Steven Hartman State Information Security Officer State of Nebraska Vulnerability and Threat Management Creating a Vulnerability Assessment Program at the State of Nebraska Steven Hartman State Information Security Officer State of Nebraska

Agenda Introductions Vulnerabilities vs. Threats Components of a Vulnerability Assessment Program Bringing it all together Quiz © November 18, 2008 Nebraska Cyber Security Center. 2008 Nebraska Digital Summit

Vulnerabilities vs. Threats What’s the Difference?

Definitions Vulnerability – Susceptible to attack. (Webster) A vulnerability is a hole or a weakness in the application, which can be a design flaw or an implementation bug, that allows an attacker to cause harm to the stakeholders of an application. Threat – An expression of intention to inflict evil, injury, or damage (Webster) A threat is the possibility of something bad happening (qualitative). Attack - An attack is when a vulnerability is exploited to realize a Threat. © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting .

Definition’s continued Risk - A Risk is the quantifiable likelihood of loss due to a realized Threat (quantitative) Countermeasures - Countermeasures are defensive technologies or modules that are used to detect, deter, or deny attacks Four types of Countermeasures Preventative Reactive Detective Administrative © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

A Word about Threat Modeling Threats are applied to assets If there are no assets, you can not have an attack If the asset has no value you have no Risk Threat modeling really forces you to understand the interactions between the various pieces of your components within your application. © September 21, 2018 Nebraska Cyber Security Center.

Components of a Vulnerability Assessment Program What are they you ask?

Five Main Components Vulnerability Assessments and testing Threat Modeling Remediation Management Incident Response Security Event Monitoring and logging © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

Vulnerability Assessments and Testing The State of Nebraska has purchased a product called Qualys Ability to perform assessments on 2,700 devices 1,700 servers 1,000 network devices Role based web application that allows agencies to only see their servers and assessments. Ability to scan both internally and externally. Can perform PCI Audit scans © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting .

Threat Modeling Look for sources that identify vulnerabilities and threats. US-CERT / MS-ISAC SANS Vendors If you know the enemy and know yourself, you need not fear the results of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle. - Sun Tzu, The Art of War © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

Remediation Management Patch Management SMS WSUS PatchLink Server Hardening Disable all un-necessary ports and services Limit administrative privileges Firewall or other network controls NITC 8-103 Minimum Server Configuration Standard http://www.nitc.state.ne.us/standards/security/Minimum_Server_Configuration_Standard_20070627.pdf © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

Incident Response NITC 8-401 Incident Response and Reporting Standard An Incident Response Program contains Five Components Preparation Analysis Containment Eradication Recovery NITC 8-401 Incident Response and Reporting Standard http://www.nitc.state.ne.us/standards/8-401.html © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

Security Event Monitoring and logging Microsoft Security Computer Operations Manager (SCOM) IDS/IPS Forti-Analyzer Cisco Compliance Manager others… © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

Demo Bringing it all together?

Bringing it all together We know we can not eliminate all vulnerabilities, so we proactively look at lowering our Risk be reducing our ‘Attack Surface’ By running regularly scheduled scans we can start to see trends develop internally that allow us to concentrate on areas showing weakness. Allows us to prioritize the work we do. (higher risk servers receive attention before low risk servers). By accurately defining asset groups, we can create clear levels of responsibility and ownership Compliance, Compliance, Compliance. © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting

Quiz

FAIR – Factor Analysis of Information Risk Picture in your mind a worthless old bald tire. Imagine that it’s so bald you can hardly tell that it ever had any tread. How much Risk is there? © September 21, 2018 Nebraska Cyber Security Center.

FAIR – Factor Analysis of Information Risk Next, imagine that the bald tire is tied to a rope hanging from a tree branch. How much Risk is there? © September 21, 2018 Nebraska Cyber Security Center.

FAIR – Factor Analysis of Information Risk Now, imagine that the rope is frayed about halfway through, just below where its tied to the tree branch. How much Risk is there? © September 21, 2018 Nebraska Cyber Security Center.

FAIR – Factor Analysis of Information Risk Finally, imagine that the tire swing is suspended over an 80-foot cliff – with sharp rocks below. How much Risk is there? © September 21, 2018 Nebraska Cyber Security Center.

FAIR – Factor Analysis of Information Risk What if I told you the risk for all 4 scenarios was the same. What is the value of the tire? Picture in your mind a worthless old bald tire. Imagine that it’s so bald you can hardly tell that it ever had any tread. © September 21, 2018 Nebraska Cyber Security Center.

FAIR – Factor Analysis of Information Risk Never forget that risk is directly tied to the value of an asset. Risk is not a thing… Risk is a derived value Similar to speed (a value derived from distance / time) Don’t equate vulnerability with risk Vulnerability is only one component of Risk © September 21, 2018 Nebraska Cyber Security Center.

Q & A

Resources NIST SP 800-37 FIPS – 199 FISMA http://csrc.nist.gov/publications/nistpubs/800-37/SP800-37-final.pdf FIPS – 199 http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf FISMA http://csrc.nist.gov/groups/SMA/fisma/index.html Wilson, Carl; What Is Certification and Accreditation? http://e-articles.info/e/a/title/What-Is-Certification-and-Accreditation/ - article added at 03/21/2007 © April 28, 2008 Nebraska Cyber Security Center. 2008 MS-ISAC Annual Meeting