The document summarizes Kevin Dunn's presentation on improving vulnerability management programs. It discusses common gaps that allow penetration tests to succeed, such as things an organization does not know about, has forgotten, or has de-prioritized. It provides recommendations to address these gaps, such as improving inventory discovery and prioritizing the security of all networked devices. Finally, it suggests moving beyond compliance-based approaches to innovating security design based on the assumption that attackers have compromised the network. The goal is to contain breaches and make attacks more difficult.

1. @NTXISSA #NTXISSACSC3
HELP! My Vulnerability
Management Program is Failing!
Kevin Dunn
Technical VP
NCC Group
02 October 2015

2. @NTXISSA #NTXISSACSC3
Session Overview
• Welcome & Introductions
• Scenario – Your Day is Ruined
• Vulnerability Management Programs
• Penetration Testing Mechanics
• VM Program Gaps & Failings
• VM Program Easy Wins
• Design Improvements to Enterprise Sec.
NTX ISSA Cyber Security Conference – October 2-3, 2015 2

3. @NTXISSA #NTXISSACSC3
Welcome & Introductions
NCC Group – A Global Security Firm
• Formed in June 1999 with immense growth over 16 years.
• 1200 employees, in 24 office locations
• North America, the United Kingdom, Europe and Australia.
• We strive to provide Total Information Assurance
NCC Group in North America
• Currently 7 offices in the US: New York, Atlanta, Chicago, Austin,
Seattle, San Francisco and Sunnyvale.
• NCC Group combines the best of bread US security brands of iSEC
Partners, Matasano, Intrepidus Group and NGS.
NTX ISSA Cyber Security Conference – October 2-3, 2015 3

4. @NTXISSA #NTXISSACSC3
Welcome & Introductions
NCC Group – Security Consulting
• Attack & Penetration Focus
• Applications
• Mobile
• Networks & Infrastructure
• Physical Security
• Embedded Systems
• Red Teaming
• Incident Response & Forensics
NTX ISSA Cyber Security Conference – October 2-3, 2015 4

5. @NTXISSA #NTXISSACSC3
Welcome & Introductions
Your Speaker – Kevin Dunn
• Technical VP for NCC Group, based in Austin TX.
• 15 year career: Attack & Penetration / Security Remediation
• Development of NCC technical practices:
o Strategic Infrastructure Security (SIS)
o NA Computer Incident Response Team (NA-CIRT)
• Specialist in Red Team / Black Ops engagements
o Forms of extreme penetration testing and attack modeling
NTX ISSA Cyber Security Conference – October 2-3, 2015 5

6. @NTXISSA #NTXISSACSC3
Scenario – Your Day is Ruined
• You’re in charge of VM for your company
• You have scanning sensors deployed
• You have hardening plans in place
• You have remediation strategies and goals
• A pentest is commissioned from an outside firm
• They prove traversal from the outside to the inside
• They become Domain Admin on your network
• They access your most critical data and systems.
NTX ISSA Cyber Security Conference – October 2-3, 2015 6

7. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Inventory Discovery & Management
• Vulnerability Discovery
• Vulnerability Risk Classification
• Vulnerability Remediation
• Specific Threat Response
• Continual Lifecycle Process
NTX ISSA Cyber Security Conference – October 2-3, 2015 7

8. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Inventory Discovery & Management
o You can’t secure what you don’t know about
o Manual, semi-automated and automated discovery
o Find servers, the services they provide, and their
general purpose within the org.
NTX ISSA Cyber Security Conference – October 2-3, 2015 8

9. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Vulnerability Discovery
o Operating systems and platform software suffer
from flaws and security problems.
o Some are fixed with patches, some are fixed with
configuration.
o Finding these problems is key.
NTX ISSA Cyber Security Conference – October 2-3, 2015 9

10. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Vulnerability Risk Classification
o How you classify your vulns.
o Likely relates to how you prioritize fixes
o Classifying security impact is easy
o Classifying business risk is harder
o Do you include business risk?
o Do you ignore business risk?
NTX ISSA Cyber Security Conference – October 2-3, 2015 10

11. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Vulnerability Remediation
o So you’ve got vulns? Now what?!
o You have to fix them
o Generally a large work effort
o How do you prioritize?
o Are you on an annual cycle?
o If so, you need a smaller cycle
NTX ISSA Cyber Security Conference – October 2-3, 2015 11

12. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Specific Threat Response
o Argh! One of those pesky ‘named bugs’ shows up
o Your management wants to know:
 Are we vulnerable?
 How many servers?
 What are we doing to fix it?
o VM programs should support this
NTX ISSA Cyber Security Conference – October 2-3, 2015 12

13. @NTXISSA #NTXISSACSC3
Vulnerability Management Programs
• Continual Lifecycle Process
o It never stops, and it never should
o A program like this is needed to gain a reasonable
baseline of security in your org.
o Do you have one?
o You need one!
o But there is so much more…
NTX ISSA Cyber Security Conference – October 2-3, 2015 13

14. @NTXISSA #NTXISSACSC3
Penetration Testing Mechanics
• At NCC we carry out a lot of Pentests
• Some have external focus, some internal
• Most of them have both
• We have a very high success rate
• Even against firms that have a
Vulnerability Management Program
NTX ISSA Cyber Security Conference – October 2-3, 2015 14

15. @NTXISSA #NTXISSACSC3
Penetration Testing Mechanics
• Penetration Testing
o Goal driven – not breadth
o Look for the path of least resistance
o Capitalize on the things you have:
 De-prioritized
 Forgotten
 Don’t know about
 Can’t control
o I.e. we cheat to win, because the attackers will too!
NTX ISSA Cyber Security Conference – October 2-3, 2015 15

16. @NTXISSA #NTXISSACSC3
Penetration Testing Mechanics
• Typical External pentest results.
o We find fewer missing patches than we used to
o Very little RCE on server OS or platforms
o We still find application vulns. like SQLi
o We find a lot of information disclosure
o We use info. disclosure to target users
o We use targeted spear phishing
o Spear phishing gives us shells or creds
o We either hit the cloud with creds
o Or pivot with shells.
NTX ISSA Cyber Security Conference – October 2-3, 2015 16

17. @NTXISSA #NTXISSACSC3
Penetration Testing Mechanics
• Typical Internal pentest results.
o We find fewer missing OS patches
o We find printers harboring domain creds
o We get into the SharePoint repo
o We find lots of poorly configured systems
o We find default or easy to guess passwords
o We pillage open NFS and SMB
o We find hard coded creds, keys, certs etc.
o We gain SYSTEM on member servers / root
o We steal domain admin tokens
NTX ISSA Cyber Security Conference – October 2-3, 2015 17

18. @NTXISSA #NTXISSACSC3
Penetration Testing Mechanics
NTX ISSA Cyber Security Conference – October 2-3, 2015 18
A. Find external entry vulnerabilities
2. Gain privileges of Local SYSTEM on Domain Member Servers
3. Traverse to different servers looking for powerful tokens & hashes
4. Steal tokens and hashes for powerful domain users & administrators
B. Find internal entry vulnerabilities
1. Gain any domain credentials to facilitate intel gathering on the network
5. Use domain admin against Business

19. @NTXISSA #NTXISSACSC3
Penetration Testing Mechanics
• Our penetration tests are almost always
successful at gaining access and gaining
privileges…
• Why does this happen?
• Does the VM program help at all?
• What else do you need to do?
NTX ISSA Cyber Security Conference – October 2-3, 2015 19

20. @NTXISSA #NTXISSACSC3
VM Program Gaps & Failings
• Pentests are good at exploiting:
o Things you don’t know about
o Things you have forgotten
o Things you are ignorant to
o Things you have de-prioritized
o Things you can’t control
NTX ISSA Cyber Security Conference – October 2-3, 2015 20

21. @NTXISSA #NTXISSACSC3
VM Program Gaps & Failings
• Things you don’t know about:
o Hosts that have been deployed
o Services that exist via product installs
o Unauthorized / unknown external gateways
o Wireless networks connected to corp.
o Infrastructure from acquisition of businesses
o General shadow IT shenanigans
NTX ISSA Cyber Security Conference – October 2-3, 2015 21

22. @NTXISSA #NTXISSACSC3
VM Program Easy Win [1]
• Things you don’t know about:
o Search for these
o Use your VMP as asset discovery
o Scan all your IP space
o Investigate all wireless in the vicinity
o Build an inventory – keep it up-to-date
o Design process around asset ownership
NTX ISSA Cyber Security Conference – October 2-3, 2015 22

23. @NTXISSA #NTXISSACSC3
VM Program Gaps & Failings
• Things you have forgotten:
o Good hardening in most areas, but…
o Some vendor default passwords sneak through
o Some Tomcat consoles are still there (etc.)
o Development servers with weaknesses
o Legacy things you no longer use
o Special configurations for special projects
o Ex-employees / exit processing
NTX ISSA Cyber Security Conference – October 2-3, 2015 23

24. @NTXISSA #NTXISSACSC3
VM Program Easy Win [2]
• Things you have forgotten:
o Be rigorous
o Search specifically for these things
o Know each and every host and service
o Check each service for default passwords
o Look in every shared file location
o Question whether hosts should ‘still be there’
o Correlate users to employment records
NTX ISSA Cyber Security Conference – October 2-3, 2015 24

25. @NTXISSA #NTXISSACSC3
VM Program Gaps & Failings
• Things you are ignorant to:
o Setting an org-wide default password (onboarding)
o Having a shared local admin / root password
o Allowing users to be admin on their own box
o Having a flat network with no segmentation
o Printers can be your downfall
o Use of single-factor authentication is a single point
of failure (wireless, VPN, cloud, domain)
NTX ISSA Cyber Security Conference – October 2-3, 2015 25

26. @NTXISSA #NTXISSACSC3
VM Program Easy Win [3]
• Things you are ignorant to:
o Listen to your Pentesters
o Learn about weaknesses
o Figure out what everyone else is doing
o Do at least that – then do more
o Some things will be hard(er)
NTX ISSA Cyber Security Conference – October 2-3, 2015 26

27. @NTXISSA #NTXISSACSC3
VM Program Gaps & Failings
• Things you have de-prioritized:
o VMP is geared only to ‘critical production’ assets
o Lower priority servers are not yet included
o “Ah that system is going away soon(ish)”
o “Admins are admin on their own build, because
they are admins!”
NTX ISSA Cyber Security Conference – October 2-3, 2015 27

28. @NTXISSA #NTXISSACSC3
VM Program Easy Win [4]
• Things you have de-prioritized:
o Prioritization is of course important
o But recognize that if an asset is:
 Domain joined
o It’s security is as important as ‘prod’
o From an attacker’s perspective it doesn’t matter
o De-prioritized systems are ways in
o Exceptions to rules / process are ways in
NTX ISSA Cyber Security Conference – October 2-3, 2015 28

29. @NTXISSA #NTXISSACSC3
VM Program Gaps & Failings
• Things you can’t control:
o Your users
o (Mic drop)
NTX ISSA Cyber Security Conference – October 2-3, 2015 29

30. @NTXISSA #NTXISSACSC3
VM Program Easy Win [5]
• Things you can’t control:
o There aren’t many easy wins for users
o Remove their privileges
o Educate them (but recognize limits)
o Be more direct – show them consequences
o Think about designing solutions that:
 Protect the org. from user actions
NTX ISSA Cyber Security Conference – October 2-3, 2015 30

31. @NTXISSA #NTXISSACSC3
Design Improvements to Ent. Sec
• Securing an enterprise network is hard
• You will fail to secure it 100%
• Pentests exploit:
o Size / Complexity
o Human Error
o Your 1%
• Embrace this problem and innovate
through security design.
NTX ISSA Cyber Security Conference – October 2-3, 2015 31

32. @NTXISSA #NTXISSACSC3
Design Improvements to Ent. Sec
1. Threat Model for Failure
2. Innovate from Failure Planning
3. Enhance Your VMP via Sec. Engineering
NTX ISSA Cyber Security Conference – October 2-3, 2015 32

33. @NTXISSA #NTXISSACSC3
Design Improvements to Ent. Sec
Threat Model for Failure
Assume the worst, in-fact start there
1. Attackers are on your network (right now)
2. The attackers have control of your AD as DA
If 1 + 2 = true, how do you:
• Stop the attacks from getting your highest value data?
Hopefully you are thinking:
• “Store critical data away from the AD domain”
NTX ISSA Cyber Security Conference – October 2-3, 2015 33

34. @NTXISSA #NTXISSACSC3
Design Improvements to Ent. Sec
Innovate from Failure Planning
• You don’t have to do ‘just the same as everyone else’
NTX ISSA Cyber Security Conference – October 2-3, 2015 34
Don’t trust the domain for auth-N? Use token based MFA
Physical office LAN compromise? Create an ‘empty network’
Your users can get phished? Separate job ops from email
Attackers are on your network? Funnel them into safe areas
Waste their time
Make things noisy
Detect and contain!

35. @NTXISSA #NTXISSACSC3
Design Improvements to Ent. Sec
Enhance Your VMP via Sec. Engineering
• Pentests often uncover systemic issues
• But remediation isn’t tackled that way
• Most require ‘fortification projects’
• These are bigger and take time
• But they get you where you need to go
NTX ISSA Cyber Security Conference – October 2-3, 2015 35

36. @NTXISSA #NTXISSACSC3
Design Improvements to Ent. Sec
Final Thoughts
• It is a winnable war
• Your VMP is a good start
• You need to enhance it
• Listen to your ‘paid attackers’
• Patching & config. is not enough
• Plug those gaps the pentest uncovers
NTX ISSA Cyber Security Conference – October 2-3, 2015 36

37. @NTXISSA #NTXISSACSC3
Thank You – Please Stay In Touch
• Kevin Dunn
• Technical VP – NCC Group
• E: kevin.dunn@nccgroup.trust
• L: https://www.linkedin.com/in/kevdunn
• W: https://www.nccgroup.trust/us
NTX ISSA Cyber Security Conference – October 2-3, 2015 37

38. @NTXISSA #NTXISSACSC3@NTXISSA #NTXISSACSC3
The Collin College Engineering Department
Collin College Student Chapter of the North Texas ISSA
North Texas ISSA (Information Systems Security Association)
NTX ISSA Cyber Security Conference – October 2-3, 2015 38
Thank you