# Presentation: 830407

## Commercially Available StillSecure Vulnerability Assessment & Management (VAM) Tool For Assessing Technical Controls

**PCIE IT Roundtable **
**FISMA Workshop **
**on**** Best Practices**

**GSA-OIG**
**Information Technology Audit Office (JA-T)**
**February 2, 2004**

##  Key To Success - Teamwork

** ****JA-T FISMA Team**
-  Gwendolyn McGowan, RIGA
-  Larry Bateman, Audit Manager
-  Khalid Hasan, Auditor-in-Charge
-  Kathy Zheng, IT Auditor
** ****Other Major Players**
-  OIG Management
-  OIG Information Technology Support Division
-  Rich Gee, Senior IT Specialist
-  GSA System Administrators
-  GSA Information Systems Security Officers/Managers
-  StillSecure VAM Assistance
-  Dennis Vich, Acela Technologies, Inc.

## Assessing Vulnerabilities With Technical Controls

-  What is VAM &  How Did we Apply It In Support of Our 2003 FISMA Review?
-  Benefits Achieved & Lessons Learned.

**Assessing Vulnerabilities With Technical Controls**

## Why We’ve Incorporated Vulnerability Scanning Into our FISMA Reviews 

** ****FISMA Requires:**
-  Agencies to Periodically Test & Evaluate Information Security Controls
-  Annual Independent Evaluations (OIG Reviews) to Test the Effectiveness of Information Security Policies and Practices
-  Testing of a Subset of Information Systems
** **Some Vulnerability Scanning Conducted by GSA System Owners & CIO
- Current Vulnerability Scanning Results Needed to Strengthen our Assessment of the Effectiveness of Information Security Policies and Practices

## Why Scan for Vulnerabilities?

- Security Incidents Up Over 400%
- Majority of Incidents Take Advantage of Known Vulnerabilities
- Assessing Processes for Vulnerability Scanning & Remediation Has Become Critical

**GISRA**

**FISMA**

**Source on Reported Security Incidents:  http://www.cert.org/stats/cert_stats.html**

## What Led Us to Select VAM?

- Initially Developed RFP Where Contractor Was to:
_**Propose**_** **Vulnerability Scanning Techniques and Procedures
_**Perform**_ Vulnerability Scanning on Select Systems
_**Issue**_ a Report on the Vulnerabilities Assessed, Results of Vulnerability Assessments, Effects of the Vulnerabilities, and Recommendations.
- No Responses to RFP Due to Extent of Work and Fixed Price.
- Time for Plan B...

## What Led Us to Select VAM?

- OIG Technical Support Division Utilizing VAM For Internal Systems Administration.
- Recognition of Potential Audit Use to Assist With  FISMA Requirements.
- Purchased VAM and Trained Audit Staff for Less Than $10,000.
- VAM has Enabled Auditors to Assess Technical Controls More Completely.
- Provides Prompt Results
- Success With VAM Required a “Champion” to Pave the Way for Applying the New Tool.

## What is VAM?

- VAM Identifies, Tracks, and Manages the Repair of Network Security Vulnerabilities
- Consists of Three Modules:
**Server VAM** – Scanning Servers, Routers, Switches, and Other Network Infrastructure Devices **INSIDE THE FIREWALL**
**2.****	****Desktop VAM** – Scanning Desktops, Laptops, and Printers
**3.****	****Remote VAM** – Performs External Penetration Tests on Internet Visible Devices

## The VAM Process

- 1. Map

- 2. Scan

- 3. Repair

- 4. Report

**Audit**

**ISSM/ISSO**

## Vulnerabilities VAM Scans For

- SANS/FBI Top 20
- VAM’s Intelliscan Feature:
- Automatically Determines What Scans to Perform Based on
- Device Types
- Operating System
- Services
- Ports
- Installed Devices
- Intrusive vs. Non-Intrusive Scans

## How We Used VAM for FISMA

- Performed Vulnerability Scanning on Four Select Systems.
- Compared Scan Results Against System Security Documentation and Other Tests and Evaluations.
- Prepared System Specific Reports for ISSMs/ISSOs.

## How We Used VAM for FISMA

- Used Scan Results to Help Support Findings Related to:
- Implementation of the Agency’s IT Security Program
- Development & Maintenance of Comprehensive POA&Ms

## Commercially Available Vulnerability Scanning Tools 

| Tool | Vendor | Linux/UNIX | Win32 |
| --- | --- | --- | --- |
| VAM | STillSecure
stillsecure.com |  |  |
| CyberCop Scanner | Network Associates
nai.com |  |  |
| ISS Internet Scanner | Internet Security Systems (iss.net) |  |  |
| Secure Scan NX | Vigilante
Vigilante.com/securescan |  |  |
| Saint | Saint Corporation
(saintcorporation.com) |  |  |

## Freeware Vulnerability Scanning Tools 

| Tool | Website | Linux/UNIX | Win32 |
| --- | --- | --- | --- |
| Nessus | Nessus.org |  |  |
| SARA  | www-arc.com/sara |  |  |
| SATAN | Fish.com/satan |  |  |

**Source:  NIST SP 800-53**

## Software Overview

## Overall Benefits with VAM

- Enables IT Auditors to Perform Independent Vulnerability Assessments of Technical Controls.
- Helps Build Working Relationships with System Administrators and Security Officials.
- Assisted us in Evaluating GSA’s POA&M Process.
- Less Than $10,000 Invested in Software and Training.
- Performed Non-Intrusive Scans of GSA’s Largest Systems in a Few Hours.
- Vulnerability Scanning Rules are Updated Automatically.

## Lessons Learned with VAM

**Need for “Rules of Engagement” **
- Communication is Key!
- How?
- Monitored Vs. Automated Scans
- Non-intrusive Vs. Intrusive
- When?
- Opening the Firewall to Our IP Address
- Non-Business Hours
**Review Results With System Security Officials**
- Provide VAM Reports in Advance
- Compare VAM Reports to POA&M & Prior Scan Results
- Discuss Potential Vulnerabilities to Identify False Positives

## Contact InformationJA-T (703) 308-1223

**Gwendolyn McGowan**
- _[Gwen.Mcgowan@gsa.gov](mailto:Gwen.Mcgowan@gsa.gov)_
**Larry Bateman**
- _[Larry.Bateman@gsa.gov](mailto:Larry.Bateman@gsa.gov)__  _
**Khalid Hasan**
- _[Khalid.Hasan@gsa.gov](mailto:Khalid.Hasan@gsa.gov)_
**Rich Gee **
- _[Richi.Gee@gsa.gov](mailto:Richi.Gee@gsa.gov)_
**Dennis Vich**
- Acela Technologies
- _[Dvich@acelatechnologies.com](mailto:Dvich@acelatechnologies.com)__  _