New Technology Reviews!.: Vulnerability

How to Evaluate a Vulnerability Management Program

The difficulty of evaluating a vulnerability management program is made a little easier when the evaluation is based around some basic principles. Web application Security is vital to any business so the vulnerability management programs job is to ensure that all security issues identified, evaluated and dealt with as efficiently as possible.Here are five elements that every management program should incorporate.Risk management strategies. Essentially, the program should be based on risk management because this approach provides a valuable guide by which decisions can be made an independent evaluations made about the risks. In other words, each threat, as it is uncovered, needs to be independently assessed before a decision is made to deploy patches. Information Technology Practices. In essence the vulnerability of management program should also be considered within the context of overall IT management and practices. This includes training, documentation and procedures, monitoring of systems and data recovery strategies. As you probably already know these activities are vital to ensure ongoing security so effective vulnerability management program should contain these elements. Patch deployment. Patches need to be deployed in a timely manner so that software can continue uninterrupted whilst at the same time being protected against malicious attacks. It's important to note however that not all patches are applicable in every situation and a decision needs to be made about which patches are relevant and which will optimise the system in ongoing sense. This means that patching should be prioritised and evaluated against the potential dangers of nonimplementation. Every asset needs to be considered on its merits and patches should be tracked and identified before deployment. Antivirus programs. It almost goes without saying that an effective vulnerability program should also contain effective antivirus and malware protection that remain permanently operational so as to provide continuous protection against viruses, worms and Trojans. Specialist advice should be obtained before deciding which software to use. It's also vital to ensure that the software is regularly updated and that someone in the management team assumes responsibility for ensuring this happens. Self testing. The vulnerability management program should provide for periodic self checks. This is an important way to measure quality assurance and also to ensure that the program is effective. During a self check system configurations can be monitored to ensure that there are no holes that need to be dealt with.Although these five steps are not meant to be a comprehensive overview of how to evaluate a vulnerability management program, they provide a framework for starting an evaluation. It is certain that any evaluation will need to involve a variety of staff and other internal resources but the costs involved should not compromise the evaluation process. By providing regular reports to management, it is much easier to stay on top of emerging problems and decisions about replacing equipment or software can be made in a much more logical and informed environment.This is the only way that Web application Security can be adequately maintained.	 	 		 			 				 					 						HackLabs is a Security Consulting Company specialising in Penetration Testing. We perform testing for our clients whom from all around the world. For more information, visit <a href="http://www.hacklabs.com" target="_new">Penetration Testing</a>.

How to Evaluate a Vulnerability Management Program

The difficulty of evaluating a vulnerability management program is made a little easier when the evaluation is based around some basic pr...

What Is Vulnerability Management?

Vulnerability management has been variably described as computer security management activity or web application security that can be as simple or as complex as you wish. From the simplistic view that a computer system can be secure by simply downloading frequent patches from Microsoft, to the more complex view taken by some organisations, that vulnerabilities need to be approached with a complex and systematic array of procedures.Whichever view you take, it is clear that in the modern marketplace computer networks should make it easier to communicate with customers and suppliers with security and safety. With this expectation in mind however threats from worms and viruses that pervade everyday computer activity mean that vulnerabilities in management software are exposed on almost daily basis. This fact alone indicates a need to take protective action as a defence against malicious attacks including the use of firewalls, intrusion detection systems and anti-virus software.In fact, layers of securities are a modern trend in a proactive approach to detecting intrusions and preventing attacks.These days, organisations can no longer relax their standards by adhering to a yearly or even quarterly audit of their systems. Vulnerabilities emerge every day and unless you have an appropriate management program that runs on a daily or weekly basis you are placing your system at risk.In summary, a typical vulnerability management system could consist of 6 steps.Early identification. This involves identifying every network asset including operating systems and any open services in use. Prioritising assets. Large organisations will find it easy to categorise various assets into business units or groups and rank them in order of priority. Assessment processes. When you have a risk profile established it is easy to focus on eliminating risks in the more important assets of your business operation. The more important the asset is, the greater the need to identify security vulnerabilities on a daily basis. Reporting. The production of regular reports can highlight problems before they emerge and paint a picture of overall trends so that remedial action can be taken. Remedial action. As indicated above once patterns have merged it is easy to prioritise and fix vulnerabilities as they are identified. The final phase involves verifying that all threats have been eliminated through follow-up audits.While this is not meant to be a definitive strategy, the steps outlined above can form the basis of an effective vulnerability management plan. But in any case the important thing to remember is that scanning technology has improved dramatically over the last 10 years and it is absolutely vital for you to get started but more importantly, to take action on the results.If you want to dip your toes in the water but are not prepared to outlay money for sophisticated software or outsource to a specialist service, there are plenty off open source systems you can start with. The important thing to remember is that automated systems will allow you to strengthen your Web application Security and give you peace of mind you're looking for.	 	 		 			 				 					 						HackLabs is a Security Consulting Company specialising in Penetration Testing. We perform testing for our clients whom from all around the world. For more information, visit <a href="http://www.hacklabs.com" target="_new">Penetration Testing</a>.

What Is Vulnerability Management?

Vulnerability management has been variably described as computer security management activity or web application security that can be as ...

Device Hardening, Vulnerability Scanning and Threat Mitigation for Compliance and Security

All security standards and Corporate Governance Compliance Policies such as PCI DSS, GCSx CoCo, SOX (Sarbanes Oxley), NERC CIP, HIPAA, HITECH, GLBA, ISO27000 and FISMA require devices such as PCs, Windows Servers, Unix Servers, network devices such as firewalls, Intrusion Protection Systems (IPS) and routers to be secure in order that they protect confidential data secure.There are a number of buzzwords being used in this area - Security Vulnerabilities and Device Hardening? 'Hardening' a device requires known security 'vulnerabilities' to be eliminated or mitigated. A vulnerability is any weakness or flaw in the software design, implementation or administration of a system that provides a mechanism for a threat to exploit the weakness of a system or process. There are two main areas to address in order to eliminate security vulnerabilities - configuration settings and software flaws in program and operating system files. Eliminating vulnerabilites will require either 'remediation' - typically a software upgrade or patch for program or OS files - or 'mitigation' - a configuration settings change. Hardening is required equally for servers, workstations and network devices such as firewalls, switches and routers.How do I identify Vulnerabilities? A Vulnerability scan or external Penetration Test will report on all vulnerabilities applicable to your systems and applications. You can buy in 3rd Party scanning/pen testing services - pen testing by its very nature is done externally via the public internet as this is where any threat would be exploited from. Vulnerability Scanning services need to be delivered in situ on-site. This can either be performed by a 3rd Party Consultant with scanning hardware, or you can purchase a 'black box' solution whereby a scanning appliance is permanently sited within your network and scans are provisioned remotely. Of course, the results of any scan are only accurate at the time of the scan which is why solutions that continuously track configuration changes are the only real way to guarantee the security of your IT estate is maintained.What is the difference between 'remediation' and 'mitigation'? 'Remediation' of a vulnerability results in the flaw being removed or fixed permanently, so this term generally applies to any software update or patch. Patch management is increasingly automated by the Operating System and Product Developer - as long as you implement patches when released, then in-built vulnerabilities will be remediated. As an example, the recently reported Operation Aurora, classified as an Advanced Persistent Threat or APT, was successful in infiltrating Google and Adobe. A vulnerability within Internet Explorer was used to plant malware on targeted users' PCs that allowed access to sensitive data. The remediation for this vulnerability is to 'fix' Internet Explorer using Microsoft released patches. Vulnerability 'mitigation' via Configuration settings ensures vulnerabilities are disabled. Configuration-based vulnerabilities are no more or less potentially damaging than those needing to be remediated via a patch, although a securely configured device may well mitigate a program or OS-based threat. The biggest issue with Configuration-based vulnerabilities is that they can be re-introduced or enabled at any time - just a few clicks are needed to change most configuration settings.How often are new vulnerabilities discovered? Unfortunately, all of the time! Worse still, often the only way that the global community discovers a vulnerability is after a hacker has discovered it and exploited it. It is only when the damage has been done and the hack traced back to its source that a preventative course of action, either patch or configuration settings, can be formulated. There are various centralized repositories of threats and vulnerabilities on the web such as the MITRE CCE lists and many security product vendors compile live threat reports or 'storm center' websites.So all I need to do is to work through the checklist and then I am secure? In theory, but there are literally hundreds of known vulnerabilities for each platform and even in a small IT estate, the task of verifying the hardened status of each and every device is an almost impossible task to conduct manually.Even if you automate the vulnerability scanning task using a scanning tool to identify how hardened your devices are before you start, you will still have work to do to mitigate and remediate vulnerabilities. But this is only the first step - if you consider a typical configuration vulnerability, for example, a Windows Server should have the Guest account disabled. If you run a scan, identify where this vulnerability exists for your devices, and then take steps to mitigate this vulnerability by disabling the Guest Account, then you will have hardened these devices. However, if another user with Administrator privileges then accesses these same servers and re-enables the Guest Account for any reason, you will then be left exposed. Of course, you wont know that the server has been rendered vulnerable until you next run a scan which may not be for another 3 months or even 12 months. There is another factor that hasn't yet been covered which is how do you protect systems from an internal threat - more on this later.So tight change management is essential for ensuring we remain compliant? Indeed - Section 6.4 of the PCI DSS describes the requirements for a formally managed Change Management process for this very reason. Any change to a server or network device may have an impact on the device's 'hardened' state and therefore it is imperative that this is considered when making changes. If you are using a continuous configuration change tracking solution then you will have an audit trail available giving you 'closed loop' change management - so the detail of the approved change is documented, along with details of the exact changes that were actually implemented. Furthermore, the devices changed will be re-assessed for vulnerabilities and their compliant state confirmed automatically.What about internal threats? Cybercrime is joining the Organised Crime league which means this is not just about stopping malicious hackers proving their skills as a fun pastime! Firewalling, Intrusion Protection Systems, AntiVirus software and fully implemented device hardening measures will still not stop or even detect a rogue employee who works as an 'inside man'. This kind of threat could result in malware being introduced to otherwise secure systems by an employee with Administrator Rights, or even backdoors being programmed into core business applications. Similarly, with the advent of Advanced Persistent Threats (APT) such as the publicized 'Aurora' hacks that use social engineering to dupe employees into introducing 'Zero-Day' malware. 'Zero-Day' threats exploit previously unknown vulnerabilities - a hacker discovers a new vulnerability and formulates an attack process to exploit it. The job then is to understand how the attack happened and more importantly how to remediate or mitigate future re-occurrences of the threat. By their very nature, anti-virus measures are often powerless against 'zero-day' threats. In fact, the only way to detect these types of threats is to use File-Integrity Monitoring technology. "All the firewalls, Intrusion Protection Systems, Anti-virus and Process Whitelisting technology in the world won't save you from a well-orchestrated internal hack where the perpetrator has admin rights to key servers or legitimate access to application code - file integrity monitoring used in conjunction with tight change control is the only way to properly govern sensitive payment card systems" Phil Snell, CTO, NNTSee our other whitepaper 'File-Integrity Monitoring - The Last Line of Defense of the PCI DSS' for more background to this area, but this is a brief summary -Clearly, it is important to verify all adds, changes and deletions of files as any change may be significant in compromising the security of a host. This can be achieved by monitoring for should be any attributes changes and the size of the file.However, since we are looking to prevent one of the most sophisticated types of hack we need to introduce a completely infallible means of guaranteeing file integrity. This calls for each file to be 'DNA Fingerprinted', typically generated using a Secure Hash Algorithm. A Secure Hash Algorithm, such as SHA1 or MD5, produces a unique, hash value based on the contents of the file and ensures that even a single character changing in a file will be detected. This means that even if a program is modified to expose payment card details, but the file is then 'padded' to make it the same size as the original file and with all other attributes edited to make the file look and feel the same, the modifications will still be exposed. This is why the PCI DSS makes File-Integrity Monitoring a mandatory requirement and why it is increasingly considered as vital a component in system security as firewalling and anti-virus defences.Conclusion Device hardening is an essential discipline for any organization serious about security. Furthermore, if your organization is subject to any corporate governance or formal security standard, such as PCI DSS, SOX, HIPAA, NERC CIP, ISO 27K, GCSx Co Co, then device hardening will be a mandatory requirement. - All servers, workstations and network devices need to be hardened via a combination of configuration settings and software patch deployment - Any change to a device may adversely affect its hardened state and render your organization exposed to security threats - file-integrity monitoring must also be employed to mitigate 'zero-day' threats and the threat from the 'inside man' - vulnerability checklists will change regularly as new threats are identified	 	 		 			 				 					 						All NewNetTechnologies software solutions are built using the latest technology, which means they can be fully adapted to suit all business environments. For more information on <a href="http://www.newnettechnologies.com" target="_new">File Integrity Monitoring</a> view our software solutions on <a href="http://www.newnettechnologies.com" target="_new">http://www.newnettechnologies.com</a> which provide 100% of the features you need but at a fraction of the cost of traditional solutions.

Device Hardening, Vulnerability Scanning and Threat Mitigation for Compliance and Security

All security standards and Corporate Governance Compliance Policies such as PCI DSS, GCSx CoCo, SOX (Sarbanes Oxley), NERC CIP, HIPAA, HI...

Vulnerability Management - The Changing Nature of Attacks

Attacks on users of the Internet have been noted for many years by the press and other observers but only recently have the attacks become more frequent and more deadly. Since almost every business and organization of any size relies on an open and accessible internet to remain competitive, cyber attacks are becoming more universal.? Increased effectiveness, adaptability and aggressiveness of malicious and destructive cyber attacks.? Increased attacks through trusted sites and botnets (a recent study shows that most cyber attacks come from IP addresses in the United States and it has been estimated that up to one quarter of all personal computers and servers connected to the internet may be part of a botnet.).? An increase in simultaneous and coordinated attacks at all levels of the internet? Attacks on U.S. government networks, critical infrastructure and increased frequency of localized attacks.? Infrastructure attacks with wide ranging and potentially long term effect.? Convergence of attacks using wolf pack like tactics.All level of internet users are affected and networks are being subjected to daily breaches of security. It doesn't matter if you are a small company or part of a large organization unless preventative steps are taken, your network is increasingly vulnerable to attack.The nature of Cyber Attacks is becoming More DestructiveInitially, cyber attacks were more nuisance than danger. Hackers originally released malware in the form of viruses/worms and spyware usually for the thrill of bringing down a selected network or site. Disgruntled employees utilized hacking tools to disrupt the business of their former employers. Eventually criminal used penetration techniques to steal credit card and other passwords.But recently, cyber terrorism has emerged which, in addition to attacks on corporate networks, posed a direct threat to U.S. military and civilian agencies and critical infrastructure. Because of the problems with attributing the attacks to the actual source, this threat has become difficult to contain.Cybercrime is becoming more aggressive, organized and effective as a transnational/multinational business. High technology online skills and techniques are now available to all interested parties, including hostile nation states, criminal elements and individuals and groups that covertly represent terrorist groups.The development and spread of automated attack and botnet tools and their use by cybercriminals has overwhelmed many current methodologies used for vulnerability management and the tracking of and defense against cyber attacks. In addition, vulnerabilities of the U.S. critical infrastructure (power, water, transport and communications) tend to attract cyber criminals to extort money, or damage the U.S. economy in a way that eventually affects national security.The result of this dangerous trend is the risk of losing proprietary knowledge that gives our country its competitive and military edge, loss of command and control of military assets and denial of service attacks that can shut down military bases and critical infrastructure like the power grid and energy plants.The transnational nature of cyber terrorism is also thriving in a culture of ineffective regulation and suspicion over allowing domestic network access to potential adversaries. Multilateral treaties, until recently, have not addressed the problem.What is the Solution?There are a number of areas that need to be addressed:? AwarenessAwareness of the threat is critical in all aspects of the economy including media, government, and corporate and the real, changing nature of the threat is mandatory.? Development of TechnologyTechnology that is available, easy to use, and adaptable to new threats would contribute towards containment of many attacks? More Effective and Adaptive Vulnerability Management Tools and TechniquesVulnerability management is continuous process that is never completed. Easy to use software tools are required as well as a dedication of real resources and management commitment to address the problem. Constant monitoring and remediation is required.? Government ActionRecently the present administration has taken steps to streamline and focus energy of the cyber security problem in civilian, defense and intelligence agencies. The Department of Homeland Security (DHS) has received additional authority to fight cyber terrorism and the cyber functions of defense and intelligence have been merged under one command - Cyber Command.These steps are but necessary first steps and much more work is required.? International TreatiesThe United Nations has recently taken steps toward the drafting of an international cyber agreement with the United States and Russia agreeing to enter negotiations. Since the United Nations is notoriously slow, much more action is required.These steps form a template and outline for future action. The threat is real and growing and must be addressed.	 	 		 			 				 					 						Jon M. Stout is Chief Executive Officer of Aspiration Software LLC. Aspiration Software LLC is an Information Technology/Cyber Security services provider focused on the Intelligence Community (IC). For more information about <a href="http://aspirationsoftware.com/core-capabilities" target="_new">Cyber Security and Information Assurance</a> and Employment Opportunities in the Intelligence Community go to <a href="http://aspirationsoftware.com" target="_new">http://aspirationsoftware.com</a>

Vulnerability Management - The Changing Nature of Attacks

Attacks on users of the Internet have been noted for many years by the press and other observers but only recently have the attacks becom...