Improve IT Security with Credentialed Vulnerability Scans

1. Improve IT Security with Credentialed Vulnerability Scans Garrett Lanzy Information Security Specialist Office of the Chancellor garrett.lanzy@csu.mnscu.edu 651.201.1591 http://its.mnscu.edu/security

2. Abstract The MnSCU Vulnerability Management Infrastructure (VMI) service provides the nCircle IP360 platform to institutions for scanning networks to comply with System Guideline 5.23.1.6.  This guideline states that vulnerability scans should have authenticated (credentialed) access to scanned devices to obtain better vulnerability data.  This session provides participants with a tutorial for setting up credentialed scanning and insight into the resulting vulnerability data for improving IT security.

3. Ground Rules • All questions are welcome! • feel free to ask during the presentation • we do have a lot of material to get through • long(er) answers may be deferred to end • Phone/e-mail after the conference is good

4. Some fundamentals of Vulnerability Management

5. Definition: Vulnerability • Wikipedia: “a weakness which allows an attacker to reduce a system’s information assurance.” • ISO 27005: “A weakness of an asset or group of assets that can be exploited by one or more threats.” • RFC 2828: “A flaw or weakness in a system’s design, implementation, or operation and management that could be exploited to violate the system’s security policy.”

6. Examples of vulnerabilities • Software bug allows unrestricted access to network share • Network switch installed without changing the default administrator password • Server application’s configuration file is writable by anyone

7. Vulnerability Management Process • Define Policy • 5.23.1.5 – Security Patch Mgmt. • 5.23.1.6 – Vulnerability Scanning • 5.23.1.8 – Anti-malware Installation and Management

8. nCircle IP360 • Distributed, agentless vulnerability scanner • Agentless: no software installed on devices scanned for vulnerabilities • Distributed: local campus scanning appliances (device profilers) reduce network load • Distributed: authorization model allows each campus to maintain own network and scan definitions • Works with nCircle Security Intelligence Hub (SIH) product for reporting

9. VMI Architecture

10. Some Fundaments of Credentialed scanning

11. So why are we here? Because we’re not out there! TRACKING YOUR $: State worker retreats Updated: 04/29/2010 11:37 PM KSTP.com By: Bob McNaney and Becky Nahm State employees staying in cabins on the lake, enjoying free meals and spending time relaxing during business hours. That is what 5 EYEWITNESS NEWS undercover cameras discovered last week. Tax dollars paid to send 250 workers and contractors from the Department of Employment and Economic Development to one of Minnesota's priciest resorts--Grand View Lodge on the shore of Gull Lake. [BLAH, BLAH, BLAH.…]

12. So why are we here? • Excerpt from System Guideline 5.23.1.6 – Vulnerability Scanning:Part 3. Guidelines. • Subpart A. Vulnerability Scans […] • 3. Authenticated Scans. Scans of system-owned devices should include authenticated access to services and applications that would not be accessible without authentication. [emphasis mine] • Authenticated means same as Credentialed

13. Why credentialed scans? • IP360 is agentless (no special software installed on systems being scanned) • Normal scans can only gather information by observing responses from “the outside” • Severely limits what vulnerabilities can be found • Example: most “desktop” applications are not directly visible from the network • browsers, Microsoft Office, Adobe Reader, Flash, ….

14. How does it work? • Campus VMI admin stores a credential on the VnE • Such as user name/password • As each system is scanned, IP360 attempts to log in using this credential • If successful, IP360 then looks at system “from the inside” (files, registry entries, …) • Goal: obtain more complete vulnerability data

15. Stored password = BAD? IP360 has multiple protections for stored credentials (“Defense in Depth”) • Always stored encrypted • Always transmitted encrypted • Except where login protocol requires plaintext transmission (i.e., SNMP v1) – even then, only on local network between DP and device • No display of plaintext password or private key • No admin access to plaintext password or private key • Only stored on VnE (not device profiler)

16. nCircle Terminology • FactoredReasoning™ - nCircle’s non-credentialed scanning technology • Deep Reflex Testing™ (DRT) - nCircle’s credentialed scanning technology • SMB-DRT: Windows credentialed scanning • SSH-DRT: Secure SHell credentialed scanning • SNMP-DRT: Simple Network Management Protocol “credentialed” scanning • Discriminant Analysis™ - nCircle’s complete OS/service/application and vulnerability application technology • Stack fingerprinting + FactoredReasoning [+ DRT]

17. IP360 Supported Credentials • SMB-DRT: username/password[/domain] • Gives access to Windows systems • SSH-DRT username/private key or username/password • Gives access to Linux/OS X/Unix/ESX/network devices • SNMP-DRT: SNMP v1 Community String • Gives access to SNMP MIB data (printers, network devices, …) • ONLY useful if you already have SNMP v1 configured (and even then, doesn’t give much info)

18. Basic Setup Steps • Request access to VnE Credentials role • Email to tac-security@mnscu.edu • Define appropriate credential (type, user, authentication) • Insure systems to be scanned set up with defined credential and any necessary firewall rules • Store credential on VnE • Enable credential type in IP360 Scan Profile • Bind credential to IP360 Network Object(s) • Not required for Windows AD environments • Verify correct operation

19. Scanning with SMB Credentials

20. How does it work? For each system scanned Identify OS If Windows system AND scan profile specifies checking Windows credentials Send NetBIOS query (netbios-ds, UDP port 137) to obtain system name and domain If a configured SMB credential matches Attempt to log in via SMB (microsoft-ds, TCP port 445) in using credential If login succeeds Query files/registry with SMB to find additional applications, services, and vulnerabilities

21. Setup for simple AD domain • Create Active Directory domain user for scans, assign to domain Backup Operators group • Make sure system firewall settings allow device profiler access to these “File and Printer Sharing” ports: UDP 137 (netbios-ds), TCP 445 (microsoft-ds) • Create credential on VnE, specifying user name, password, and domain name (short “NetBIOS” format in all lowercase) • Enable Windows credentials on scan profile • That’s it! (Well, after testing )

22. Creating IP360 scan credential 1. Select Discover 3. Select New 2. Select Credentials Management

23. Create AD domain credential

24. Enable Windows credentials on scan profile Check Windows box

25. Testing: How do I know it worked? 

26. Just to compare…

27. Non-AD Windows: What’s different? • Create scan user (with same password) on each machine • Member of Backup Operators group on versions which support it • Otherwise must create an Administrator user • Leave domain field blank when creating IP360 credential • IP360 credential must be bound to all network objects where needed • Only one credential can be bound to any network object/IP address! • Binding rules and excluded addresses can cause conflicts • Soit’s very difficult to use different users/passwords for different systems unless networks are well-segmented • Windows XP: MUST run Internet Connection Wizard to properly enable File/Print Sharing!

28. Create non-AD credential

29. Add Credential Binding (step 1) Select New

30. Add Credential Binding (step 2)

31. Voila!

32. Enable Windows credentials Check Windows box

33. Test results 

34. Problem Determination • Check firewall settings. • Check firewall settings (again). • Verify credential is enabled in scan profile. • Non-AD: Verify credential is bound to correct network object. • Check event viewer • May need to adjust security policy to log additional security events • Check IP360 SMB credential processing rules (next slide).

35. SMB Credential Processing SMB credentials are used for scanning Windows systems. IP360 uses the following process for SMB credentials: • The Device Profiler queries the Windows host. The host returns its machine name and possibly its IP address and domain. This step uses UDP port 137. • The Device Profiler first tries to find the most specific credential according to the host’s IP address and the credential’s network binding. The DP looks for a credential that is bound to the host’s network and restricted to an IP space that includes the host. The DP makes sure that the selected credential’s Domain (if it has been specified) matches the host’s domain. • If the DP makes no match in step 2, the DP looks for a credential that is bound, unrestricted, to the host’s network. The DP makes sure that the selected credential’s Domain (if it has been specified) matches the host’s domain. (There can be at most one such credential.) • If the DP makes no match in step 3, the DP looks for a credential with no network binding that has a Domain that the host belongs to. • If the DP makes no match in step 4, the DP does not authenticate against the host using an SMB credential. Warning: UDP port 137 must be available for domain-based SMB credential-matching to work.

36. Scanning with SSH Credentials

37. SSH DRT OS support Best (vulnerabilities for OS and vendor-supported packages): • RedHat Linux • Sun/Oracle Solaris Some support (basic OS vulnerabilities): • Mac OS X • VMware ESX Server Little support (software versions identified but not patches): • Other Linux distros (i.e., SuSE) • Cisco IOS • …

38. How does it work? For each system scanned Identify OS If “SSH OS” AND scan profile specifies checking SSH credentials AND an SSH credential is bound to network object Attempt to log in via SSH (TCP port 22) If login succeeds Query files/settings with SSH to find additional applications, services, and vulnerabilities

39. SSH credential choices Only 1 SSH credential can be bound to a network object – either: • User/password • User/key • Generate 1024-bit DSA public/private key pair • No passphrase on private key! • RSA keys are NOT SUPPORTED!!! • Configure username + private key on VnE • (then destroy private key) • Store public key in ~user/.ssh/authorized_keys on systems to be scanned • Best to configure user so that password cannot be used for login

40. Setup for SSH user/password • Create user on system(s) to be scanned with desired password • User needs to have read access to system files • Make sure system firewall settings allow device profiler access to SSH (TCP port 22). • Create credential on VnE, specifying user name and password. • Bind credential to network(s) to be scanned. • Enable SSH credentials on scan profile. • That’s it! (Well, after testing )

41. Creating IP360 scan credential 1. Select Discover 3. Select New 2. Select Credentials Management

42. Create SSH password credential

43. Add Credential Binding (step 1) Select New

44. Add Credential Binding (step 2)

45. Enable SSH credentials on scan profile Check SSH box

46. Testing: How do I know it worked? 

47. Setup for SSH user/key • Create 1024-bit DSA key pair. • No passphraseon private key!!! • Create credential on VnE, specifying user name and private key. • Bind credential to network object(s) to be scanned. • Create user on system to be scanned . • User needs to have read access to system files • Copy public key to ~user/.ssh/authorized_keys • Make sure SSH daemon is running and system firewall settings allow device profiler access to SSH (TCP port 22). • Enable SSH credentials on scan profile. • Test. • Deploy user/public key across systems to be scanned.

48. Creating key pair 1 2 3 4

49. Private key

50. Public key Must be copied as a single line!!! (Best to use a copy command instead of cut/paste.)