technical PM - NCC Group, Security Consulting E: damon.small@nccgroup.trust L: https://www.linkedin.com/in/damon-small-7400501 T: @damonsmall

Notas do Editor

  1. The purpose of this slide is to illustrate how certain tools are used to gather specific types of information. Regardless of whether you are discussing scanning or manual app testing, one clear message is that you must have humans involved. Manual app testing will always be more sophisticated than scanners alone, but even with VA scanners, you must have humans analyzing the results and configuring the scans to ensure they network is not taken down. Interest from someone who controlled ICS networks and wanted to give a scanner to a low-end IT employee to scan. This is a bad idea and can wreak havoc if you are not careful. You also need a skilled security pro to analyze the results. (Story about httpd vulns found. Server ops claimed that they must be false positives because these were not web servers. The vuln actually came from the HP SMS server which includes Apache server. Previous analysts failed to recognize this because the results were not vetted by an experienced security pro.) Sampling of tools vs the OSI model. Doesn’t represent well unless you have a defined lexicon. At a particular client site, “Application,” “application,” and “software” meant different things to different people.