Slashdot Mirror
Kinder, Gentler Security Scans?
klausner asks: "I'm working at a large company that is trying to be more thorough about things like network security scanning. When Security told Operations they were planning to do this, there were immediate screams of anguish, and insistence that scans could only be done in the maintenance window, only with prior notice, and with a bunch of other restrictions. Needless to say, this is less than ideal. Given the size of the network, it would take weeks to do a single scan set. However, it is reasonable to take steps to ensure that the scans do not interrupt business traffic, or cause undesirable side effects like crashing target systems. What sort of limits are the readers out there using to ensure safe scanning? Limiting the bandwidth to a fixed percentage? Limiting the number of simultaneous tests? What other kinds of things can I do to limit the scans effect on network performance?"
Identify nodes that are more likely to have security holes(ie phb's desktop), identify the nodes whose performance is most critical, etc.
That should give you a clue of who to scan and how often to scan them. Probably more intelligent than scanning your whole network all the time.
Security is a range, it isn't a switch. If maximum compute power is of upmost important to you - go ahead, turn off all your virus scanners, personal firewalls, etc. . However, if you need security - turn those services on, monitor their compliance, and take the overhead that it requires.
Scanning for security vulnerabilities at night won't do you any good if the PHB takes his laptop home w/ him, or joe user powers off his virus ridden PC every night before heading home. You must scan during the day (again, if that is important to your business).
I have mod points and I am not afraid to use them
First run a slow portscan across your network, with clean connection tear-down (i.e. send QUIT to a SMTP server insted of just closing the connection) and look over your results. Operations shouldn't have too much of a problem with this if you do it right.
Second look at the least common ports. These will be the oddball services that an administrator tossed up to test, or an engineer was trying to sneak past security with, and are most likely to be overlooked when updates are released.
Third, look at the most common ports. If you have a lot of machines with port 80 open, you should invest some time into researching web vulnerabilities. Same for other protocols. Based on these results you can launch smaller scans within maitnence windows to check for say, open relays on all machines listening on port 25.
Building apon this process and fitting it to your situation would be a good course of action. This obviously isn't as indepth as a good auditing plan should be, but it will get you going in the right direction.
Also realize that yout operations team has a good point, regardless of how concerned about security you are. Don't do like I did and take a off the shelf application (Nessus or Cisco Security Scanner) and blast away at your network. I ended up taking down a dozen mission critical devices because the vendor of the hardware in question didn't account for portscans. The devices ended up hanging because they received a connection with no command in it.
symetrix. We are building a religion, a limited edition.
When Security told Operations they were planning to do this, there were immediate screams of anguish, and insistence that scans could only be done in the maintenance window, only with prior notice, and with a bunch of other restrictions.
Just make sure Operations let the crackers know about these restrictions as well, and you'll be fine.
To: Network Operations
In accordance with your policy on security related network traffic, please be advised that I will attempt to DDOS the web server located at IP XXX.XXX.XXX.XXX and compromise the database server located at IP XXX.XXX.XXX.XXX, starting shortly after the start of the maintainence window at 8:00 UTC. If all goes successfully, the database will be corrupted by 9:00 UTC and the DDOS will cease shortly thereafter. All due efforts will be taken to minimize effects on connectivity for other networks users, and network traffic for this sequrity breach will be limited to the two above mentioned IP addresses.
I appologize for any inconvieniece this may cause you, but it is nessasary to "ownerz" your system.
Thank You,
Jack Cracker
Vice Prezident of Black Hats P.S. I would appreciate it if you would facilitate my exploit by reverting to an unpatched version of IIS on the database server.
We've found that certain applications running on erm, VMS or something here at work - will allow only a certain number of connections to a service - and if they aren't closed down properly, will hang. This is perhaps the worst thing we've discovered after performing network scans.
;)
If your company want's you to do scheduled scans during maintenance windows, that is rather simple however. You can implement this with Nessus in command-line mode, called from crontab. Just be certain that when you are configuring your scan, that you do not perform any potential denial of service scans.
But to be honest, I've been blase' a few times and on a whim pointed my Nessus box at our internal exchange server and highly expensive monitoring cluster and scanned away - nothing horrible has come of it - apart from discovering about 10 remote root vulnerabilities on each. That is the main concern from these people I believe, that the security scans will highlight something they know they're slack in - regular patching.
If you run into any departments who point at a particular system and say "don't scan that - it's mission critical", get the highest manager responsible for that system and get him to personally sign off that he's unwilling to allow a scan. Then remind him of recent privacy laws that have come into force. If that mission critical server is holding customer data, and it gets cracked, he or the company may be liable for failing to perform due diligence with regards to securing their data. And you'll have their signoff on paper.
Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
I work as a contractor for big 5 letter chip company. I can tell you that security is only second to the fab, and that is because the fab makes money. Unless something crashing is going to cause you millions of dollars an hour, someone needs to decide what is more important, your network being slow because it is being scanned for unpatched systems, or having a nasty version of Sasser erase data, send out confidential information, and completely crash the whole network. And they are even pickier about fab security, because if something does get infected and go down, they are out big bucks
Is security in charge of making sure everything is patched also, or is operations in charge and they are trying to cover their ass by making you forewarn them of your scan?
Your production network should be segmented from the general network, and critical portions of the general network (say, helpdesk, hr, etc) should be on their own segments. This allows you to scan one entity at a time and if something does break, you have a defined area for your desktop support team to work in.
Regardless of if you must wait for a maintenance window for production equipment, who will get the blame if something breaks? Do the scan on the weekend, on test servers, whatever you can do the easiest first. You should have a standard build for servers, desktops, etc... and be able to test those systems and see the effects.
The release time between an exploit being found and being exploited is growing shorter all the time. What was the leadtime for sasser? Two, three weeks? The netops people here are shutting off the ports of systems that are not patched at the switch level already. The network comes to a crawl while they are doing the scans. And guess what? They do them during the day. Why? Because that is when people are at work! A maintenance window is useless if you cannot guarantee what percentage of your population you are going to hit. So if your window is 1am to 3am, you better be scanning a network full of Indian helpdesk agents.
--ngoy