Penetration Test Report (National Cybersecurity Assessments and Technical Services (NCATS)): CyHy Sample Report 508C

ASSESSMENT
SUMMARY
Cyber Hygiene Assessment
CYHYNONE NUMBER
April 2, 2018 DATE
Cyber Hygiene Assessment
Sample Organization
Contents
1 How To Use This Report 5
1.1 SAMPLEPointsofContact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Report Card 6
3 Executive Summary 7
4 Sub-Organization Summary 10
5 Methodology 11
5.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
5.2 Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
6 Approximate Host Locations 14
7 Vulnerability Scan Results 15
8 Results Trending 17
9 Conclusion 20
Appendices 21
Appendix A Vulnerability Summary 21
Appendix B Vulnerability Changes Since Last Report 23
B.1 MitigatedVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
B.2 NewVulnerabilitiesDetected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
B.3 Re-Detected(Previously-Mitigated)Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
B.4 Recently-DetectedVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Appendix C Detailed Findings and Recommended Mitigations by Vulnerability 44
Appendix D Critical and High Vulnerability Mitigations by IP Address 69
2 April 2, 2018
Appendix E False Positive Findings 70
E.1 ExpiringSoonFalsePositiveFindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
E.2 AllFalsePositiveFindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Appendix F Frequently Asked Questions 71
Appendix G Attachments 74
Appendix H Glossary and Acronyms 75
List of Figures
1 TopVulnerabilitiesbyOccurrence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2 TopHigh-RiskHosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3 TopRisk-BasedVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4 MedianTimeinDaystoMitigateVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
5 MedianAgeinDaysofActiveVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
6 CriticalVulnerabilityAgeOverTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
7 ActiveCriticalVulnerabilityAge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
8 ApproximateHostLocations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
9 VulnerabilityCountperHost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
10 CVSSHistogramforActiveVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
11 TotalActiveVulnerabilitiesOverTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
12 ActiveCriticalandHighVulnerabilitiesOverTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
13 ActiveMediumandLowVulnerabilitiesOverTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
14 VulnerableHostsOverTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
15 DistinctServicesOverTime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
16 DistinctVulnerabilitiesOverTime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
List of Tables
1 NumberofVulnerabilitiesbySeverityLevel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3 April 2, 2018
2 TopOperatingSystemsDetected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3 TopServicesDetected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
4 ActiveCriticalVulnerabilityAgeSummary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5 NumberofVulnerabilitiesbySeverityLevel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
6 TopVulnerabilitiesbyCommonVulnerabilityScoringSystem(CVSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
7 TopHostsbyWeightedRisk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
8 RiskRatingSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
9 ComparisonwithPreviousReport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4 April 2, 2018
1 How To Use This Report
Welcome to your Cyber Hygiene (CyHy) report. This document aims to be a comprehensive weekly snapshot of known vulnerabilities
detected on Internet-facing hosts for Sample Organization (SAMPLE).
You may wonder what you’re supposed to do with all this information. While it’s not our intent to prescribe to you a particular process for
remediating vulnerabilities, we hope you’ll use this report to strengthen your security posture. Here’s a basic flow:
1. Review the Cyber Hygiene Report Card for a high-level overview. This section gives a quick comparison of the problems we find
week to week. If this is your first report, you should note that the Report Card will initially lack historical data to make comparisons
against, though that data will exist in your next report.
2. See Appendix A: Vulnerability Summary for a list of unique vulnerabilities across all the systems we detect problems with. Appendix C:
Detailed Findings and Recommended Mitigations by Vulnerability provides more information about each vulnerability and all the hosts
that we detect are susceptible to a given vulnerability. You should focus on those vulnerabilities rated with the greatest severity, as
well as those that impact your high-value assets, but don’t ignore the medium or low vulnerabilities. Recognize that a vulnerability’s
rating tends to get worse with time.
3. If this report is not your first, review Appendix B: Vulnerability Changes Since Last Report for a breakdown of all the changes we
detected in your scope in the last week.
4. If you’ve patched a vulnerability since your last report, verify it’s listed here. If it’s not present, there may still be an issue. It may also
be possible that the issue was fixed after our latest scan, which was on April 2, 2018.
5. For additional analysis, see Appendix G: Attachments, which provides Comma-Separated Values (CSV) files for all findings, services,
hosts, and the scope that we scan.
You should be aware that Cyber Hygiene does not scan your entire scope (all of the addresses your organization has sent us) every week,
but does attempt to scan every host each week. For an explanation of how CyHy works, see the Methodology section.
As you review the report, you may have additional questions. Check out the answers we provide in the Frequently Asked Questions section.
If you have any additional questions, email us at ncats@hq.dhs.gov.
1.1 SAMPLE Points of Contact
SAMPLE has defined the following points-of-contact for Cyber Hygiene activities; if present, reports are emailed solely to distribution lists.
If you receive this report through a distribution list, Department of Homeland Security (DHS) requests that you funnel your request through
your technical POC(s).
Type Name Email Address Phone Number
Technical Technical POC 1 tech_poc_1@sample.org[PII_REDACTED]
Technical Technical POC 2 tech_poc_2@s