Grant Johnson, Technical Account Manager

Phoenix May 14, 2014

Audit and Control of Enterprise Vulnerability Management

Key Elements of EVM

IT Asset Inventory and Control

Risk-based Vulnerability Management & Strategy

Scan Management and Strategy

Vulnerability Tracking and Closure

Scan Exclusion/Exception Process

Some Best Practices

Some Reference and Resources

2

Lifecycle of a Vulnerability

3

Scan

Identification &

Reporting

Ticketing Patching

& Configuration

Verification

I added some key things to remember as you are

planning the audit approach

There are some suggested audit

steps

A risk rating for context

Vulnerability life Cycle

Some quick thoughts

…an ongoing continuous cycle

IT Asset Inventory & Control

IT Asset Inventory and Control

5

CMDB- Configuration Management Database Or IT Asset Inventory

“You cannot manage that which you do not track”

IT Asset Inventory and Control

6

Things to Know:

Audit Steps:

Risk Rating

List-to-Floor, Floor-to-List inventory check (accuracy & completeness) Inspect data center inventory for proper labeling on devices Map the environment –[Tool based] and compare with inventory list

Inventories are VITAL to ensure vulnerability scan coverage is complete These inventories are difficult to maintain and are error prone Server Inventory should be tested or spot-checked for completeness Information could include, server, I.Ps, rack location, applications, owner,

data risk, etc.. Maintenance for the inventories are usually a collective effort, don’t shoot

the messenger

Scan Management and Strategy

Scan Management & Strategy

8 Risk Rating

Scan Intervals - There should be a controlled process that determines scan frequency and reporting frequency. Be observant of possible gaps created by intervals Scan Metrics – Vulnerability scanning can be affected by network outages, firewalls, traffic management, DNS Errors etc. Scans require administrative access that can affect scan completeness and accuracy. Good vulnerability management will have a method of tracking scan success Configuration Management – The process by which management defines permissible services, settings and applications - e.g. Should FTP be allowed for servers within the DMZ? A solid hardening process will save hours of vulnerability management and reduce risk.

Scan Management & Strategy

9

What to scan… Pretty much everything. Here is the short list:

Web Servers: Apache, Microsoft ISS; iPlanet; Lotus Domino; IpSwitch; Zeus; full support for virtual hosting. SMTP/POP Servers: Sendmail; Microsoft Exchange; LotusDomino; Netscape Messaging Server; QMail. FTP Servers: IIS FTP Server; WuFTPd; WarFTPd. Firewalls: Check Point Firewall-1/VPN-1 and NG; Cisco PIX; Juniper NetScreen; Gauntlet; CyberGuard; Raptor. Databases: Oracle; Sybase; MS SQL; PostgreSQL; MySQL.

eCommerce: Icat; EZShopper; Shopping Cart; PDGSoft; Hassan Consulting Shopping; Perishop.

LDAP Servers: Netscape; IIS; Domino; Open LDAP.

Load Balancing Servers: Cisco CSS, Alteon, F5 BIG IP;

IBM Network Dispatcher; Intel Routers; Administrable.

Switches and Hubs: Cisco; 3Com; Nortel Networks; Cabletron; Lucent; Alcatel.

Wireless Access Points: Cisco; 3Com; Symbol; Linksys; D-Link; Netgear; Avaya; Apple Airport; Nokia;

Siemens.d

Scan Management & Strategy

10

Things to Know:

Audit Steps:

Risk Rating

Select a sample of high-risk servers and determine the last-scanned date and is it within the stated goals of the scan strategy

Does the scan interval meet regulatory requirements? Review the process for updating the scan signature and scan completeness –

Manual updates should be fully justified and tested. Determine if any critical tests are excluded from review - Management should justify Determine if Scan success and results are tracked Are hardening guidelines published and followed – How?

Scan frequency should match the risk of loss associated with the data and system Frequency can range from monthly/bi monthly to continuous Vulnerabilities garner differing levels of Risk . e.g. – associated with malware, remotely

executable etc.. Scan signature should be VERY current – Auto-update is recommended Approach needs to comply with local and national laws

Risk Based Vulnerability Strategy

Risk Based Vulnerability Strategy Three Broad Risks to consider..

12

Public Network

Management should have a Defined data classification scheme There should be a concise inventory of systems that host, store and process sensitive data

Outward and Customer- Facing systems need to be prioritized These systems should be clearly identifiable

Risk Based Vulnerability Strategy How do you priorities which high severity findings to fix first?

13

In Summary: Start with -High exposure systems – Public facing - Systems that hold or use High risk data - Fix the High probably/High severity, patchable vulnerabilities

Prioritize vulnerabilities when known exploits are published by third party vendors and/or publicly available sources. Good VM tools constantly correlate exploitability information from real-time feeds to provide up to date references to exploits and related security resources.

Look for malware associated vulnerabilities. Vulnerability scanners correlate malware information with vulnerabilities when malware threats for vulnerabilities are published within the Trend Micro Threat Encyclopedia or other authoritative sources

Prioritize the vulnerability can be detected using remote (unauthenticated) scanning.

Begin with vulnerabilities that are fixable with a patch that is currently available from the vendor.

Risk Based Vulnerability Strategy

14

The VM solution needs to provide the capability to scan for and fix vulnerabilities in a broad range of categories, including: Back Doors and Trojan Horses (bypass authentication systems).

Brute force attacks (defies cryptography by systematically trying different keys).

CGI (exploits the Common Gateway Interface).

Databases.

DNS and Bind (exploits Domain Name Services).

E-commerce applications.

File sharing.

File Transfer Protocol.

Firewalls.

Risk Based Vulnerability Strategy

15

Things to Know:

Audit Steps:

Risk Rating

Review system risk assessment used to identify HIGH risk systems based on Data sensitivity

Review network diagrams used to track externally facing systems Ensure HIGH risk systems are scanned in accordance with policy

guidelines Review action plans associated with high severity vulnerabilities

Management needs to have a plan to identify and priorities the systems that are subject to vulnerability management. It is very difficult if not impossible to “fix all” or “All Sev 4s and 5s”

Risk differs from server to server depending on Host data, internet facing, etc.

Vulnerabilities garner differing levels of threat and should match the patch cycles

Start with the fixable vulnerabilities

Vulnerability Tracking and Closure

Vulnerability Tracking and Closure

17

Things to Know:

Audit Steps:

Risk Rating

Ensure system ownership is properly documented – lines of responsibility for security are properly assigned

Is there a process in place to escalate overdue or unpatched systems outside of policy- Test by reviewing scan results

Does management monitor aging of vulnerabilities of a system

There needs to be a manageable, measurable process to track Vulnerabilities

Many companies use ticketing systems There will ALWAYS be exceptions to a policy – Need to ensure that exceptions are approved

and reviewed at a regular interval Vulnerability ageing is a commonly applied

metric

Scan Exclusions and

Exception Process

Scan Exclusions & Exceptions

19 Risk Rating

Some systems maybe appropriately excluded from vulnerability scanning!!

Possible Scenarios

Process networks Air-Gaped networks Low risk, untrusted

systems – Be VERY wary of this justification

Smart Equipment (oops..) System is being DE

installed System cannot tolerated

a scan without interruption

Scan Exclusion/Exceptions

20

Things to Know:

Audit Steps:

Risk Rating

Is there a formal, documented process to exclude a system from scanning? Are scanning exceptions reviewed at a regular interval? Select a sample of excluded hosts and determine if the hosts Determine if there are action plans in place to remediate older systems and

subject them to future vulnerability scans

High risk in that these are permanent blind spots for vulnerabilities to hide

There are some systems that should be excluded – the need for security scanning does not outweigh business use.

Scan-caused crashed can be an indication of a misconfigured system

Exceptions to scanning should be documented/approved and subject to regular review

Some Best Practices

Some Best Practices

22

Vulnerability Management is best driven at the CISO level – Metrics should be designed to give “C” level management something to “manage to” number of days to close vulnerabilities scan coverage as a % authentication %

Patch Metrics and Configuration Management dashboards have been found to be more effective that voluminous reports of high severity vulnerabilities

Be cautious when recommending automatic ticketing for new vulnerabilities

Risk Rating

Some Good References- free

23 www.qualys.com/enterprises/qualysguard/resources/

Free Services at your Fingertips

24

www.qualys.com/secure

Thank You gjohnson@qualys.com