1. Vulnerability Analysis Borrowed from the CLICS group.

2. Vulnerability Assessment Attack Overview –Gathering Information / Fingerprinting –Vulnerability Assessment –Attempt Exploit Defender –Fix Vulnerabilities To prevent exploits

3. Vulnerability Assessment Tools Collected Set of Tools for Determining Possible Security Holes Components –Port scanning –Additional checks on ports for: Software packages actually running Versions of those packages Possible vulnerabilities on these combinations –Vulnerability database to support above –Possibly other components Check for weak passwords Check for general patch levels Etc.

4. Example Going beyond port scanning –Port scanning may find port 21 listening, ftp –OS fingerprint – Linux 2.2 kernel –Service query – identifies ftp as wu-ftpd version 2.4.2 –What specific vulnerabilities does wu-ftpd 2.4.2 have?

5. Where To Position Vulnerability Assessment Tools? Don’t want them on bastion hosts, firewalls –Could be used against you Safer but less useful in secure zones Best may be to install on laptop –Connect to DMZ, insecure zone, secure zone when needed –Disconnect when not being used

6. Vulnerability Assessment Tools Linux –Nessus –SATAN/SAINT http://www.miora.com/articles/satan.htm –SARA Windows –NeWT (Nessus for Windows) –ISS Internet Scanner –Cybercop Scanner (also Linux) –Microsoft Baseline Security Analyzer

7. Nessus Probably most well-known Unix/Linux VA tool Uses nmap for initial port scanning Two-level architecture –Server: runs scans –Client: control scans, view reports http://www.nessus.org

8. Nessus Structure Uses plug-ins to abstract vulnerability tests –Tests further grouped into families Uses accounts for authorization Can configure through running server interactively –as opposed to running server in daemon state

9. Nessus Notes Prefs tab –Be careful with selecting ping –If ping refused, nessus may think system is down, not do further scans Plugins tab –Be careful with enabling all plugins Dangerous plugins can interrupt or even crash services on ports

10. Nessus results Good graphical interface Listing of findings with recommendations Example: http://www.nessus.org/demo/third.html

11. NeWT NeWT – Nessus Windows Technology Vulnerability database customized for Windows environments http://www.tenablesecurity.com/products/n ewt.shtmlhttp://www.tenablesecurity.com/products/n ewt.shtml

12. Microsoft Baseline Security Analyzer Program that analyzes a Windows system for vulnerability Analyzes in several areas –OS and related utilities - patch levels HFNetChk – allows this to be done across network from central system (command line option) –Accounts – password content and expiration –Services – whether unneeded services present –Utility security settings (e.g. IIS, SQL Server) –Etc. Start/Programs/Microsoft Baseline Security Analyzer