Subject: [sacm] SACM Vulnerability Assessment Scenario Review

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 17 Nov 2015 14:28:13 +0000

Just to follow up on Adam's request for the WG to review the Vulnerability Assessment Scenario document by November 20th, it would be great to hear any feedback that you may have on the document as well as how well it aligns with the way your organization does vulnerability assessment.

For your convenience, you may find the document here (https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/).

Feel free to provide any feedback over the list.

Thanks,

Danny

---

From: Adam Montville <[email-masked]>
Date: Wed, 18 Nov 2015 07:28:48 -0600

Hi Danny,

I asked some people at CIS who work with various US state, local, and tribal governments in this capacity to review the draft.  They felt that the draft was a fairly accurate representation of vulnerability assessment and had no specific comments. 

When I asked for their review, I specifically asked them to opine as to the accuracy of the draft over its precision - I believe the goal is to depict a generally applicable, rather than exact, scenario.

Kind regards,

Adam

PS: I expect further reviews from within my organization to be forthcoming.

> On Nov 17, 2015, at 8:28 AM, Haynes, Dan <[email-masked]> wrote:
> 
> Just to follow up on Adam’s request for the WG to review the Vulnerability Assessment Scenario document by November 20th, it would be great to hear any feedback that you may have on the document as well as how well it aligns with the way your organization does vulnerability assessment.
>  
> For your convenience, you may find the document here (https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/ <https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/>). 
>  
> _______________________________________________
> sacm mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>

---

From: Sherif Mansour Farag <[email-masked]>
Date: Wed, 18 Nov 2015 13:40:25 +0000

Hi Danny,

I have taken a look at https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/ and I have some feedback.

How do we scan?

We tend to run both credentialed and non-credentialed scans on our internal network ranges, as well as ASV scans for our external network ranges.

For context a credentialed scan is when a vulnerability scanner logs in over WMI/SSH and runs some checks on the box. A non credentialed scans depends on port scanning and a few passive scanning techniques.

The credentialed scans give us more detailed information, while the network scans helps us identify any deltas or discrepancies between the two.

Example, the internal scanner detected 100 systems via port scanning but was only able to log in and check 85 of those systems.

What do we check for ?

Aside from the issues mentioned in the document, with regards to actual checks, we also look for any virtualization on these systems. Are there any docker containers for VMware/Virtualbox guests for example? Additionally if there is a web-application listening on a port we run some light web app tests as well.

?How do we use the reporting?

Ah! this is the tricky bit, its manual at the moment but we look to use an API to automate the process. In general we look for a few things

  *   ?We like CSV/spreadsheets because we could filteri either by a vulnerability across machines OR all issues on one machine.
     *   ?Some sys admins would want to check if their patched "Canary" server has all issues resolved before pushing a fix across the enviroment
     *   Equally some security engineers would want to know which systems are impacted by a specific issue
  *   ?Additionally there are multiple stakeholders for example:
     *   ?Sys Admins patch the version of Java installed on a system, but not before developers can test and confirm their code can work with a later version of Java.
  *   ?We proceed three types of reports per Asset group owners (i.e. the sys admins that would normally patch the boxes).
     *   ?Emergency - Drop everything you are doing and fix all issues in this report.
     *   High - You have less than a month to patch these issues (one of our counterparts has a 24 hour SLA for this).
     *   Medium/Low - You need to fix these issues by the end of the quarter.

The challenge is with containers like docker now, because while the base image has instructions to load the latest updates before building the container, that container might be out in the environment for a while and forgotten, which is why we are looking for a solution that interrogates docker containers for example (https://coreos.com/blog/vulnerability-analysis-for-containers/)

Hope that helps.

Sherif Mansour
Enterprise Information Security
Sr Security Engineer | EIS - Secure Design & Consulting

T + 44 (0) 203 194 5245 |  M + 44 (0) 7860 782936

Expedia.com Ltd - 407 St John St, London EC1V4EX

________________________________
From: sacm <[email-masked]> on behalf of Haynes, Dan <[email-masked]>
Sent: Tuesday, November 17, 2015 2:28 PM
To: [email-masked]
Subject: [sacm] SACM Vulnerability Assessment Scenario Review

Thanks,

Danny