# Presentation: 109834

## PNNL Vulnerability Scanning

- Integrating Contiguous Scanning While Maintaining a
- Comprehensive Program
- Presented by Vahid Hackler at NLIT 2007
- Unclassified Cyber Security (UCS)
- Pacific Northwest National Laboratory

## Agenda

- Program Objective
- Vulnerabilities Focus
- Tools
- Detection and Follow-Through
- Scanning Timetable
- Remediation
- Metrics
- Lessons Learned

## PNNL Network Environment

- Approx. 8,500 networked systems
- Windows operating system
- Server, XP, and 2000
- UNIX including Linux
- Redhat, Solaris, IRIX, Suse, and Ubuntu
- Macintosh
- Network printers and other operating systems

## Program Objective

- Provide comprehensive and effective vulnerability and configuration management in a heterogeneous environment...
- Managed and unmanaged systems
- Dispersed workforce environment
- Constant patch releases from various sources
- Users with administrative privileges
-     ...with minimal impact to staff productivity

## Vulnerabilities Focus

- Critical, High, and Medium
- Variety of operating systems and platforms
- Wide array of user and organizational deployed applications
- Configuration Management
- Clear text protocols such as telnet, ftp, rlogin, and xdcmp
- Inherently vulnerable protocols such as SSHv1, SNMP, and SMTP
- Unused services such as chargen, finger, echo, daytime, discard, and systat

## Today’s Tools

- Vulnerability Program Management System
- Managed system providing scheduled scans
- Ticketing system
- Foundstone Enterprise Management System
- Verification Scanner
- Accurate
- Common, reputable auditing tool
- Nessus
- Password Cracker
- L0phtcrack

## Scanning TimetableIssues for Consideration

- Benefits of multiple types of scans
- Finite network bandwidth capacity
- Identify most critical issues quickly
- Strategic remediation of enterprise wide issues

## Scanning Timetable

| 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| --- | --- | --- | --- | --- | --- | --- |
| 8 | 9 | 10 | 11 | 12 | 13 | 14 |
| 15 | 16 | 17 | 18 | 19 | 20 | 21 |
| 22 | 23 | 24 | 25 | 26 | 27 | 28 |
| 29 | 30 | 31 |  |  |  |  |

- Patch Tuesday
- Monthly
- Authenticated Scan
- Local Admin Password Scan
- Weekly
- Non-authenticated Scan
- Contiguously
- Top 20 Scan
- Targeted Scans (project scans)
- Used when tackling new issues (e.g. Symantec LiveUpdate vulnerability)

## Monthly Authenticated Scan

- Acts as independent patch deployment verification
- Utilized for strategic remediation
- Conducted using Vulnerability Program Management System

## Monthly Local Admin Password Scan

- Identify 10 to 15 of the most commonly guessed passwords
- Performed after authenticated scans
- Passwords identified as weak are changed through a separate, automated process
- Uses homegrown plug-in for Verification Scanner

## Weekly Non-Authenticated Scan

- All non-authenticated checks
- Used to determine checks for the contiguous “Top 20” scans
- Remediation completed on all issues identified
- Uses a combination of the Vulnerability Program Management and Verification Scanner systems

## Contiguous Top 20 Scan

- FBI/SANS recommendations
- PNNL previous vulnerability issues
- All issues identified are corrected on an individual basis by PNNL Help Desk

## Targeted Scans

- Used to further assess specific issues identified in routine scans
- Performed as needed or requested by management
- Results dealt with as required

## Remediation A Team Effort

- Unclassified Cyber Security (UCS)
- Scan and identify issues to be resolved
- Desktop and Hosting Services
- Implement strategic and large scale vulnerability remediation
- User Support Services
- Remediate isolated issues

*User Support Services*

*Unclassified Cyber Security*

*Desktop and Hosting Services*

## Remediation After the Scan

- Authenticated scans
- Issues identified are passed via metric reports to Desktop and Hosting Services
- Non-authenticated scans
- Vulnerabilities are treated as isolated issues and passed to User Support Services for remediation
- All remediation actions are reported to UCS
- Effectiveness measured by follow-up scans

## Measuring Success:Issues to Consider

- Keep it simple
- Track number of vulnerabilities on the network
- Keep it readable
- Show the key issues and trends
- Provide data for management action
- Keep it consistent
- Give a clear picture that tells the story as it was told before

## The Vulnerability Scanning Report

- General Discussion
- Narrative of authenticated and non-authenticated scan issues
- Scanning System Health
- Uptime, performance
- Password Scan Summary
- Non-Authenticated Vulnerabilities
- High and Medium
- Authenticated Vulnerabilities
- High and Medium

## Vulnerability Scanning Report – cont.

- Top Ten
- High Vulnerabilities
- Medium Vulnerabilities
- Worst Systems
- Number of Non-authenticated Vulnerabilities per Operating System
- Watch for non-managed operating system issues

## Lessons Learned

- Increase Efforts to Fix Root Causes
- Bring more systems under managed umbrella
- Ensure system management tools are working
- Provide Realistic and Meaningful Reports
- Build metrics that management can act upon
- Integrate Asset and Vulnerability Management
- Vulnerability tracking system feeds and gets information to/from other systems such as Help Desk incident ticketing system
- Vulnerability tracking system that utilizes multiple scanning technologies through integrated management tool

## Questions and Contact

- _[vahid.hackler@pnl.gov](mailto:vahid.hackler@pnl.gov)_
- 509-372-6721