Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a...

20
Reducing the Risk of Known Vulnerabilities Jason Cathey CISO Bank OZK

Transcript of Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a...

Page 1: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reducing the Risk of Known Vulnerabilities

Jason Cathey

CISO

Bank OZK

Page 2: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

What is a Vulnerability?

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

vul-ner-a-bil-i-ty (noun)The quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotional.

- Google Dictionary

Vulnerability is a cyber-security term that refers to a flaw in a system that can leave it open to attack. A vulnerability may also refer to any type of weakness in a computer system itself, in a set or procedures, or in anything that leaves information security exposed to a threat. - Techopedia

Page 3: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Why Perform Assessments?

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Regulatory Requirements

✓ FFIEC IT Examination Handbook IV.A.2(c): Vulnerability Assessments

✓ Payment Card Industry Data Security Standard (PCI DSS): Maintain a Vulnerability Management Program

✓ Health Insurance Portability and Accountability (HIPAA ) 45CFR$164.308(a)(1)(ii)(A): …vulnerability assessment of all the IT assets….

Page 4: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Why Perform Assessments?

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Best Practice

• National Institute of Standards and Technology (NIST)

• SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program

• SP 800-115 (2008): Technical Guide to Information Security Testing and Assessment

• SANS/CIS Top 20 Critical Security Controls (CSC)

• CSC 4: Continuous Vulnerability Assessment and Remediation

Page 5: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Why Perform Assessments?

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Real World Threats

• Documented vulnerabilities were the disclosed initial point of entry for 3 of the 5 biggest data breaches of the 21st

century.

• Adult Friend Finder (#2, October 2016) - Local File Inclusion Vulnerability

• Equifax (#4, July 2017) - Website Application Vulnerability

• Heartland Payment Systems (#5, March 2008) – SQL Injection Vulnerability

The 16 biggest data breaches of the 21st centuryhttps://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.html

Page 6: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Vulnerability Scanners

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Community Platforms• Nmap Security Scanner

• OpenVAS

• Microsoft Baseline Security Analyzer

• Nexpose Community Edition

Commercial Platforms• Nessus

• Nexpose

• Core Impact

Page 7: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Performing Vulnerability Scans

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

• Identify Asset Groups • Network Segmentation

• Business Unit

• Device Type

• Data Sensitivity

• Network and External Exposure

• Mitigating Controls

• Determine Frequency

• Set Schedules

Page 8: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Analyzing Scan Results

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

CVSS provides 3 important benefits• Standardized vulnerability scores

• Open framework

• Enables prioritized risk

Page 9: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Analyzing Scan Results

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Determining the Risk• Hosts – Know Your Network

• Host Exposure

• Data Sensitivity

• Asset Groups

• Vulnerability – Common Vulnerability Scoring System (CVSS), Scanner Classification, Override when applicable

• Critical

• High

• Medium

• Low

• Informational

Page 10: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Analyzing Scan Results

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

The initial scans will more than likely produce a very large number of findings

The Vulnerability Assessment Program should mature the Configuration Standards and Patch Management Programs

• Now that you know what you didn’t know, who cares?

• Information Technology – Uses the results to target mitigation efforts

• Host-Based Approach – Focus efforts on hosts with a higher volume of more critical vulnerabilities

• Vulnerability-Based Approach – Focus efforts on more critical vulnerabilities that affect a larger number of hosts

• Information Security – Focus preventative and detective controls on assets that are more susceptible due to identified, known vulnerabilities

• Risk/Executives – What is the perceived overall risk to the Confidentiality, Integrity and Availability to the network and corporate data due to the vulnerabilities and is it within the Risk Appetite

Page 11: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

• Technical Resources have the experience, knowledge and need to work in the details

• Provide access to dashboards, reports and scan output

Page 12: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Executive Leadership doesn’t want the details, they want something simple, clear, concise and measurable over time.

Page 13: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Executive Leadership doesn’t want the details, they want something simple, clear, concise and measurable over time.

Page 14: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Executive Leadership doesn’t want the details, they want something simple, clear, concise and measurable over time.

Page 15: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Executive Leadership doesn’t want the details, they want something simple, clear, concise and measurable over time.

Page 16: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Page 17: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Reporting

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Page 18: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

VERI Example

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Page 19: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Vulnerability Management Standard

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

• Topics

• Scope of scanning

• Who is authorized to scan

• Scan Frequency

• Vulnerability Severity Scale

• Time to Remediate

• Access to results and findings

• Enforcement

• Exceptions

• Vendor Maintained Systems

• Have an approved standard to strengthen processes

• Collaborate with IT Staff and Management

Page 20: Reducing the Risk of Known Vulnerabilities•SP 800-40 v1 (2002), v2 (2005), v3 (2013): Creating a Path and Vulnerability Management Program •SP 800-115 (2008): Technical Guide to

Disclaimer: Nothing in this presentation represents the opinions, policy position, or activities of my employer.

Jason Cathey, CISSP | https://www.linkedin.com/in/jasoncathey/

https://www.linkedin.com/in/jasoncathey/

The NARA Rule and NIST SP 800-171 · 2018-03-21 · • 50+ security controls from NIST SP 800-53 ... requirements, taken from NIST SP 800-53’s security controls 20. Requirements

The NARA Rule and NIST SP 800-171 · 2018-03-21 · • 50+ security controls from NIST SP 800-53 ... requirements, taken from NIST SP 800-53’s security controls 20. Requirements

NIST SP 800-38D Draft For Public Comment4

NIST SP 800-38D Draft For Public Comment4

Dual EC in X9.82 and SP 800-90 - NIST · Moving Work to SP 800 -90 • SP 800-90 (initial draft in 2005) – Mostly just DRBGs from X9.82 Part 3 – Intended to get wider review:

Dual EC in X9.82 and SP 800-90 - NIST · Moving Work to SP 800 -90 • SP 800-90 (initial draft in 2005) – Mostly just DRBGs from X9.82 Part 3 – Intended to get wider review:

INSTRUCTIONS TO CONVERT PUMP FOR INLINE USE · SP-290 SP-400 SP-530 SP-800 . Tel: 631-234-5261 or 800-458-5876 Fax: 631-234-7809 or 631-234-4778 Email: sales@dannermfg.com Distribué

INSTRUCTIONS TO CONVERT PUMP FOR INLINE USE · SP-290 SP-400 SP-530 SP-800 . Tel: 631-234-5261 or 800-458-5876 Fax: 631-234-7809 or 631-234-4778 Email: [email protected] Distribué

Fortanix SDKMS ApplianceCert # Algorithm Standard Model/ Method Key Lengths, Curves or Moduli Use 5282 AES FIPS 197, SP 800-38F SP 800-38C, SP 800‐38D ECECB, CBC, CTR, CFB 128, GCM,

Fortanix SDKMS ApplianceCert # Algorithm Standard Model/ Method Key Lengths, Curves or Moduli Use 5282 AES FIPS 197, SP 800-38F SP 800-38C, SP 800‐38D ECECB, CBC, CTR, CFB 128, GCM,

NIST SP 800-63-3 #idcon vol.22

NIST SP 800-63-3 #idcon vol.22

NIST SP 800-171 DoD Assessment Methodology, Version 1 SP 800... · 2020-03-17 · NIST SP 800-171 DoD Assessment Methodology, Version 1.1, March 13, 2020 5 iii) This assessment is

NIST SP 800-171 DoD Assessment Methodology, Version 1 SP 800... · 2020-03-17 · NIST SP 800-171 DoD Assessment Methodology, Version 1.1, March 13, 2020 5 iii) This assessment is

Draft Special Publication 800-73-4, Interfaces for ...€¦ · 2015-05-29  · 162 SP800-73-3, SP 800-73-2, or SP 800-73-1) are unaware of new SP 800-73-4 features and thus have the

Draft Special Publication 800-73-4, Interfaces for ...€¦ · 2015-05-29  · 162 SP800-73-3, SP 800-73-2, or SP 800-73-1) are unaware of new SP 800-73-4 features and thus have the

NIST SP 800-53 Rev. 4

NIST SP 800-53 Rev. 4

NIST SP 800-53 Security Controls Reference

NIST SP 800-53 Security Controls Reference

NIST SP 800-53 Rev - Carahsoft · HPE Security Fortify Audit Workbench NIST SP 800-53 Rev.4 Riches_scan Compliance Pass Fail

NIST SP 800-53 Rev - Carahsoft · HPE Security Fortify Audit Workbench NIST SP 800-53 Rev.4 Riches_scan Compliance Pass Fail

Navigating Unclassified Information System …...Replacing NIST SP 800-53 based controls with NIST SP 800-171 NIST SP 800-171 Requirement NIST SP 800-53 Requirement (from DFARS Table

Navigating Unclassified Information System …...Replacing NIST SP 800-53 based controls with NIST SP 800-171 NIST SP 800-171 Requirement NIST SP 800-53 Requirement (from DFARS Table

NIST SP 800 53r4 Controls

NIST SP 800 53r4 Controls

NIST SP 800-14, Generally Accepted Principles and ...

NIST SP 800-14, Generally Accepted Principles and ...

NIST SP 800-18

NIST SP 800-18

DRAFT SPECIAL PUBLICATION (SP) (Draft SP 800 …...The following information was posted to CSRC announcing release of this document: Sep. 24, 2013 SP 800-52 Rev. 1 DRAFT Guidelines

DRAFT SPECIAL PUBLICATION (SP) (Draft SP 800 …...The following information was posted to CSRC announcing release of this document: Sep. 24, 2013 SP 800-52 Rev. 1 DRAFT Guidelines

NIST SP 800-88, Guidelines for Media Santifization

NIST SP 800-88, Guidelines for Media Santifization

Are You Ready for NIST SP 800-171?

Are You Ready for NIST SP 800-171?

Compliance to NIST SP 800-171 - Protecting Controlled ... · Compliance to NIST SP 800-171 - Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems

Compliance to NIST SP 800-171 - Protecting Controlled ... · Compliance to NIST SP 800-171 - Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems

SPRS Access for NIST SP 800-171

SPRS Access for NIST SP 800-171