Scribd Logo
Upload

Welcome to Scribd!

  • 204 views

    Vulnerability Assessment Best Practices

    Uploaded by

    dehnhaide
    This document outlines best practices for conducting vulnerability assessments. It begins with definitions of key terms like vulnerability, threat, and control. It then discusses the basics of vulnerability assessments and why they are important for risk assessment, compliance, and justifying security spending. The document provides details on the CERT methodology, which is a 5 step process of setup, test execution, vulnerability analysis, reporting, and remediation. It emphasizes thorough documentation, prioritizing vulnerabilities by risk, and verifying results to produce accurate and meaningful reports. The goal is to identify issues and track remediation progress over time.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd

    Vulnerability Assessment Best Practices

    Uploaded by

    dehnhaide
    204 views25 pages
    This document outlines best practices for conducting vulnerability assessments. It begins with definitions of key terms like vulnerability, threat, and control. It then discusses the basics of vulnerability assessments and why they are important for risk assessment, compliance, and justifying security spending. The document provides details on the CERT methodology, which is a 5 step process of setup, test execution, vulnerability analysis, reporting, and remediation. It emphasizes thorough documentation, prioritizing vulnerabilities by risk, and verifying results to produce accurate and meaningful reports. The goal is to identify issues and track remediation progress over time.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document outlines best practices for conducting vulnerability assessments. It begins with definitions of key terms like vulnerability, threat, and control. It then discusses the basics of vulnerability assessments and why they are important for risk assessment, compliance, and justifying security spending. The document provides details on the CERT methodology, which is a 5 step process of setup, test execution, vulnerability analysis, reporting, and remediation. It emphasizes thorough documentation, prioritizing vulnerabilities by risk, and verifying results to produce accurate and meaningful reports. The goal is to identify issues and track remediation progress over time.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    204 views25 pages

    Vulnerability Assessment Best Practices

    Uploaded by

    dehnhaide
    This document outlines best practices for conducting vulnerability assessments. It begins with definitions of key terms like vulnerability, threat, and control. It then discusses the basics of vulnerability assessments and why they are important for risk assessment, compliance, and justifying security spending. The document provides details on the CERT methodology, which is a 5 step process of setup, test execution, vulnerability analysis, reporting, and remediation. It emphasizes thorough documentation, prioritizing vulnerabilities by risk, and verifying results to produce accurate and meaningful reports. The goal is to identify issues and track remediation progress over time.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 25

    Best Practices for Vulnerability Assessments

    Presented by: Nathan Heck, IT Security & Privacy Analyst

    A Quick Vocabulary Lesson


    Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that may result in a security breach or a violation of the system's security policy. Threat: The potential for a specific vulnerability to be exercised either intentionally or accidentally Control: measures taken to prevent, detect, minimize, or eliminate risk to protect the Integrity, Confidentiality, and Availability of information. Vulnerability Assessment: The process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system.
    2

    Vulnerability Assessment Basics


    Vulnerability Assessment is a subset of Vulnerability Management Proactive vs. reactive Vulnerability assessment vs. penetration testing Examples of IT vulnerability assessments

    Why Do Vulnerability Assessments?


    System accreditation Risk assessment Network auditing Provide direction for security controls Can help justify resource expenditure Can provide greater insight into process and architecture Compliance checking Continuous monitoring

    Vulnerabilities
    Where do they come from?
    Flaws in software Faulty configuration Weak passwords Human error
    Inappropriately assigned permission levels System inappropriately placed in infrastructure/environment

    Vulnerabilities dont go away by themselves


    5

    Best Practices
    Establish chain of command/authority Create official purpose and procedures Decide on schedule

    Build your reputation


    Build relationships

    Best Practices
    Think in terms of risk Document everything! Know your environment Be prepared

    CERT Methodology
    1) Setup 2) Test Execution 3) Vulnerability Analysis

    4) Reporting
    5) Remediation Repeat!
    8

    Step 1: Setup
    Begin documentation Secure permission Update tools

    Configure tools

    Step 2: Test Execution


    Run the tools Document as you go Run a packet capture while running the assessment tools

    10

    Step 3: Vulnerability Analysis


    Human interpretation is required to make results meaningful That interpretation includes
    Assessing risk presented by vulnerabilities Comparing the results to security policy Verifying vulnerabilities Prioritizing vulnerabilities

    11

    Step 3: Vulnerability Analysis


    Assessing risk and prioritizing vulnerabilities
    A subjective process but you can be objective by using CVSS

    Common Vulnerability Scoring System (CVSS)


    NIST provides a CVSS calculator at http://nvd.nist.gov/cvss.cfm?calculator By adjusting the different values based on the characteristics of the vulnerability, the CVSS score will go either up or down depending on the risk presented to your specific environment

    12

    Step 3: Vulnerability Analysis


    Researching vulnerabilities
    The Common Vulnerabilities and Exposures (CVE) numbers
    http://cve.mitre.org
    Some tools will provide with the CVE CVE numbers can be used to look up additional vulnerability information from trusted sources
    US-CERT Vulnerability Notes Database: http://www.kb.cert.org/vuls/ National Vulnerability Database: http://nvd.nist.gov Secunia.com Vendor Sites
    13

    Step 3: Vulnerability Analysis


    Researching vulnerabilities
    Without a CVE number
    Google
    Security Sites Security email list archives http://seclists.org

    Be careful who you get information from/trust


    Best to go to a known good security site (e.g. sans.org)

    CERIAS Cassandra service - https://cassandra.cerias.purdue.edu Verify with a trusted source or multiple sources if possible
    14

    Step 3: Vulnerability Analysis


    Causes of errors during vulnerability analysis
    Environmental Issues Timing Issues Privilege Issues Tool Issues People/knowledge Issue

    15

    Step 3: Vulnerability Analysis


    Error types
    False Positive - Identifying a vulnerability that is not present

    False Negative - Failing to identify the presence of a vulnerability

    Error prevention
    Use several different tools for verification Examine the traffic generate by tools Consult with the system owner/administrator

    16

    Step 4: Reporting
    Goals
    Present a meaningful summary of the vulnerabilities found Prioritize and explain vulnerabilities Provide possible remediation suggestions

    17

    Step 4: Reporting
    Anatomy of a report
    Header Summary List of vulnerabilities - For each vulnerability, at a minimum provide:
    Unique tracking number Risk level
    High - Immediate action Medium - Action required Low - Action recommended

    Brief description

    Appendices - At a minimum the following two should be included


    Vulnerability details Assessment Setup

    18

    Step 4: Reporting
    Metrics
    Tracking progress of key metrics over time allows progress to be quantified Also a good idea to tie metrics to cost savings Examples:
    Number of vulnerabilities found by criticality Average number of vulnerabilities found Number of vulnerabilities remediated Time from vulnerability discovery to remediation Time per assessment Total assessments done

    19

    Step 4: Reporting
    Best Practices
    Standardization

    Know your audience


    Avoid fluff

    Prioritize by risk
    Track progress

    20

    Step 5: Remediation
    Vulnerability remediation is the process of fixing vulnerabilities Pick the issues you want to fix because you may not have enough resources to fix them all Remediation choices
    For every vulnerability there are three choices for remediation:
    Fix - eliminate vulnerability altogether Accept - the cost of fixing outweighs the risk Mitigate - don't outright fix but use additional layers of security to lessen the risk presented by the vulnerability
    21

    Step 5: Remediation
    Types of remediation
    Manual
    Pros - less likely to cause system problems Cons - does not scale well, time consuming

    Automatic remediation
    Pros - scales very well Cons - may cause system problems, may not actually remediate, potential for breaking something is greater

    Manual - unique or critical system

    Automatic - many similar items

    22

    Step 5: Remediation
    Remediation Planning
    Plan for remediating all vulnerabilities found in the system

    Plan should include:


    Whether to fix, mitigate or accept vulnerabilities Whether to use automatic or manual remediation Strategy to mitigate any remaining vulnerabilities Justification for accepting any vulnerability

    23

    Step 5: Remediation
    Test remediation on a dev instance before implementing on a production system

    Verification
    Cooperation required for successful remediation Dont forget change management

    24

    Best Practices for Vulnerability Assessments

    Questions?

    Presented by: Nathan Heck, IT Security & Privacy Analyst

    25

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy