Networks

1. powered by
Why won’t these damn things just patch themselves?: The
Hitchhiker’s Guide to Threat and Vulnerability Management

2. Meet Your Presenter
Ryan Elmer
• Master of Science, Security Technologies – The University of Minnesota
• Published by American Banker, Star Tribune, Bloomberg Business Week
• Former faculty member ICBA Community Bank IT Institute
• Technology Implementer (The Ohio State University, Total Networx)
• Information Security Auditor (RSM McGladrey)
FRSecure
• Founded in 2008
• HQ in Minnetonka
• Sole focus fixing a broken information security industry
• Full suite of InfoSec services
• Product Agnostic – Your IT guys will love us!

3. • A Threat and Vulnerability Management is one of the most critical
elements of an Information Security Program.
• Organizations which lack “brilliance in the basics” and will have difficulties
implementing an effective vulnerability management program.
• Vulnerability Assessments are often confused for Vulnerability
Management. This can lead to unmitigated vulnerabilities and increased
risk.
• Most importantly, it means wasted money.
Meet Your Presentation

5. A vulnerability is a system susceptibility or flaw
A threat is an attacker who can access the flaw and has the capability to exploit it.
A risk is a convergence of a vulnerability and threat that has a defined likelihood
and impact.
Vulnerability Management is the cyclical practice of identifying, classifying,
remediating and mitigating vulnerabilities.
Meet Your Definitions

6. An inherent weakness in technology tools resulting from a design
flaw. Universal to everyone utilizing that tool.
• System and Applications not patched for known security flaws
• Hardware, OS, Application, Database, Network Equipment
• Web Applications and Web Services
• Known security issues, incorrectly coded, unpatched known security flaws
• Browser and Plugins
• Not up to date, not patched for known security flaws
• Application and OS Configs
• Never configured, configuration changes
Vulnerability - Technical

7. Weaknesses resulting from implementation, configuration and
convergence of technological tools. Specific to that organization.
• Remote Access (Admin, Terminal Servers)
• Lack of Segmentation (Flat Networks)
• Weak Passwords
• Default Configs (WPAD over LLMNR)
• Convergence issues (Auto-Authenticate)
Conceptual and Architectural Issues

8. Vulnerability - Human

9. Vulnerability
Management
Vulnerability
Assessment
We Can’t Confuse These Two

10. An effective vulnerability management program relies on other mature
programs.
Foundations of vulnerability management
Vulnerability
Management
Access Control
Change Management
Asset Management

11. Expectations
• Accurate, Reviewed and Reconciled Inventories of Hardware,
Software and Data Assets.
• Data is categorized as public, non-public and confidential and assets
are classified by the types of data which they house.
• Extra credit: Data flow diagrams show connections between systems
Reasons
• A complete list of assets ensures that everything gets scanned
• Classified assets allows for more flexibility in accepting risk
(depending on data and interconnectedness)
Asset Management-- Realistically

12. Expectations
• The organization tracks significant changes to technology with tools as complex as a
COTS Ticketing System or a spreadsheet.
• Minimum Tracking:
• Description/Nature of Change
• System
• Testing/Business Unit Sign-off
• Roll-Back Procedures
• Approval
Reasons
• Changes to devices can introduce new vulnerabilities and configuration issues
• The testing and roll-back procedures make sure that you don’t wreck your
environment.
Change Management -- Realistically

13. Expectations
• Access control is in place. This includes user, system and service account
access.
• vLANs and ACLs are in place
Reasons
• Appropriate security can be placed on segregated systems according to the
data which resides on them.
• This is always easier to talk about than to actually implement. De-activate
service accounts when they are not use, create vLANs to the best of your
ability. Pen Test to verify this has been done well.
Access Control -- Realistically

14. Patching
Vulnerability Scanning
Analysis, Decision Making, Mitigation
Penetration Testing
Vulnerability Management
Turning Your Current Program Into Management

15. Vulnerability Scanning v Pen Testing

16. Vulnerability Scanning
Purpose Identify, rank and report technical vulnerabilities
Goal Determine all the vulnerabilities that we know can be exploited
Example Checking all exterior and interior doors
Focus Breadth over Depth
Tactics Fast and Loud
Tests Preventative Controls
Cadence Quarterly, Monthly
What it do?!

17. • Enumeration
• Discover Ports and Services (SSH, Telnet, SNMP)
• Interrogation of Services
• Scan
• Analyze
• Viability of Vulnerability
• CVSS
• Research
• Impact
• Data
• Connections
• Make Risk Determinations
• Mitigate (patch, re-config)
• Transfer (outsource, insure)
• Accept (document, compensate)
• Avoid (turn it off)
Vulnerability Assessment Process

18. • Banks need to increase the frequency which they scan.
• Vulnerability scans are not inherently better or worse than a penetration
test, it depends on your objectives. Vendors and Examiners who tell you
this are wrong.
• Running a vulnerability scan is very easy. Interpreting the results are
difficult the first time and get easier as you go.
• On-going scanning with external vendors should be pretty damn cheap. In
fact, you can do it for free with OpenVAS.
• Credentialed Scans provide a more accurate picture of your vulnerabilities.
Attaining a credential isn’t that hard, this does not distort the results.
Vulnerability Scanning – Insider Secrets

19. Penetration Testing – Exploit It

20. Penetration Testing
Purpose Exploit vulnerabilities to circumvent or defeat security
Goal Determine what can be accomplished exploiting those vulnerabilities
Example Entering first available door to search
Focus Depth over Breadth
Tactics Low and Slow
Tests Effectiveness of Vulnerability Management Program; Detective and Reactive Controls
Cadence Annually
What it do?!

21. • Pen Tests are one of the fastest maturing areas of information security, even
though we don’t fully understand the basics.
• Scope
• Internal
• External
• Threat Emulation
• Blue Team/Red Team/Purple Team
• Knowledge
• White Box - Full knowledge of Systems – Faster, More Thorough
• Black Box – No Knowledge – Most accurate threat emulation
• What is an Assumed Breach?
• Providing credentials
• Downloading payload
Penetration Testing

22. Penetration Test – Insider Secrets
• Using white box testing, dropping defenses or assuming a breach
(giving credentials) save money, they aren’t “cheating”
• Saves Money!
• Goal is to identify vulnerabilities, not confirm you’re safe.
• If you want your penetration test to mimic the real world, use social
engineering.
• Performing the only vulnerability scan of the year during the pen test
is a very bad investment. Should not pay a premium to find low
hanging fruit. Frees Pen Tester time to focus on issues not found by
scanner.

23. • The “right” pen test for your organization should align with objectives.
• Will and should change from year to year, might mean going “backward”
• Want to test newly implemented vLAN? Provide several credentials from multiple
segments.
• Done that for a couple years? Maybe a black box test is best.
• Scoping
• Share results and key metrics from vulnerability scans, confirm their test isn’t looking
for technical vulnerabilities
• Talk about the network and any recent changes (local admin, segmentation, user
profiles, shares, interconnectedness)
• Talk about objectives, what do you want to accomplish?
• Look for architectural and conceptual issues
• Test detective and reactive controls
• Affirm segmentation
• Train staff on indicators of compromise
• Confirm confidential data is well protected
Picking the right Pen Test

24. Vulnerability Management

25. • Not a project, but a program
• No beginning or end, revolving process
• Meeting regulatory goals
• Defined success factors (number by severity level, number of hosts with
vulnerabilities, vulnerability age)
• Measurable – Because we have success factors
• Repeatable – Documented Process
• Involved with other programs (patch management, ticketing, asset
management, configuration management)
• Accountability – Historical data to compare performance
• Context, context and more context
Vulnerability Management

26. Vulnerability Management Best Practices
• Set the foundation: Asset Inventory, Change Management, Access Control
• Run your typical vulnerability assessment process.
• Track your key metrics
• Make risk decisions and document the process
• Repeat to gather all low hanging fruit
• Pen Test to find the issues vulnerability scanners cannot find. This will also then measure
the effectiveness of your vulnerability management process.

27. • Questions * ††
*there are no stupid questions
†† unless you’re a Packer fan
• Answers (kind of)
Ryan Elmer
relmer@frsecure.com
(952) 451-5081

28. • If executives do not understand a project, they will not allocate the
time, money or resources needed to make it successful.
• Attackers only need to be right one time, whereas IT needs to be right
100%
Risks

29. Information security is the application of administrative, physical and
technical controls used to mitigate risks to the confidentiality, integrity and
availability of information.
Information Security
Administrative
• People
Physical
• Stuff
Technical
• Machines
Confidentiality
• Privacy
Integrity
• Accuracy
Availability
• Accessibility

30. • Assets with varying value
• Defined Perimeter (outside and inside)
• Things which have high likelihood of theft or high impact go inside, things which have
low probability or low impact go outside.
• Means of ingress/egress (doors, windows)
• Implemented controls
• Preventative (locks)
• Detective (alarm systems, dogs)
• Reactive (law enforcement, guns, maybe your dog, but not mine)
• Corrective
InfoSec as a House

31. Risk Management
Identification –– Indicator of a major risk
Articulation –– Specifies the event
Ownership –– Party responsible
Remediation –– How it’s fixed
“Oh My God!”
“The Bar’s On Fire”
“Somebody”
“Save the Beer”
The forecasting and evaluation of risks together with the identification of procedures
to avoid or minimize their impact

32. “I cannot secure it if I don’t know that I have it”
• Asset Management
• Determines what is going to be scanned
• Defines the priority of the asset (classification of data on it, interconnectedness)
“I cannot secure what I cannot control”
• Access Control
• A flat network with no access control means that every vulnerability needs to be fixed
• Change Management
• Tracks deliberate changes to the environment through ticketing and testing
• Used to detect unauthorized changes
Foundations of vulnerability management

33. Vulnerability Scan Penetration Test
Purpose Identify, rank and report vulnerabilities Exploit vulnerabilities to circumvent or defeat
security
Goal Determine all vulnerabilities that could
exploited
Determine what can be accomplished exploiting
those vulnerabilities
Real World Example Checking all exterior and interior doors Entering first available door to search
Focus Breadth over Depth Depth over Breadth
Tactics Loud and Fast Low and Slow
Tests Preventative controls Detective and Reactive controls
Vulnerability Scans vs. Penetration Tests

34. • Different tools for different purposes
• Port scanner (Nmap)
• Network Vulnerability Scanner (Nessus)
• Web App Security Scanner (Burp Suite, Accunetix)
• Database Security Scanner
• Host-based vulnerability scanner (Lynis, Microsoft Baseline Security Analyzer)
• AIX Security Configuration Scanner
Vulnerability Scanner