Compaq Security Solutions

Compaq Security Solutions

Vulnerability Assessment

Vulnerability Assessment

Module 7

Objectives

After completing this module, you will be able to:

Explain how vulnerability assessment technology works.

List the criteria you should use to evaluate vulnerability assessment products.

List the considerations for implementing vulnerability assessment.

Explain the role of vulnerability assessment in a security policy and list Compaq's recommendations.

Introduction

Human error is one of the most challenging areas in information risk management. Vulnerabilities created through human error arise unpredictably and can easily be exploited, causing grave harm to an enterprise.

To be considered secure, operating systems must be properly configured. Because of the complexity of the network administration task, it is likely that exploitable errors exist in every network. Risk management accepts that likelihood and demands implementation of a proactive means of managing the resulting risk. Tools are needed to detect improperly configured computers before errors can be identified and exploited by a potentially malicious individual.

When properly configured, Microsoft Windows NT is secure against many forms of attack. Unfortunately, an "out-of-the-box" computer system is not properly configured for use in an operational environment. A system administrator must configure the system before operational use. Periodic system administration is also required.

Even well-trained and experienced system administrators can easily make errors that effectively cancel the security of the system.

Of special concern are those computers directly connected to public networks such as the Internet. Both firewalls and web servers are vulnerable to administrative error because they run as applications on computers controlled by standard operating systems. With firewalls, not only does the operating system have to be properly configured, but also the firewall application itself. As the guardian of the network, a firewall is an exceptionally attractive target to hackers. Therefore, exploitable errors in a firewalls configuration present especially grave risks to the network it protects.

Vulnerability Assessment Technology

Internet

Vulnerability

Assessment

Server

Client

Client

Client

Client

Firewall

It is relatively easy to compile a list of known vulnerabilities associated with a specific operating system. It is possible for a system administrator to manually interrogate an operating system, just as a hacker would, to identify potential vulnerabilities. However, the job is tedious, prone to error, and time consuming.

The security industry has developed automated tools to support identification of potential vulnerabilities. Known as vulnerability assessment tools, these tools interrogate an operating system for known vulnerabilities and provide reporting features.

Automated vulnerability assessment tools interrogate the configuration of computer operating systems based on the network address. Specialized vulnerability assessment tools are also available to assess web server and firewall configuration vulnerabilities. These tools can be configured to automatically assess all or some of the nodes in a network on a daily, weekly, or other basis.

When identified, system configuration errors can be easily corrected. The reports of the tool also provide an excellent means of tracking recurring errors that might point to either poor practices or the need for additional training.

Types of Vulnerability Assessment Technology

The two basic types of vulnerability assessment technology are:

Host resident Vulnerability assessment is performed by an application running on a specific computer and only that computer is assessed.

Network-based Vulnerability assessment is performed by an application running on a server within a local area network (LAN). Designated computers, indicated by the IP address, are assessed on a schedule determined by the administrator.

Evaluating Vulnerability Assessment Tools

Vulnerability assessment products are applications running under the control of the operating system (either Microsoft NT or SCO UNIX). When selecting a vulnerability assessment tool, evaluate the following criteria:

Graphical user interface (GUI) A GUI should be provided for system configuration and reporting.

Ability to repair vulnerabilities A feature should be provided to automatically repair some system vulnerabilities.

Robustness The product should test for the widest possible suite of vulnerabilities. All vulnerabilities associated with common attack scenarios should be contained in the suite.

Reporting The product should provide reporting through the interface and also plain text reporting that can be electronically mailed or printed. Consolidated reporting of vulnerabilities found throughout the network should be supported.

Secure installation The product should be supported with installation and configuration instructions to ensure that the application is securely installed.

Integrity The product should provide an automatic integrity feature to ensure that the application cannot be modified or infected with malicious code.

Ease of update The vulnerability assessment capability should be easily updated. Ideally, software updates should be automatically downloaded. Software updates should not require reconfiguration of the system.

Alert options When a significant vulnerability is detected, the system should be capable of issuing an alert in several ways, including automatic reporting through the GUI, electronic mail, and paging.

Scheduling A scheduling feature should be provided to support the off-hours assessment of specific network nodes.

Operational Considerations

Assessment tools can create a significant network load, particularly if a large number of nodes are being assessed. The tools automatically test all the IP ports, issuing several hundred tests for each node. This level of testing can effectively create a denial-of-service situation. It is important to schedule testing when the node is not otherwise in heavy use. Consider the following:

When is the network and specific node subject to peak usage? Scheduling should avoid periods of peak usage.

Has the node been reconfigured since it was last assessed? One of the primary reasons for vulnerability assessment is to recognize and correct vulnerabilities created through administrative error. If the node has not been administered since the last assessment, there should be no new vulnerabilities.

What is the assessment history? Some network nodes are more efficiently administrated than others, depending on the experience and professionalism of the administrator. It might be determined that some nodes have rarely been found to have vulnerabilities, and testing of those nodes can be minimized.

Role of Vulnerability Assessment in a Security Policy

Compaq recommends the following policies:

Use vulnerability assessment tools to interrogate any new computers operating system before the computer is connected to the network. This is particularly critical for firewalls, web servers, and shared systems.

Interrogate firewalls and web server operating systems for vulnerabilities at least weekly and anytime the configuration is changed.

For essentially stable environments with certified, experienced system administrators or those environments that have not experienced hacker problems, interrogate shared computers on a weekly basis. Because hackers are particularly active on weekends, Friday afternoon is an excellent time to perform this function.

For environments that are highly sensitive, growing rapidly, or known targets for hackers, interrogate all shared computers at the end of each business day.

For extremely sensitive environments, environments with recognized system administration problems, or environments being harassed by hackers, interrogate the entire network daily until the attacks cease or the vulnerability reports are clear for at least a week.

Review Questions

1. Describe the two main types of vulnerability assessment technology.

2. List four criteria to consider when evaluating vulnerability assessment tools.

3. When and how often should vulnerability assessment occur?

4. What components of an enterprise network are most important to check for vulnerabilities?

Rev. 0.117 1

7 8Rev. 0.11

Rev. 0.117 7