Security Assessments and Vulnerabilities

Security Assessments

• Identify vulnerabilities, assess vulnerabilities, and implement penetration testing are key security assessment steps.

Host Vulnerabilities

• The underlying operating system (OS) and its configuration directly impact host vulnerabilities.
• Default OS configurations are often insufficient and need customization.
• Critical aspects of configuration include running services, installed programs, and security settings.
• Leaving a host with default settings can create weaknesses.
• Attackers might exploit these weaknesses.
• Example: Failing to disable Telnet can lead to man-in-the-middle attacks in this context.

Software Vulnerabilities

• Zero-day: Exploited before public disclosure, often leading to prolonged impact.
• Improper input handling: Software failing to handle unexpected input leading to various security issues such as unauthorized access, privilege escalation, or denial of service (DoS) attacks.
• Improper error handling: Errors that aren't handled well can make the system unstable.
• Resource exhaustion: Insufficient resource management can cause crashes or instability.
• Race conditions: Events occurring out of order leading to crashes.
• Memory vulnerabilities: Memory issues like leaks, buffer overflow, integer overflow, pointer dereference, and DLL injection pose significant risks.

Encryption Vulnerabilities

• Some encryption solutions become insecure or are inherently weak due to time or improper implementation.
• Organizations could utilize obsolete or vulnerable cipher suites.
• Weaknesses in implementation are reflected in things such as digital certificates (invalid addresses, expired certificates, and untrusted signers).
• Poor key management can result in compromised private keys, which can facilitate impersonation and man-in-the-middle attacks.

Network Architecture Vulnerabilities

• Network design can reveal security weaknesses.
• Insecure network designs might allow attackers to move through systems to databases.
• Uncontrolled wireless networks can allow for broader access to a system, allowing attackers to gain more access to areas a user may not be familiar with.
• Attacks intended to stall a system are referred to as DoS (Denial of Service) attacks.

Account Vulnerabilities

• Weak or easily guessable passwords and lack of password expiration are common weaknesses.
• The absence of multi-factor authentication makes accounts vulnerable to brute-force or other related attacks.
• Misplaced accounts and/or accounts with excessive privileges create opportunities for attackers.
• Accounts that have not been disabled and unused accounts are easy target points for potential attack.
• Guest accounts often require disabling or review of configurations.

Operations Vulnerabilities

• Untrained users are susceptible to social engineering and are a significant security risk in this context.
• A lack of a proper incident response policy or plan can expose an organization to attacks.
• Obsolete systems/software without proper maintenance procedures can be significantly vulnerable.
• Inadequate vendor support can hinder the ability to fix security issues.
• Embedded systems (if not secure) may be difficult to detect and understand.
• System sprawl (large, complex systems) can be challenging to manage from a security perspective leading to gaps.
• Undocumented assets make consistent security management difficult.

Security Assessment

• Security assessment is a method of identifying security measures gaps or weaknesses in tools, technology, services, and operations.
• Information obtained provides methods for timely and efficient vulnerability mitigation.
• Various methods are used to determine vulnerabilities, with some approaches being active and others passive.

Security Assessment Techniques

• Review baseline: A set of configurations that are used as reference to check against other systems for security compliance.
• Review code: All applications undergoing development are reviewed to prevent vulnerabilities.
• Determine attack surface: Evaluating points that are exposed to attack, reducing the risk of successful attacks.
• Review security architecture: An evaluation of the security of the infrastructure.
• Review security design: Review whether a proposed security solution meets the organization's requirements.

Vulnerability Assessment Tools

• Vulnerability scanners assess various systems.
• Port scanners evaluate network ports.
• Protocol/packet analyzer assesses network communications.
• Fingerprinting tools identify target information and services.
• Network enumerators map logical network structures or find rogue systems.
• Password crackers recover passwords.
• Backup utilities create copies of scanned data.
• Honeypots redirect activity to isolated systems.

Types of Vulnerability Scans

• Tools to scan for weak points in wireless networks
• Tools to scan for configuration compliance
• Credentialed scans: Scans performed by an authorized user or account, having elevated privileges on all potential targets.
• Non-credentialed scans: The user scans from a common user perspective allowing for more general testing opportunities.

False Positives

• Incorrect identification of a vulnerability.
• Example: Port 5424 could be open but potentially harmless or a non-attackable vulnerability.

Guidelines for Assessing Vulnerabilities

• Consider how host operating systems are configured.
• Create custom configurations that reflect specific security needs.
• Be aware of the risks posed by zero-day vulnerabilities.
• Evaluate flaws in software.
• Consider using outdated cipher suites and how this might introduce risk.
• Evaluate digital certificates for vulnerabilities.
• Assess encryption systems for weaknesses.
• Consider the existing network architecture and its potential weaknesses.
• Account configuration should be properly reviewed.
• Identify users who require training.
• Identify critical business processes.
• Be aware of system sprawl challenges.
• Account for undocumented assets.

Penetration Testing

• Penetration testing employs active methods and techniques to simulate attacks on systems.
• It verifies threats; it goes beyond simple diagnosis by actually attempting to exploit vulnerabilities.
• Penetration testing is more intrusive than vulnerability assessments.
• Gleaning data and information is more thorough.
• There is risk during penetration testing, with potential for damage to systems.
• Penetration tests are often subject to restrictions.

Penetration Testing Techniques

• Reconnaissance: Gathering information about the target system
• Initial exploitation: Obtaining access to the target system
• Escalation of privileges: Increasing access levels on the system
• Pivoting: Expanding access to other systems.
• Persistence: Maintaining access to the system

Box Testing Methods

• Black box - Full reconnaissance
• Grey box - Some reconnaissance
• White box - No reconnaissance

Penetration Testing Tools

• Exploitation Frameworks: Creating and deploying exploit code
• Data sanitization tools: Data securely removed from a storage medium
• Steganography tools: Hiding data to prevent detection
• Social engineering tools: Testing user susceptibilities
• Stress testers: Testing system response to increased load

Guidelines for Implementing Penetration Testing

• Consider a penetration test in addition to or instead of a vulnerability assessment.
• Be aware of risks involved in penetration testing
• Implement pen-testing procedures as phases of a simulated attack
• Pen-test methods can be employed using different box testing techniques.
• Understand the necessary reconnaissance for each box testing method.
• Familiarize yourself with tools used in active exploitation of systems.

Activity: Implementing Penetration Testing

• Conduct a penetration test to observe how attackers can exploit systems.
• Utilize existing credentials, such as one from a previous compromise.
• Use these credentials within simulated attacks on Windows Server.
• This test enables remote desktop access.

Additional Questions and Requirements

• Vulnerability assessment tools used or planned by an organization
• Value of implementing a penetration test in an organization.