SlideShare a Scribd company logo

Enterprise Vulnerability Management: Back to Basics

•
•
Damon Small
Damon Small

Vulnerability Management is the lifecycle of identifying and remediating vulnerabilities in an organization's enterprise. A number of companies are starting to do this well, but in some cases, focus on advanced and emerging threats has had the unintended consequence of leaving Vulnerability Management unattended. Defense is actually hard work and people aren't doing it as well as they should! Considered in the context of asymmetric warfare, Blue Teaming is more difficult than Red Teaming. Coupled with the fact that most vulnerabilities do not actually suffer from advanced attacks and 0-days, Vulnerability Management must be the cornerstone of any Information Assurance Program. The speakers, Kevin Dunn and Damon Small, will describe the key elements of a mature Vulnerability Management Program (VMP) and the pitfalls encountered by many organizations as they try to implement it. Dunn and Small will include detailed examples of why purchasing the scanner should be one of the last decisions made in this process, and what the attendee must do to ensure the successful defense of company assets and data. This session will cover: - Vulnerability Management: What is it good for? - What is it not good for? - How do I make a real difference?

Technology
1 of 32
Download to read offline
Enterprise Vulnerability Management BSIDES AUSTIN - April 2016 Damon Small & Kevin Dunn - NCC Group
Agenda Welcome & Introductions 03 Session Overview 07 Session Definitions 08 Vulnerability Management 101 09 VulnerabilityAssessment Scans 10 Failing & Pitfalls 21 VMP: Making a Real Difference 22 Session Close 31 2
3 Welcome & Introductions NCC Group – A Global Security Firm • Formed in June 1999 showing immense growth over the past 16 years. • 1800 employees, in 30 office locations • North America, the United Kingdom, Europe and Australia. • We strive to provide Total Information Assurance for our clients. NCC Group in North America • Currently 8 offices in the NA: New York, Atlanta, Chicago, Austin, Seattle, San Francisco, Sunnyvale and Waterloo. • NCC Group combines the best of bread US security brands of iSEC Partners, Matasano, Intrepidus Group and NGS.
4 Welcome & Introductions NCC Group – Security Consulting • Attack & Penetration Focus • Applications • Mobile • Networks & Infrastructure • Physical Security • Embedded Systems • Red Teaming • Incident Response & Forensics • Enterprise Risk / VA Strategy
5 Welcome & Introductions Your Speakers – DAMON SMALL, Technical PM for NCC Group in NA • In IT since 1995; InfoSec since 2001 • Louisiana native: “Not from Texas but I got here as fast as I could!” • Studied music at LSU; grad school in 2005 for Information Assurance • Supported healthcare orgs. in the Texas Medical Center • Vulnerability Management Programs: o Two for Health Care orgs. o One for Oil & Gas o Workflow Analysis & Development o Scanner Platform Deployments
6 Welcome & Introductions Your Speakers – KEVIN DUNN, Technical VP for NCC Group in NA • Technical VP for NCC Group, based in Austin TX. • 14 year career focused on Attack & Penetration techniques & defenses • Prior to that security focused government/military background • Responsible for: o Regional Development & Management o Development of Strategic Technical Practices: § Strategic Infrastructure Security (SIS) § NA Computer Incident Response Team (NA-CIRT) • Specialist in Red Team / Black Ops engagements o (Forms of extreme penetration testing and attack modeling)
7 Session Overview Blue Team is Harder than Red Team! • You’re in charge of VM for your company • You have scanning sensors deployed • You have hardening plans in place • You have remediation strategies and goals • A pentest is commissioned from an outside firm • They prove traversal from the outside to the inside • They become Domain Admin on your network • They access your most critical data and systems.
8 Session Definitions • Vulnerability Assessment: The act of gathering information regarding vulnerabilities on specific hosts, often using scanning tools. (Does include penetration testing). • Vulnerability Management: A business process that includes the following key components: o Identification o Classification o Decision/Decision Record o Mitigation
9 Vulnerability Management 101 • A business process that includes: 1. Identifying Vulnerabilities (VA) 2. Promotes Patching / Hardening / Fix of Issues 3. Decision process regarding remediation activities: a. Fix it, accept it, or transfer the risk. b. Creates an auditable decision record, process for validation, and a process to periodically review “no action” remediation where risk is accepted. c. Decision process should be multi-disciplinary and represent all stakeholders (IT, business, InfoSec, etc.)
10 Vulnerability Assessment Scans Scanning - What is it Good For? • Identifying Vulnerabilities • Remediation Information • Software Inventory • Asset Management Scanning - What is it Not Good For? • Identifying Vulnerabilities • Going Beyond Patching • Workflow/Business Processes
11 Electrons/Photons going though wire/fiber What is being examined What tool can be used 1. Physical 2. Datalink 3. Network 4. Transport 5. Session 6. Presentation 7. Application MediaLayersHostLayers OSI Model The Right Tool for the Right Job
12 Patching vs. Hardening • Patching - Applying a software fix, update or upgrade. This is a code-level change, packaged typically as a binary. It usually comes from the software manufacturer / development team. • Hardening - Changing configuration settings to increase the security of something based on an understanding of which settings are ‘more secure’. Typically defined via some kind of ‘best practices document’. Hardening advice may come from a number of sources.
13 Over-Focus on Scanning / Patching Depth of System Hardening is Typically Shallow • Consider the following issues found on most Pentests! o MSSQL Weak SA Password o Tomcat Manager Weak Password o Jenkins Groovy Script Command Execution o Printer Default Credentials
14 Over-Focus on Scanning / Patching MSSQL Weak SA Password • A few simple steps to full control of server!
15 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
16 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
17 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • Jenkins Integration Manager (source code build env.)
18 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • When poorly configured visiting /script gets you to a ‘Script Console’
19 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • That’s OS command execution! You never know how many privs you have!
20 Over-Focus on Scanning / Patching Printer Default Credentials • Printers can be useful!
21 Failings & Pitfalls Common VMP Problems • Over-prioritization of Scanning - no workflow development • Scan All the Things - but do nothing with the results… • Generate False Positives - and lose credibility* • No Consideration for Network & Business Impact* • No Security Team & Support Org. Relationship • Mistaking VA (alone) as a DefensiveActivity
22 VMP: Making a Real Difference HIGHEST PRIORITIES • Asset Inventory Management • Decision & Remediation Workflows • Visualization & Metrics LOWER PRIORITIES • VulnerabilityAssessment Scanning • Penetration Testing • Buying Cool Toys
23 Scan Data Human Analysis Actionable Information Turning Data Into Information
24 VMP Process Overview Visualizing VMP Workflows • VMP workflows can be difficult to visualize without prior exposure! • Workflows and process will vary between organizations • For the purposes of this discussion we’ve created an example • Most of our workflows can scale up or down to your requirements • Bring on the HUGE diagram!
25
26 NIST Cybersecurity Framework • VMP allows you to IDENTIFY your assets. • VMP allows you to PROTECT via remediation. • VMP allows you to DETECT vulnerabilities. • VMP helps with effective RESPONSE. • VMP communication workflows help RECOVERY.
27 Considerations Analysis Methods & Opportunities for Improvement • Macro vs Micro Analysis o Vulnerabilities by Host o Hosts by Vulnerability • Minimizing False Positives o Confirmation of Issues from VMP Team § How? o Prior to Escalation to Support Org. o Maintain Credibility
28 VMP Design Checklist (1) Before You Purchase a Scanning Solution… • Do you know your environment? o Enterprise Planning o Asset Discovery • Do you know your stakeholders? o Business Units / Owners o Support Org. Teams • How will the data be consumed? o Consumers o Storage & Transmission o Format & Control
29 VMP Design Checklist (2) Before You Purchase a Scanning Solution… • How will we fit in with existing support workflows? o Scheduling / Change Control o Ticketing (Defect) o Hands on Keyboard o Outage Resolution • What skills or capabilities does our VMP team have? o VulnerabilityAssessment - Hands-on Experience o VulnerabilityAnalysis - Results Interpretation • How will we measure VMP success or failure? o Metrics / Feedback / Process Improvement
30 Okay! Now you can have lunch with a scanner sales person! J
31 Session Close • Scanners have been around for 20 years and yet we still don’t know how to use them, consume their data properly, or fix the things they find to satisfaction. Call to Action • Orgs - If you think the number and types of scans you do is the critical success factor, you are doing it wrong. • Be sure to consider your VMP design and workflows FIRST. • Scanner Vendors - Flinging packets is easy. Workflow integration, data aggregation, ticketing and tracking is much harder than it should be. Please help!
32 Ways to Stay in Touch Kevin Dunn Technical VP – NCC Group, Security Consulting E: kevin.dunn@nccgroup.trust L: https://www.linkedin.com/in/kevdunn T: @kdunn_ncc Damon Small Technical PM - NCC Group, Security Consulting E: damon.small@nccgroup.trust L: https://www.linkedin.com/in/damon-small-7400501 T: @damonsmall

Recommended

Vulnerability Management Program
Vulnerability Management ProgramVulnerability Management Program
Vulnerability Management Program
Dennis Chaupis
 
Implementing Vulnerability Management
Implementing Vulnerability Management Implementing Vulnerability Management
Implementing Vulnerability Management
Argyle Executive Forum
 
Planning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management ProgramPlanning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management Program
Sasha Nunke
 
Vulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskVulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize Risk
AlienVault
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
asherad
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
Patch and Vulnerability Management
Patch and Vulnerability ManagementPatch and Vulnerability Management
Patch and Vulnerability Management
Marcelo Martins
 
USPS CISO Academy - Vulnerability Management
USPS CISO Academy - Vulnerability ManagementUSPS CISO Academy - Vulnerability Management
USPS CISO Academy - Vulnerability Management
Jim Piechocki
 

Recommended

Vulnerability Management Program
Vulnerability Management ProgramVulnerability Management Program
Vulnerability Management Program
Dennis Chaupis
 
Implementing Vulnerability Management
Implementing Vulnerability Management Implementing Vulnerability Management
Implementing Vulnerability Management
Argyle Executive Forum
 
Planning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management ProgramPlanning and Deploying an Effective Vulnerability Management Program
Planning and Deploying an Effective Vulnerability Management Program
Sasha Nunke
 
Vulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize RiskVulnerability Management: What You Need to Know to Prioritize Risk
Vulnerability Management: What You Need to Know to Prioritize Risk
AlienVault
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
asherad
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
Patch and Vulnerability Management
Patch and Vulnerability ManagementPatch and Vulnerability Management
Patch and Vulnerability Management
Marcelo Martins
 
USPS CISO Academy - Vulnerability Management
USPS CISO Academy - Vulnerability ManagementUSPS CISO Academy - Vulnerability Management
USPS CISO Academy - Vulnerability Management
Jim Piechocki
 
Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Management
n|u - The Open Security Community
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
NIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewNIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewTandhy Simanjuntak
 
Introduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security FrameworkIntroduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security Framework
PECB
 
Application Security
Application SecurityApplication Security
Application Security
Reggie Niccolo Santos
 
Patch Management Best Practices 2019
Patch Management Best Practices 2019Patch Management Best Practices 2019
Patch Management Best Practices 2019
Ivanti
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program
BeyondTrust
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
Rishi Kant
 
SOC Cyber Security
SOC Cyber SecuritySOC Cyber Security
SOC Cyber Security
Steppa Cyber Security
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect Match
McKonly & Asbury, LLP
 
SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
Priyanka Aash
 
Cybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your OrganizationCybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your Organization
McKonly & Asbury, LLP
 
Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0
Network Intelligence India
 
Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
Denim Group
 
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Net at Work
 

More Related Content

What's hot

Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Management
n|u - The Open Security Community
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
NIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewNIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewTandhy Simanjuntak
 
Introduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security FrameworkIntroduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security Framework
PECB
 
Application Security
Application SecurityApplication Security
Application Security
Reggie Niccolo Santos
 
Patch Management Best Practices 2019
Patch Management Best Practices 2019Patch Management Best Practices 2019
Patch Management Best Practices 2019
Ivanti
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program
BeyondTrust
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
Rishi Kant
 
SOC Cyber Security
SOC Cyber SecuritySOC Cyber Security
SOC Cyber Security
Steppa Cyber Security
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect Match
McKonly & Asbury, LLP
 
SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
Priyanka Aash
 
Cybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your OrganizationCybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your Organization
McKonly & Asbury, LLP
 
Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0
Network Intelligence India
 

What's hot (20)

Vulnerability and Patch Management
Vulnerability and Patch ManagementVulnerability and Patch Management
Vulnerability and Patch Management
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
 
NIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An OverviewNIST CyberSecurity Framework: An Overview
NIST CyberSecurity Framework: An Overview
 
Introduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security FrameworkIntroduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security Framework
 
Application Security
Application SecurityApplication Security
Application Security
 
Patch Management Best Practices 2019
Patch Management Best Practices 2019Patch Management Best Practices 2019
Patch Management Best Practices 2019
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
 
SOC Cyber Security
SOC Cyber SecuritySOC Cyber Security
SOC Cyber Security
 
7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
Cybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect MatchCybersecurity Frameworks and You: The Perfect Match
Cybersecurity Frameworks and You: The Perfect Match
 
SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
 
Cybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your OrganizationCybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your Organization
 
Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0Vapt pci dss methodology ppt v1.0
Vapt pci dss methodology ppt v1.0
 

Similar to Enterprise Vulnerability Management: Back to Basics

Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
Denim Group
 
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Net at Work
 
[EMC] Source Code Protection
[EMC] Source Code Protection[EMC] Source Code Protection
[EMC] Source Code ProtectionPerforce
 
State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019
Stefan Streichsbier
 
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldVulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
Denim Group
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metrics
centralohioissa
 
Information Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security MetricsInformation Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security Metrics
Jack Nichelson
 
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsEmbracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
Tom Cappetta
 
SLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshopSLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshop
SLVA Information Security
 
API Training 10 Nov 2014
API Training 10 Nov 2014API Training 10 Nov 2014
API Training 10 Nov 2014
Digital Bond
 
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the businessCisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Canada
 
Inside SecOps at bet365
Inside SecOps at bet365 Inside SecOps at bet365
Inside SecOps at bet365
Splunk
 
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider DisciplineTroubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
Sagi Brody
 
State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019
Stefan Streichsbier
 
The State of DevSecOps
The State of DevSecOpsThe State of DevSecOps
The State of DevSecOps
DevOps Indonesia
 
State of DevSecOps - GTACS 2019
State of DevSecOps - GTACS 2019State of DevSecOps - GTACS 2019
State of DevSecOps - GTACS 2019
Stefan Streichsbier
 
Application Assessment Techniques
Application Assessment TechniquesApplication Assessment Techniques
Application Assessment Techniques
Denim Group
 
Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?
Skybox Security
 
Outpost24 webinar: Turning DevOps and security into DevSecOps
Outpost24 webinar: Turning DevOps and security into DevSecOpsOutpost24 webinar: Turning DevOps and security into DevSecOps
Outpost24 webinar: Turning DevOps and security into DevSecOps
Outpost24
 

Similar to Enterprise Vulnerability Management: Back to Basics (20)

Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007Web Application Remediation - OWASP San Antonio March 2007
Web Application Remediation - OWASP San Antonio March 2007
 
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
Information Security Risks - What You Can Do To Help Your Clients Avoid Costl...
 
[EMC] Source Code Protection
[EMC] Source Code Protection[EMC] Source Code Protection
[EMC] Source Code Protection
 
State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019State of DevSecOps - DevSecOpsDays 2019
State of DevSecOps - DevSecOpsDays 2019
 
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldVulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metrics
 
Information Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security MetricsInformation Security Metrics - Practical Security Metrics
Information Security Metrics - Practical Security Metrics
 
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsEmbracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
 
SLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshopSLVA - Security monitoring and reporting itweb workshop
SLVA - Security monitoring and reporting itweb workshop
 
API Training 10 Nov 2014
API Training 10 Nov 2014API Training 10 Nov 2014
API Training 10 Nov 2014
 
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the businessCisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
Cisco Connect Vancouver 2017 - Embedding IR into the DNA of the business
 
Inside SecOps at bet365
Inside SecOps at bet365 Inside SecOps at bet365
Inside SecOps at bet365
 
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider DisciplineTroubleshooting: A High-Value Asset For The Service-Provider Discipline
Troubleshooting: A High-Value Asset For The Service-Provider Discipline
 
State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019State of DevSecOps - DevOpsDays Jakarta 2019
State of DevSecOps - DevOpsDays Jakarta 2019
 
The State of DevSecOps
The State of DevSecOpsThe State of DevSecOps
The State of DevSecOps
 
State of DevSecOps - GTACS 2019
State of DevSecOps - GTACS 2019State of DevSecOps - GTACS 2019
State of DevSecOps - GTACS 2019
 
Secure Iowa Oct 2016
Secure Iowa Oct 2016Secure Iowa Oct 2016
Secure Iowa Oct 2016
 
Application Assessment Techniques
Application Assessment TechniquesApplication Assessment Techniques
Application Assessment Techniques
 
Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?Is Your Vulnerability Management Program Irrelevant?
Is Your Vulnerability Management Program Irrelevant?
 
Outpost24 webinar: Turning DevOps and security into DevSecOps
Outpost24 webinar: Turning DevOps and security into DevSecOpsOutpost24 webinar: Turning DevOps and security into DevSecOps
Outpost24 webinar: Turning DevOps and security into DevSecOps
 

Recently uploaded

The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
BookNet Canada
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Ramesh Iyer
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)
Ralf Eggert
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
ODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User GroupODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User Group
CatarinaPereira64715
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 

Recently uploaded (20)

The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
ODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User GroupODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User Group
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 

Enterprise Vulnerability Management: Back to Basics

  • 1. Enterprise Vulnerability Management BSIDES AUSTIN - April 2016 Damon Small & Kevin Dunn - NCC Group
  • 2. Agenda Welcome & Introductions 03 Session Overview 07 Session Definitions 08 Vulnerability Management 101 09 VulnerabilityAssessment Scans 10 Failing & Pitfalls 21 VMP: Making a Real Difference 22 Session Close 31 2
  • 3. 3 Welcome & Introductions NCC Group – A Global Security Firm • Formed in June 1999 showing immense growth over the past 16 years. • 1800 employees, in 30 office locations • North America, the United Kingdom, Europe and Australia. • We strive to provide Total Information Assurance for our clients. NCC Group in North America • Currently 8 offices in the NA: New York, Atlanta, Chicago, Austin, Seattle, San Francisco, Sunnyvale and Waterloo. • NCC Group combines the best of bread US security brands of iSEC Partners, Matasano, Intrepidus Group and NGS.
  • 4. 4 Welcome & Introductions NCC Group – Security Consulting • Attack & Penetration Focus • Applications • Mobile • Networks & Infrastructure • Physical Security • Embedded Systems • Red Teaming • Incident Response & Forensics • Enterprise Risk / VA Strategy
  • 5. 5 Welcome & Introductions Your Speakers – DAMON SMALL, Technical PM for NCC Group in NA • In IT since 1995; InfoSec since 2001 • Louisiana native: “Not from Texas but I got here as fast as I could!” • Studied music at LSU; grad school in 2005 for Information Assurance • Supported healthcare orgs. in the Texas Medical Center • Vulnerability Management Programs: o Two for Health Care orgs. o One for Oil & Gas o Workflow Analysis & Development o Scanner Platform Deployments
  • 6. 6 Welcome & Introductions Your Speakers – KEVIN DUNN, Technical VP for NCC Group in NA • Technical VP for NCC Group, based in Austin TX. • 14 year career focused on Attack & Penetration techniques & defenses • Prior to that security focused government/military background • Responsible for: o Regional Development & Management o Development of Strategic Technical Practices: § Strategic Infrastructure Security (SIS) § NA Computer Incident Response Team (NA-CIRT) • Specialist in Red Team / Black Ops engagements o (Forms of extreme penetration testing and attack modeling)
  • 7. 7 Session Overview Blue Team is Harder than Red Team! • You’re in charge of VM for your company • You have scanning sensors deployed • You have hardening plans in place • You have remediation strategies and goals • A pentest is commissioned from an outside firm • They prove traversal from the outside to the inside • They become Domain Admin on your network • They access your most critical data and systems.
  • 8. 8 Session Definitions • Vulnerability Assessment: The act of gathering information regarding vulnerabilities on specific hosts, often using scanning tools. (Does include penetration testing). • Vulnerability Management: A business process that includes the following key components: o Identification o Classification o Decision/Decision Record o Mitigation
  • 9. 9 Vulnerability Management 101 • A business process that includes: 1. Identifying Vulnerabilities (VA) 2. Promotes Patching / Hardening / Fix of Issues 3. Decision process regarding remediation activities: a. Fix it, accept it, or transfer the risk. b. Creates an auditable decision record, process for validation, and a process to periodically review “no action” remediation where risk is accepted. c. Decision process should be multi-disciplinary and represent all stakeholders (IT, business, InfoSec, etc.)
  • 10. 10 Vulnerability Assessment Scans Scanning - What is it Good For? • Identifying Vulnerabilities • Remediation Information • Software Inventory • Asset Management Scanning - What is it Not Good For? • Identifying Vulnerabilities • Going Beyond Patching • Workflow/Business Processes
  • 11. 11 Electrons/Photons going though wire/fiber What is being examined What tool can be used 1. Physical 2. Datalink 3. Network 4. Transport 5. Session 6. Presentation 7. Application MediaLayersHostLayers OSI Model The Right Tool for the Right Job
  • 12. 12 Patching vs. Hardening • Patching - Applying a software fix, update or upgrade. This is a code-level change, packaged typically as a binary. It usually comes from the software manufacturer / development team. • Hardening - Changing configuration settings to increase the security of something based on an understanding of which settings are ‘more secure’. Typically defined via some kind of ‘best practices document’. Hardening advice may come from a number of sources.
  • 13. 13 Over-Focus on Scanning / Patching Depth of System Hardening is Typically Shallow • Consider the following issues found on most Pentests! o MSSQL Weak SA Password o Tomcat Manager Weak Password o Jenkins Groovy Script Command Execution o Printer Default Credentials
  • 14. 14 Over-Focus on Scanning / Patching MSSQL Weak SA Password • A few simple steps to full control of server!
  • 15. 15 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
  • 16. 16 Over-Focus on Scanning / Patching Tomcat Manager Weak Password
  • 17. 17 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • Jenkins Integration Manager (source code build env.)
  • 18. 18 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • When poorly configured visiting /script gets you to a ‘Script Console’
  • 19. 19 Over-Focus on Scanning / Patching Jenkins Groovy Script Command Execution • That’s OS command execution! You never know how many privs you have!
  • 20. 20 Over-Focus on Scanning / Patching Printer Default Credentials • Printers can be useful!
  • 21. 21 Failings & Pitfalls Common VMP Problems • Over-prioritization of Scanning - no workflow development • Scan All the Things - but do nothing with the results… • Generate False Positives - and lose credibility* • No Consideration for Network & Business Impact* • No Security Team & Support Org. Relationship • Mistaking VA (alone) as a DefensiveActivity
  • 22. 22 VMP: Making a Real Difference HIGHEST PRIORITIES • Asset Inventory Management • Decision & Remediation Workflows • Visualization & Metrics LOWER PRIORITIES • VulnerabilityAssessment Scanning • Penetration Testing • Buying Cool Toys
  • 24. 24 VMP Process Overview Visualizing VMP Workflows • VMP workflows can be difficult to visualize without prior exposure! • Workflows and process will vary between organizations • For the purposes of this discussion we’ve created an example • Most of our workflows can scale up or down to your requirements • Bring on the HUGE diagram!
  • 25. 25
  • 26. 26 NIST Cybersecurity Framework • VMP allows you to IDENTIFY your assets. • VMP allows you to PROTECT via remediation. • VMP allows you to DETECT vulnerabilities. • VMP helps with effective RESPONSE. • VMP communication workflows help RECOVERY.
  • 27. 27 Considerations Analysis Methods & Opportunities for Improvement • Macro vs Micro Analysis o Vulnerabilities by Host o Hosts by Vulnerability • Minimizing False Positives o Confirmation of Issues from VMP Team § How? o Prior to Escalation to Support Org. o Maintain Credibility
  • 28. 28 VMP Design Checklist (1) Before You Purchase a Scanning Solution… • Do you know your environment? o Enterprise Planning o Asset Discovery • Do you know your stakeholders? o Business Units / Owners o Support Org. Teams • How will the data be consumed? o Consumers o Storage & Transmission o Format & Control
  • 29. 29 VMP Design Checklist (2) Before You Purchase a Scanning Solution… • How will we fit in with existing support workflows? o Scheduling / Change Control o Ticketing (Defect) o Hands on Keyboard o Outage Resolution • What skills or capabilities does our VMP team have? o VulnerabilityAssessment - Hands-on Experience o VulnerabilityAnalysis - Results Interpretation • How will we measure VMP success or failure? o Metrics / Feedback / Process Improvement
  • 30. 30 Okay! Now you can have lunch with a scanner sales person! J
  • 31. 31 Session Close • Scanners have been around for 20 years and yet we still don’t know how to use them, consume their data properly, or fix the things they find to satisfaction. Call to Action • Orgs - If you think the number and types of scans you do is the critical success factor, you are doing it wrong. • Be sure to consider your VMP design and workflows FIRST. • Scanner Vendors - Flinging packets is easy. Workflow integration, data aggregation, ticketing and tracking is much harder than it should be. Please help!
  • 32. 32 Ways to Stay in Touch Kevin Dunn Technical VP – NCC Group, Security Consulting E: kevin.dunn@nccgroup.trust L: https://www.linkedin.com/in/kevdunn T: @kdunn_ncc Damon Small Technical PM - NCC Group, Security Consulting E: damon.small@nccgroup.trust L: https://www.linkedin.com/in/damon-small-7400501 T: @damonsmall

Editor's Notes

  1. The purpose of this slide is to illustrate how certain tools are used to gather specific types of information. Regardless of whether you are discussing scanning or manual app testing, one clear message is that you must have humans involved. Manual app testing will always be more sophisticated than scanners alone, but even with VA scanners, you must have humans analyzing the results and configuring the scans to ensure they network is not taken down. Interest from someone who controlled ICS networks and wanted to give a scanner to a low-end IT employee to scan. This is a bad idea and can wreak havoc if you are not careful. You also need a skilled security pro to analyze the results. (Story about httpd vulns found. Server ops claimed that they must be false positives because these were not web servers. The vuln actually came from the HP SMS server which includes Apache server. Previous analysts failed to recognize this because the results were not vetted by an experienced security pro.) Sampling of tools vs the OSI model. Doesn’t represent well unless you have a defined lexicon. At a particular client site, “Application,” “application,” and “software” meant different things to different people.