network vulnerability assessment methodology lesson 6
Post on 26-Dec-2015
228 Views
Preview:
TRANSCRIPT
Network Vulnerability Assessment Methodology
Lesson 6
Review of Some Definitions
Risk: the probability that a threat will exploit a vulnerability to adversely affect an information asset.Threat: an event, the occurrence of which could have an undesired impactThreat impact: a measure of the magnitude of loss or harm on the value of an asset.Threat probability: the chance that an event will occur or that a specific loss value may be attained should the event occur.Safeguard: a risk-reducing measure that acts to detect, prevent, or minimize loss associated with the occurrence of a specified threat or category of threats.Vulnerability: the absence or weakness of a risk-reducing safeguard.
Definitions from Peltier Text
Philosophy of an NVA
“The NVA examines the network systems from both a policy and a practice point of view” – the top-down and bottom-up assessments mentioned in a previous lesson.Top-Down concentrates on the extent to which policies and procedures promote a secure computing environment. Team examines procedural framework upon which corporate security rests.Bottom-up concentrates on the hardware and software implementations of network security.
Exhibit 1, page 50 from Peltier
NVA Methodology
Page 51 from Peltier text
NVA Methodology
Page 52 from Peltier Text
NVA Team Members and Skills
Major RolesNVA LeadPolicy examiner(s)Technical examiner(s)
May need experts in several OS’s and programs
Page 58 from Peltier Text
Project Initiation
Develop detailed project planAssemble teams and make tentative assignmentsHold a kick-off meeting with the sponsor (client)
Earlier meeting may be needed to complete Pre-NVA checklist (before detailed plan is completed)
Obtain approval of detailed project plan by sponsor (before kick-off meeting)
Phase I Data Collection
Obtain documents that client has from list in Pre-NVA checklist.Review applicable state and federal laws affecting the client.Review documentation and list of equipment.
Create list of known bugs and security vulnerabilities to test for in the client environment.
Phase II, Interviews, Information Reviews, Hands-on Investigation
InterviewsDetermine what interviews you might want to conductProvide list of requested interviews to POCConduct Interviews
Request for additional documents that may not have been considered during Phase IRequest facility and network clearance and passwords for team members from the POC
We will differ from this slightly
Take tour of facility and conduct tests of HW and SW as well a physical inspection.
Phase II, our version
What text has is good, we will be adding to it We need the onsite evaluation of HW/SW and the look at the physical facilities. We will want to conduct:
Public Presence analysisExternal Penetration Test
ReconnaissanceFocused ReconnaissanceVulnerability ScanningWeb Page Inspection/AlterationPasswordsSocial Engineering
Reconnaissance
ReconnaissancePort scanning Single portsPort scanning multiple ports
Focused ReconnaissancePort scans and connection programs to grab banner information from all open services, sometimes integrated into vulnerability scannersBasic configuration information
Password protectionSite content
Vulnerability Scanning
Automated scanning of known vulnerabilities based upon server typeMany different scanners exist, open source as well as commercial
WhiskerCISNetsonarISSNmapNessus
Web Page ExaminationRaw HTML Examination
Path NamesDirectory ListingClues to directory structure
Database commandsHard coded IP addressesOther extraneous information
Editing HTMLSaving local copy, then making key edits to attempt unauthorized data accessSQL injection
Form entryOverly long inputs, inputs with invalid charactersSQL injection
Passwords and Social Engineering
Attempt to guess passwordsDefault and Common passwordsIntelligent guesses based on obtained infoBrute force(later we may ask for password file to crack)
Social EngineeringAttempt to obtain information through SE
Names of individuals, positions, phone numbers, email addresses (this gives login ID generally)Attempt to social engineer a password/userid (for small company may not be able to do this)
Physical attack on facilityDumpster divingShoulder surf, piggyback
Phase III AnalysisSpans most of the NVA process as it is being conducted at multiple levelsOngoing analysis may shape and direct further activities.Need to identify threats and vulnerabilities
Also need to take a look at possible ways to mitigate the risks.Need to consider most cost effective mechanisms
Analysis of Security PoliciesDo policies explicitly state what is and is not permissible?Do they cover all security-related factors (network to physical)?
Security HandbookIt has been recommended by several sources that every organization have a security handbook for all employees. This book translates the company’s policies into specific practices for the employeesExamine the handbook (if they have one) and ensure:
Users can implement the security policy correctlyBook provides specific examples as opposed to generalized statements.Consequences for failure to follow policies are clearly delineated.Users are provided an understanding of their responsibilities and expectationsIt covers all situations (e.g. telecommuting)It has a procedure to report violations of policies
Additional Phase III itemsExamination of
Standards and PracticesDocument handlingIncident Handling
Do they have procedures?Do they have an established IRT
Asset protection Management and AwarenessOrganizational suitability
E.g. is senior management openly supportive of security program?
Personnel issues (enough people to do the job?, good HR and security related policies?)After-Hours proceduresAuditingApplication Design and development proceduresTechnical safeguards (and their operation)
Phase IV & V: ReportsPhase IV, draft report (sample sections covered in text).
Provides sponsor opportunity to review and for you to re-evaluate areas that might be in question (if necessary) or to clarify points.Provides sponsor opportunity to provide comments
Phase V: Final Report and PresentationCan include comments from sponsor obtained after draft report was reviewedFormal presentation signals formal conclusion of project.
Provided to senior management if possible
Several final reportsSenior ManagementTechie Summary report and Techie detailed report
Text Book Timeline - Laredo
Exhibit 4, page 58 from Peltier
Lesson 10 14 16 18 20 22 24 26 28 Final
Interviews, analysis, tests
Textbook Timeline - Austin
Exhibit 4, page 58 from Peltier
Lesson 10 14 16 18 20 22 24 26 28 Final
Interviews, analysis, tests
Summary
What is the importance and significance of this material?
How does this topic fit into the subject of “Security Risk Analysis”?
top related