Network Security Assessment : From Vulnerability to Patch

by Manzuik; Pfeil; Gold

• ISBN13: 9781597491013
• ISBN10: 1597491012
• Format: Paperback
• Copyright: 2006-10-24
• Publisher: Elsevier Science

Summary

This book will take readers from the discovery of vulnerabilities and the creation of the corresponding exploits, through a complete security assessment, all the way through deploying patches against these vulnerabilities to protect their networks. This is unique in that it details both the management and technical skill and tools required to develop an effective vulnerability management system. Business case studies and real world vulnerabilities are used through the book. It starts by introducing the reader to the concepts of a vulnerability management system. Readers will be provided detailed timelines of exploit development, vendors time to patch, and corporate path installations. Next, the differences between security assessment s and penetration tests will be clearly explained along with best practices for conducting both. Next, several case studies from different industries will illustrate the effectiveness of varying vulnerability assessment methodologies. The next several chapters will define the steps of a vulnerability assessment including: defining objectives, identifying and classifying assets, defining rules of engagement, scanning hosts, and identifying operating systems and applications. The next several chapters provide detailed instructions and examples for differentiating vulnerabilities from configuration problems, validating vulnerabilities through penetration testing. The last section of the book provides best practices for vulnerability management and remediation. * Unique coverage detailing both the management and technical skill and tools required to develop an effective vulnerability management system * Vulnerability management is rated the #2 most pressing concern for security professionals in a poll conducted by Information Security Magazine * Covers in the detail the vulnerability management lifecycle from discovery through patch.

Table of Contents

Foreword	xix
Windows of Vulnerability	1	(16)
Introduction	2	(1)
What Are Vulnerabilities?	2	(7)
Understanding the Risks Posed by Vulnerabilities	9	(6)
Summary	15	(1)
Solutions Fast Track	15	(1)
Frequently Asked Questions	16	(1)
Vulnerability Assessment 101	17	(28)
Introduction	18	(1)
What Is a Vulnerability Assessment?	18	(6)
Step 1: Information Gathering/Discovery	18	(3)
Step 2: Enumeration	21	(1)
Step 3: Detection	22	(2)
Seeking Out Vulnerabilities	24	(1)
Detecting Vulnerabilities via Security Technologies	24	(10)
Deciphering VA Data Gathered by Security Technologies	26	(3)
Accessing Vulnerabilities via Remediation (Patch) Technologies	29	(1)
Extracting VA Data from Remediation Repositories	30	(2)
Leveraging Configuration Tools to Assess Vulnerabilities	32	(2)
The Importance of Seeking Out Vulnerabilities	34	(6)
Looking Closer at the Numbers	35	(5)
Summary	40	(1)
Solutions Fast Track	40	(1)
Frequently Asked Questions	41	(4)
Vulnerability Assessment Tools	45	(20)
Introduction	46	(1)
Features of a Good Vulnerability Assessment Tool	46	(4)
Using a Vulnerability Assessment Tool	50	(12)
Step 1: Identify the Hosts on Your Network	51	(4)
Step 2: Classify the Hosts into Asset Groups	55	(1)
Step 3: Create an Audit Policy	56	(2)
Step 4: Launch the Scan	58	(1)
Step 5: Analyze the Reports	59	(2)
Step 6: Remediate Where Necessary	61	(1)
Summary	62	(1)
Solutions Fast Track	62	(1)
Frequently Asked Questions	63	(2)
Vulnerability Assessment: Step One	65	(20)
Introduction	66	(1)
Know Your Network	67	(7)
Classifying Your Assets	74	(4)
I Thought This Was a Vulnerability Assessment Chapter	78	(4)
Summary	82	(1)
Solutions Fast Track	82	(1)
Frequently Asked Questions	83	(2)
Vulnerability Assessment: Step Two	85	(18)
Introduction	86	(1)
An Effective Scanning Program	86	(2)
Scanning Your Network	88	(8)
When to Scan	96	(4)
Summary	100	(1)
Solutions Fast Track	100	(1)
Frequently Asked Questions	101	(2)
Going Further	103	(44)
Introduction	104	(1)
Types of Penetration Tests	104	(2)
Scenario: An Internal Network Attack	106	(19)
Client Network	107	(2)
Step 1: Information Gathering	109	(1)
Operating System Detection	110	(2)
Discovering Open Ports and Enumerating	112	(4)
Step 2: Determine Vulnerabilities	116	(1)
Setting Up the VA	117	(3)
Interpreting the VA Results	120	(5)
Penetration Testing	125	(14)
Step 3: Attack and Penetrate	126	(1)
Uploading Our Data	126	(3)
Attack and Penetrate	129	(5)
Searching the Web Server for Information	134	(1)
Discovering Web Services	135	(4)
Vulnerability Assessment versus a Penetration Test	139	(2)
Tips for Deciding between Conducting a VA or a Penetration Test	139	(2)
Internal versus External	141	(3)
Summary	144	(1)
Solutions Fast Track	144	(1)
Frequently Asked Questions	145	(2)
Vulnerability Management	147	(24)
Introduction	148	(1)
The Vulnerability Management Plan	149	(1)
The Six Stages of Vulnerability Management	150	(8)
Stage One: Identify	151	(1)
Stage Two: Assess	152	(1)
Stage Three: Remediate	153	(1)
Stage Four: Report	154	(1)
Stage Five: Improve	155	(1)
Stage Six: Monitor	156	(2)
Governance (What the Auditors Want to Know)	158	(2)
Measuring the Performance of a Vulnerability Management Program	160	(4)
Common Problems with Vulnerability Management	164	(2)
Summary	166	(1)
Solutions Fast Track	166	(4)
Frequently Asked Questions	170	(1)
Vulnerability Management Tools	171	(18)
Introduction	172	(1)
The Perfect Tool in a Perfect World	172	(2)
Evaluating Vulnerability Management Tools	174	(3)
Commercial Vulnerability Management Tools	177	(3)
eEye Digital Security	177	(1)
Symantec (BindView)	178	(1)
Attachmate (NetIQ)	178	(1)
Still Secure	179	(1)
McAfee	179	(1)
Open Source and Free Vulnerability Management Tools	180	(3)
Asset Management, Workflow, and Knowledgebase	180	(1)
Host Discovery	180	(1)
Vulnerability Scanning and Configuration Scanning	181	(1)
Configuration and Patch Scanning	181	(1)
Vulnerability Notification	182	(1)
Security Information Management	182	(1)
Managed Vulnerability Services	183	(3)
Summary	186	(1)
Solutions Fast Track	186	(2)
Frequently Asked Questions	188	(1)
Vulnerability and Configuration Management	189	(32)
Introduction	190	(1)
What is Vulnerability Management?	190	(1)
Patch Management	190	(14)
System Inventories	195	(2)
System Classification	197	(2)
System Baselines	199	(1)
Creating a Baseline	199	(3)
Baseline Example	202	(1)
The Common Vulnerability Scoring System	203	(1)
Building a Patch Test Lab	204	(5)
Establish a Patch Test Lab with ``Sacrifical Systems''	204	(1)
Virtualization	205	(2)
Environmental Simulation	207	(2)
Patch Distribution and Deployment	209	(2)
Configuration Management	211	(5)
Logging and Reporting	212	(1)
Change Control	212	(4)
Summary	216	(1)
Solutions Fast Track	217	(1)
Frequently Asked Questions	218	(3)
Regulatory Compliance	221	(22)
Introduction	222	(1)
Regulating Assessments and Pen Tests	222	(11)
The Payment Card Industry (PCI) Standard	223	(2)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA)	225	(3)
The Sarbanes-Oxley Act of 2002 (SOX)	228	(2)
Compliance Recap	230	(3)
Drafting an Information Security Program	233	(6)
Summary	239	(1)
Solutions Fast Track	239	(1)
Frequently Asked Questions	240	(3)
Tying It All Together	243	(30)
Introduction	244	(1)
A Vulnerability Management Methodology	244	(1)
Step One: Know Your Assets	245	(5)
What You Need to Do	245	(1)
Why You Need to Do It	246	(1)
How to Do It	246	(3)
What Tools Exist to Help You Do It	249	(1)
Step Two: Categorize Your Assets	250	(3)
What You Need to Do	250	(1)
Why You Need to Do It	251	(1)
How to Do It	252	(1)
What Tools Exist to Help You Do It	252	(1)
Step Three: Create a Baseline Scan of Assets	253	(3)
What You Need to Do	253	(1)
Why You Need to Do It	254	(1)
How to Do It	254	(1)
What Tools Exist to Help You Do It	255	(1)
Step Four: Perform a Penetration Test on Certain Assets	256	(3)
What You Need to Do	256	(1)
Why You Need to Do It	257	(1)
How to Do It	257	(1)
What Tools Exist to Help You Do It	258	(1)
Step Five: Remediate Vulnerabilities and Risk	259	(2)
What You Need to Do	259	(1)
Why You Need to Do It	259	(1)
How to Do It	259	(2)
What Tools Exist to Help You Do It	261	(1)
Step Six: Create a Vulnerability Assessment Schedule	261	(4)
What You Need to Do	261	(1)
Why You Need to Do It	262	(1)
How to Do It	262	(3)
Step Seven: Create a Patch and Change Management Process	265	(1)
What You Need to Do	265	(1)
Why You Need to Do It	265	(1)
How to Do It	265	(1)
What Tools Exist to Help You Do It	266	(1)
Step Eight: Monitor for New Risks to Assets	266	(5)
What You Need to Do	266	(1)
Why You Need to Do It	267	(1)
How to Do It	267	(1)
What Tools Exist to Help You Do It	268	(3)
Summary	271	(2)
Appendix A Legal Principles for Information Security Evaluations	273	(66)
Introduction	274	(1)
Uncle Sam Wants You: How Your Company's Information Security Can Affect U.S. National Security (and Vice Versa)	275	(5)
Legal Standards Relevant to Information Security	280	(10)
Selected Federal Laws	281	(1)
Gramm-Leach-Bliley Act	281	(1)
Health Insurance Portability and Accountability Act	282	(1)
Sarbanes--Oxley	283	(1)
Federal Information Security and Management Act	284	(1)
FERPA and the Teach Act	284	(1)
Electronic Communications Privacy Act and Computer Fraud and Abuse Act	285	(1)
State Laws	285	(1)
Unauthorized Access	285	(1)
Deceptive Trade Practices	286	(1)
Enforcement Actions	286	(1)
Three Fatal Fallacies	287	(1)
The ``Single Law'' Fallacy	287	(1)
The Private Entity Fallacy	288	(1)
The ``Pen Test Only'' Fallacy	289	(1)
Do It Right or Bet the Company: Tools to Mitigate Legal Liability	290	(8)
We Did our Best; What's the Problem?	290	(1)
The Basis for Liability	291	(1)
Negligence and the ``Standard of Care''	291	(1)
What Can Be Done?	292	(1)
Understand your Legal Environment	293	(1)
Comprehensive and Ongoing Security Assessments, Evaluations, and Implementation	293	(1)
Use Contracts to Define Rights and Protect Information	294	(1)
Use Qualified Third-party Professionals	295	(1)
Making Sure Your Standards-of-Care Assessments Keep Up with Evolving Law	296	(1)
Plan for the Worst	297	(1)
Insurance	297	(1)
What to Cover in IEM Contracts64	298	(20)
What, Who, When, Where, How, and How Much	299	(1)
What	299	(4)
Who	303	(5)
When	308	(1)
Where	308	(1)
How	309	(1)
How Much	310	(2)
Murphy's Law (When Something Goes Wrong)	312	(2)
Where the Rubber Meets the Road: The LOA as Liability Protection	314	(2)
Beyond You and Your Customer	316	(2)
The First Thing We Do...? Why You Want Your Lawyers Involved From Start to Finish	318	(9)
Attorney-Client Privilege	319	(2)
Advice of Counsel Defense	321	(1)
Establishment and Enforcement of Rigorous Assessment, Interview, and Report-Writing Standards	322	(1)
Creating a Good Record for Future Litigation	323	(1)
Maximizing Ability to Defend Litigation	323	(1)
Dealing with Regulators, Law Enforcement, Intelligence, and Homeland Security Officials	324	(2)
The Ethics of Information Security Evaluation	326	(1)
Solutions Fast Track	327	(3)
Frequently Asked Questions	330	(2)
References	332	(7)
Appendix B Examples of Infosec Tools by Baseline Activity	339	(22)
Index	361