This chapter is from the book
This chapter is from the book
This chapter is from the book
Vulnerability Scans
Vulnerability management teams often use other tools such as vulnerability scanners and software composition analysis (SCA) tools. Figure 7-4 illustrates how a typical automated vulnerability scanner works.
)
FIGURE 7-4 Coordinated Vulnerability Disclosures
The following are the steps illustrated in Figure 7-4. Keep in mind that vulnerability scanners are all different, but most follow a process like this:
-
In the discovery phase, the scanner uses a tool such as Nmap to perform host and port enumeration. Using the results of the host and port enumeration, the scanner begins to probe open ports for more information.
-
When the scanner has enough information about the open port to determine what software and version are running on that port, it records that information in a database for further analysis. The scanner can use various methods to make this determination, including banner information.
-
The scanner tries to determine if the software that is listening on the target system is susceptible to any known vulnerabilities. It does this by correlating a database of known vulnerabilities against the information recorded in the database about the target services.
-
The scanner produces a report on what it suspects could be vulnerable. Keep in mind that these results are often false positives and need to be validated.
One of the main challenges with automated vulnerability scanners is the number of false positives and false negatives. False positive is a broad term that describes a situation in which a security device triggers an alarm, but no malicious activity or actual attack is taking place. In other words, false positives are false alarms, and they are also called benign triggers. False positives are problematic because by triggering unjustified alerts, they diminish the value and urgency of real alerts. Having too many false positives to investigate becomes an operational nightmare, and you most definitely will overlook real security events.
There are also false negatives, which is the term used to describe a network intrusion device’s inability to detect true security events under certain circumstances—in other words, a malicious activity that is not detected by the security device.
A true positive is a successful identification of a security attack or a malicious event. A true negative occurs when the intrusion detection device identifies an activity as acceptable behavior and the activity is actually acceptable.
There are also different types of vulnerability scanners:
Application scanners: Used to assess application-specific vulnerabilities and operate at the upper layers of the OSI model
Web application scanners: Used to assess web applications and web services (such as APIs)
Network and port scanners: Used to determine what TCP or UDP ports are open on the target system
Credentialed vs. Noncredentialed
To reduce the number of false positives, some vulnerability scanners have the capability to log in to a system to perform additional tests and see what programs, applications, and open-source software may be running on a targeted system. These scanners can also review logs on the target system. They can also perform configuration reviews to determine if a system may be configured in an unsecure way.
Intrusive vs. Nonintrusive
Vulnerability scanners sometimes can send numerous IP packets at a very fast pace (intrusive) to the target system. These IP packets can potentially cause negative effects and even crash the application or system. Some scanners can be configured in such a way that you can throttle the probes and IP packets that it sends to the target system in order to be nonintrusive and to not cause any negative effects in the system.
Common Vulnerability Scoring System (CVSS)
The Common Vulnerability Scoring System (or CVSS) is an industry standard used to convey information about the severity of vulnerabilities. In CVSS, a vulnerability is evaluated under three aspects, and a score is assigned to each of them. These three aspects (or groups) are the base, temporal, and environmental groups.
The base group represents the intrinsic characteristics of a vulnerability that are constant over time and do not depend on a user-specific environment. This is the most important information and the only mandatory information to obtain for a vulnerability score.
The temporal group assesses the vulnerability as it changes over time.
The environmental group represents the characteristic of a vulnerability taking into account the organization’s environment.
The CVSS score is obtained by taking into account the base, temporal, and environmental group information. The score for the base group is between 0 and 10, where 0 is the least severe and 10 is assigned to highly critical vulnerabilities (for example, for vulnerabilities that could allow an attacker to remotely compromise a system and get full control). Additionally, the score comes in the form of a vector string that identifies each of the components used to make up the score. The formula used to obtain the score takes into account various characteristics of the vulnerability and how the attacker is able to leverage these characteristics. CVSS defines several characteristics for the base, temporal, and environmental groups.
The base group defines exploitability metrics that measure how the vulnerability can be exploited, and impact metrics that measure the impact on confidentiality, integrity, and availability. In addition to these two, a metric called scope change (S) is used to convey the impact on systems that are affected by the vulnerability but do not contain vulnerable code.
Exploitability metrics include the following:
Attack Vector (AV): Represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values:
Network (N)
Adjacent (A)
Local (L)
Physical (P)
Attack Complexity (AC): Represents the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. The values can be one of the following:
Low (L)
High (H)
Privileges Required (PR): Represents the level of privileges an attacker must have to exploit the vulnerability. The values are as follows:
None (N)
Low (L)
High (H)
User Interaction (UI): Captures whether user interaction is needed to perform an attack. The values are as follows:
None (N)
Required (R)
Scope (S): Captures the impact on systems other than the system being scored. The values are as follows:
Unchanged (U)
Changed (C)
The Impact metrics include the following:
Confidentiality Impact (C): Measures the degree of impact to the confidentiality of the system. It can assume the following values:
Low (L)
Medium (M)
High (H)
Integrity Impact (I): Measures the degree of impact to the integrity of the system. It can assume the following values:
Low (L)
Medium (M)
High (H)
Availability Impact (A): Measures the degree of impact to the availability of the system. It can assume the following values:
Low (L)
Medium (M)
High (H)
The temporal group includes three metrics:
Exploit code maturity (E): Measures whether or not public exploits are available
Remediation Level (RL): Indicates whether a fix or workaround is available
Report Confidence (RC): Indicates the degree of confidence in the existence of the vulnerability
The environmental group includes two main metrics:
Security Requirements (CR, IR, AR): Indicate the importance of confidentiality, integrity, and availability requirements for the system
Modified Base Metrics (MAV, MAC, MAPR, MUI, MS, MC, MI, MA): Allow the organization to tweak the base metrics based on specific characteristics of the environment
For example, a vulnerability that could allow a remote attacker to crash the system by sending crafted IP packets would have the following values for the base metrics:
Access Vector (AV) would be Network because the attacker can be anywhere and can send packets remotely.
Attack Complexity (AC) would be Low because it is trivial to generate malformed IP packets.
Privilege Required (PR) would be None because no privileges are required by the attacker on the target system.
User Interaction (UI) would also be None because the attacker does not need to interact with any user of the system in order to carry out the attack.
Scope (S) would be Unchanged if the attack does not cause other systems to fail.
Confidentiality Impact (C) would be None because the primary impact is on the availability of the system.
Integrity Impact (I) would be None because the primary impact is on the availability of the system.
Availability Impact (A) would be High because the device becomes completely unavailable while crashing and reloading.
CVSS also defines a mapping between a CVSS Base Score quantitative value and a qualitative score. Table 7-2 provides the qualitative-to-quantitative score mapping.
Table 7-2 Qualitative-to-Quantitative Score Mapping
Rating |
CVSS Base Score |
|---|---|
None |
0.0 |
Low |
0.1–3.9 |
Medium |
4.0–6.9 |
High |
7.0–8.9 |
Critical |
9.0–10.0 |