Instructor: Scope Considerations. 2 2
At this point, we understand the basics of scanning, 3 3
but now we need to understand what are some of the things 4 4
that can affect the way we scan. 5 5
Before we do that, let me give you a quick formal definition 6 6
of a vulnerability scanner, 7 7
because we've been talking about that 8 8
in the last couple of lessons 9 9
but we haven't really properly defined it. 10 10
When we talk about a vulnerability scanner, 11 11
this is a hardware appliance or a software application 12 12
that is configured with a list 13 13
of known weaknesses and exploits, 14 14
and can then scan for their presence 15 15
in a host operating system 16 16
or within a particular application. 17 17
You can also scan things like network appliances, 18 18
like firewalls, and routers, and switches. 19 19
All of these can be scanned with a vulnerability scanner. 20 20
Now, web application vulnerability scanners, 21 21
like Nikto will analyze applications 22 22
for SQL injections, cross-site scripting, 23 23
and may even analyze the source code 24 24
and database security 25 25
to detect insecure programming practices. 26 26
Now, in this section of the course, 27 27
and the next section of the course, 28 28
as we're talking about vulnerability scanners, 29 29
I'm not really focused 30 30
on web application vulnerability scanners. 31 31
I'm talking more about 32 32
what we call an infrastructure vulnerability scanner. 33 33
These are things that are going to be testing things, 34 34
like your clients, your workstations, your desktops, 35 35
your servers, not web applications. 36 36
Some of these will have the ability 37 37
to do some web application scanning, 38 38
but we'll focus on web application vulnerability scanners 39 39
in a different lesson in a different section. 40 40
So for now, whenever I say vulnerability scanners, 41 41
I just want you to think 42 42
about a basic vulnerability scanner. 43 43
Now, these basic vulnerability scanners, 44 44
known as infrastructure scanners, 45 45
are going to be able to scan our network. 46 46
These scanners such as this one here, which is Nessus, 47 47
will compile a report for you, 48 48
and classify each identified vulnerability 49 49
with an impact warning. 50 50
Each of these scanners has its own database 51 51
of vulnerabilities, like I said, 52 52
and all of these can then look for those signatures 53 53
to find out what things are out there on your network. 54 54
So if I'm scanning your Macintosh machine, 55 55
and I find that you have 56 56
Mozilla Foundation Unsupported Application Detection, 57 57
this is a critical finding. 58 58
You could see it here in red on the screen. 59 59
There's one count of this, and if I click into that, 60 60
it'll actually tell me what causes this, 61 61
who knows how to exploit it, and what I can do to fix it, 62 62
and that's the benefit 63 63
of having these vulnerabilities scanners. 64 64
They find those vulnerabilities out there, 65 65
and then tell you what you need to do to fix it. 66 66
Now, these infrastructure scanners 67 67
can perform mapping and enumeration 68 68
in the form of a host discovery scan. 69 69
Now, we talked about host discovery scans 70 70
when we talked about things like Nmap, 71 71
where we can go across the network, 72 72
and find out what ports are open, 73 73
and what computers are on our network. 74 74
Well, these infrastructure scanners do this as well, 75 75
it's called a host discovery scan, 76 76
and it is the smallest type of scan that we're going to do 77 77
with a vulnerability scanner. 78 78
The benefit of doing that 79 79
is it first takes a look at your entire network, 80 80
and then you can scope down 81 81
into what you want to do in-depth scanning on. 82 82
That's the real benefit here. 83 83
For example, here on the screen, 84 84
I've conducted a discovery scan 85 85
using the Greenbone Community Edition 86 86
of the OpenVAS Vulnerability Manager. 87 87
This uses the OpenVAS scanning engine, 88 88
and it performed an uncredentialed discovery scan 89 89
that couldn't even identify the OS type 90 90
of each of the hosts, 91 91
but I did identify that there was nine different hosts there 92 92
on the network, 93 93
and they're all in the same layer of the network, 94 94
which is why you just see those nine dots together 95 95
in the middle of my screen. 96 96
Now, as we learn more about vulnerability scanners, 97 97
you'll learn how to configure them better 98 98
to be able to get exactly the information you want 99 99
out of them. 100 100
But this is just to start getting you introduced 101 101
to what these tools look like. 102 102
Now, when we start talking about things like scope, 103 103
I want to make sure you understand what scope is. 104 104
When we talk about scope in a network, 105 105
we're talking about some portion of the network, right? 106 106
So if I said 192.1 68.1.1/24, 107 107
you from your network plus study should know, 108 108
"Oh, that is a scope of network IP addresses of 256 IPs. 109 109
But when we talk about scope 110 110
inside of a vulnerability scanner 111 111
we're really talking about the range of hosts or subnets 112 112
that's going to be included within a single job. 113 113
Now, this can be done using an IP address, 114 114
or an IP address with CIDR notation, 115 115
something like /24 to be able 116 116
to say I want that entire subnet, 117 117
or you can have multiple different subnets, 118 118
or multiple different IPs. 119 119
A lot of these tools will let you import 120 120
a list of IP addresses as a CSV file, 121 121
and so I can have the 50 IPs that I really care about, 122 122
and they could be across all sorts of different subnets. 123 123
That's okay too. 124 124
When we're talking about scope here, 125 125
we're just talking about this grouping of computers or hosts 126 126
that we want to look at using our tool. 127 127
Now, it's important for us to adjust the scope 128 128
to make our scanning more efficient, 129 129
and there's lots of ways to do this. 130 130
For example, one of the things we can do 131 131
is we can schedule scans on different portions of the scope 132 132
for different times of the day. 133 133
One of the reasons we want to do this 134 134
is if we scan everything all at once, 135 135
we can overload our network. 136 136
We're causing network traffic to be used, 137 137
we're causing CPU and memory to be used on the host 138 138
that we're scanning and responding to all of our queries. 139 139
So we don't want to scan everything all at the same time. 140 140
So by breaking things into scopes, 141 141
we can scan at different times a day 142 142
for different environments. 143 143
For example, I might say I'm going to scan 144 144
the Accounting Department overnight, 145 145
because nobody works after five o'clock in Accounting 146 146
so that's not going to affect their daily business. 147 147
Or I may want to defer scanning my web servers 148 148
in the middle of the Christmas holiday, 149 149
because I'm an e-commerce store, 150 150
and I'm doing a lot of business at that time, 151 151
and so I'll wait till after the holiday to do that. 152 152
There might be some risk that I'm assuming there, 153 153
but it is one of the ways you can schedule your scans 154 154
to figure out which portions of the network 155 155
should be scanned at which time, 156 156
some of them will be done at different times of the day 157 157
or even on different days 158 158
based on how you need to break up your network. 159 159
The second thing we want to think about 160 160
is how are you going to configure your scope 161 161
based on a particular compliance objective? 162 162
For example, if you're trying to be compliant 163 163
with PCI DSS that has to do with payment card data, 164 164
do you need to scan the video editor's computer 165 165
to make sure it's in compliance with PCI DSS? 166 166
Well, no, because they're probably not dealing 167 167
with any kind of credit card data, 168 168
but you may need to do that for Bookkeeping or Accounting, 169 169
or the web server, or the e-commerce server, 170 170
or the e-commerce database 171 171
'cause all of those things may touch that credit card data, 172 172
in which case they would have to be part of that scope, 173 173
and that compliance scan. 174 174
So we can have a particular scan set 175 175
for just PCI DSS assets, 176 176
and those are the 10 or 15 computers across our organization 177 177
that touch credit card data. 178 178
The third thing we want to consider 179 179
is how we can re-scan scopes 180 180
containing critical assets more often. 181 181
Now, what I mean by this is I might have a scope 182 182
of my web servers that are sitting in the DMZ. 183 183
Because they're in the DMZ, 184 184
they're more vulnerable to attack 185 185
than something that was inside my internal network. 186 186
So I may want to scan those every week 187 187
where I only do my internal network once a month. 188 188
Again, these are just numbers I'm making up, 189 189
and you as an organization get to decide 190 190
what the right frequency is for you. 191 191
But if you have something that's more critical, 192 192
you probably want to scan it more often. 193 193
Now, the other thing we have to look at 194 194
when we start looking at these scopes and scanning 195 195
is how are we going to scan them? 196 196
Are we going to do this as an internal scan, 197 197
or an external scan? 198 198
Now, if I'm dealing with internal scanning, 199 199
this is where a vulnerability scan 200 200
is being conducted on your local network 201 201
from within your local network. 202 202
Now, the real benefit here 203 203
is you're going to be able to scan things 204 204
without having to go through the firewall, 205 205
because you're inside the local network already. 206 206
Now, if you're doing things externally 207 207
using an external scan 208 208
this is a vulnerability scan that's being conducted 209 209
against your network from outside 210 210
of your local area network. 211 211
Therefore, it's going to be coming in through the firewall. 212 212
Now, when you do internal scanning, 213 213
you can actually do this with permissions 214 214
called credentialed scans, 215 215
and this will give you additional details 216 216
on the vulnerabilities that exist, 217 217
because essentially you're already behind the firewall, 218 218
you're already talking directly to those clients, 219 219
and now you're logging into them 220 220
using an administrator password. 221 221
That's going to give you a lot more detail 222 222
than if you were an attacker coming in from the outside. 223 223
So why wouldn't we use an internal scan for everything? 224 224
Well, because an internal scan 225 225
is going to give you a laundry list of vulnerabilities, 226 226
but not all of them are true vulnerabilities 227 227
that could be exploited by an attacker. 228 228
So instead, if you want to get an attacker's perspective 229 229
you really have to do external scanning. 230 230
By performing this, 231 231
you're going to be able to get the attacker's perspective, 232 232
because you're coming in through the firewall. 233 233
Now, you're going to see a lot less vulnerabilities this way, 234 234
because a lot of things are going to be blocked 235 235
by the firewall. 236 236
But again, it's good to have both perspectives, 237 237
internal scans and external scans, 238 238
and you're going to have to figure that out 239 239
as you start doing this in the real world 240 240
and how you're deciding which scopes to use, 241 241
and from which perspective you want to scan.