1 1 00:00:00,330 --> 00:00:02,820 Scope Considerations. 2 2 00:00:02,820 --> 00:00:05,790 At this point, we understand the basics of scanning, 3 3 00:00:05,790 --> 00:00:08,400 but now we need to understand what are some of the things 4 4 00:00:08,400 --> 00:00:10,143 that can affect the way we scan. 5 5 00:00:11,112 --> 00:00:13,290 Before we do that, let me give you a quick formal definition 6 6 00:00:13,290 --> 00:00:14,850 of a vulnerability scanner, 7 7 00:00:14,850 --> 00:00:15,930 because we've been talking about that 8 8 00:00:15,930 --> 00:00:16,890 in the last couple of lessons 9 9 00:00:16,890 --> 00:00:19,260 but we haven't really properly defined it. 10 10 00:00:19,260 --> 00:00:21,450 When we talk about a vulnerability scanner, 11 11 00:00:21,450 --> 00:00:24,360 this is a hardware appliance or a software application 12 12 00:00:24,360 --> 00:00:25,500 that is configured with a list 13 13 00:00:25,500 --> 00:00:27,660 of known weaknesses and exploits, 14 14 00:00:27,660 --> 00:00:29,400 and can then scan for their presence 15 15 00:00:29,400 --> 00:00:30,810 in a host operating system 16 16 00:00:30,810 --> 00:00:33,270 or within a particular application. 17 17 00:00:33,270 --> 00:00:35,430 You can also scan things like network appliances, 18 18 00:00:35,430 --> 00:00:37,890 like firewalls, and routers, and switches. 19 19 00:00:37,890 --> 00:00:41,190 All of these can be scanned with a vulnerability scanner. 20 20 00:00:41,190 --> 00:00:43,590 Now, web application vulnerability scanners, 21 21 00:00:43,590 --> 00:00:45,840 like Nikto will analyze applications 22 22 00:00:45,840 --> 00:00:48,450 for SQL injections, cross-site scripting, 23 23 00:00:48,450 --> 00:00:50,490 and may even analyze the source code 24 24 00:00:50,490 --> 00:00:51,780 and database security 25 25 00:00:51,780 --> 00:00:54,330 to detect insecure programming practices. 26 26 00:00:54,330 --> 00:00:55,830 Now, in this section of the course, 27 27 00:00:55,830 --> 00:00:57,270 and the next section of the course, 28 28 00:00:57,270 --> 00:00:59,310 as we're talking about vulnerability scanners, 29 29 00:00:59,310 --> 00:01:00,450 I'm not really focused 30 30 00:01:00,450 --> 00:01:02,850 on web application vulnerability scanners. 31 31 00:01:02,850 --> 00:01:03,930 I'm talking more about 32 32 00:01:03,930 --> 00:01:06,810 what we call an infrastructure vulnerability scanner. 33 33 00:01:06,810 --> 00:01:08,370 These are things that are going to be testing things, 34 34 00:01:08,370 --> 00:01:11,250 like your clients, your workstations, your desktops, 35 35 00:01:11,250 --> 00:01:14,040 your servers, not web applications. 36 36 00:01:14,040 --> 00:01:15,480 Some of these will have the ability 37 37 00:01:15,480 --> 00:01:17,610 to do some web application scanning, 38 38 00:01:17,610 --> 00:01:20,280 but we'll focus on web application vulnerability scanners 39 39 00:01:20,280 --> 00:01:22,650 in a different lesson in a different section. 40 40 00:01:22,650 --> 00:01:24,870 So for now, whenever I say vulnerability scanners, 41 41 00:01:24,870 --> 00:01:25,703 I just want you to think 42 42 00:01:25,703 --> 00:01:27,870 about a basic vulnerability scanner. 43 43 00:01:27,870 --> 00:01:29,640 Now, these basic vulnerability scanners, 44 44 00:01:29,640 --> 00:01:31,350 known as infrastructure scanners, 45 45 00:01:31,350 --> 00:01:33,510 are going to be able to scan our network. 46 46 00:01:33,510 --> 00:01:36,150 These scanners such as this one here, which is Nessus, 47 47 00:01:36,150 --> 00:01:37,410 will compile a report for you, 48 48 00:01:37,410 --> 00:01:39,720 and classify each identified vulnerability 49 49 00:01:39,720 --> 00:01:41,100 with an impact warning. 50 50 00:01:41,100 --> 00:01:42,990 Each of these scanners has its own database 51 51 00:01:42,990 --> 00:01:44,700 of vulnerabilities, like I said, 52 52 00:01:44,700 --> 00:01:47,160 and all of these can then look for those signatures 53 53 00:01:47,160 --> 00:01:50,010 to find out what things are out there on your network. 54 54 00:01:50,010 --> 00:01:52,110 So if I'm scanning your Macintosh machine, 55 55 00:01:52,110 --> 00:01:53,854 and I find that you have 56 56 00:01:53,854 --> 00:01:56,310 Mozilla Foundation Unsupported Application Detection, 57 57 00:01:56,310 --> 00:01:57,450 this is a critical finding. 58 58 00:01:57,450 --> 00:01:59,220 You could see it here in red on the screen. 59 59 00:01:59,220 --> 00:02:01,590 There's one count of this, and if I click into that, 60 60 00:02:01,590 --> 00:02:04,170 it'll actually tell me what causes this, 61 61 00:02:04,170 --> 00:02:07,020 who knows how to exploit it, and what I can do to fix it, 62 62 00:02:07,020 --> 00:02:07,890 and that's the benefit 63 63 00:02:07,890 --> 00:02:09,630 of having these vulnerabilities scanners. 64 64 00:02:09,630 --> 00:02:11,490 They find those vulnerabilities out there, 65 65 00:02:11,490 --> 00:02:13,980 and then tell you what you need to do to fix it. 66 66 00:02:13,980 --> 00:02:15,510 Now, these infrastructure scanners 67 67 00:02:15,510 --> 00:02:17,640 can perform mapping and enumeration 68 68 00:02:17,640 --> 00:02:19,920 in the form of a host discovery scan. 69 69 00:02:19,920 --> 00:02:21,600 Now, we talked about host discovery scans 70 70 00:02:21,600 --> 00:02:23,430 when we talked about things like Nmap, 71 71 00:02:23,430 --> 00:02:24,630 where we can go across the network, 72 72 00:02:24,630 --> 00:02:26,040 and find out what ports are open, 73 73 00:02:26,040 --> 00:02:27,960 and what computers are on our network. 74 74 00:02:27,960 --> 00:02:30,510 Well, these infrastructure scanners do this as well, 75 75 00:02:30,510 --> 00:02:32,220 it's called a host discovery scan, 76 76 00:02:32,220 --> 00:02:34,500 and it is the smallest type of scan that we're going to do 77 77 00:02:34,500 --> 00:02:36,270 with a vulnerability scanner. 78 78 00:02:36,270 --> 00:02:37,200 The benefit of doing that 79 79 00:02:37,200 --> 00:02:39,480 is it first takes a look at your entire network, 80 80 00:02:39,480 --> 00:02:41,010 and then you can scope down 81 81 00:02:41,010 --> 00:02:43,500 into what you want to do in-depth scanning on. 82 82 00:02:43,500 --> 00:02:44,970 That's the real benefit here. 83 83 00:02:44,970 --> 00:02:46,500 For example, here on the screen, 84 84 00:02:46,500 --> 00:02:48,240 I've conducted a discovery scan 85 85 00:02:48,240 --> 00:02:50,190 using the Greenbone Community Edition 86 86 00:02:50,190 --> 00:02:52,440 of the OpenVAS Vulnerability Manager. 87 87 00:02:52,440 --> 00:02:54,450 This uses the OpenVAS scanning engine, 88 88 00:02:54,450 --> 00:02:57,120 and it performed an uncredentialed discovery scan 89 89 00:02:57,120 --> 00:02:59,010 that couldn't even identify the OS type 90 90 00:02:59,010 --> 00:03:00,120 of each of the hosts, 91 91 00:03:00,120 --> 00:03:03,180 but I did identify that there was nine different hosts there 92 92 00:03:03,180 --> 00:03:04,020 on the network, 93 93 00:03:04,020 --> 00:03:06,180 and they're all in the same layer of the network, 94 94 00:03:06,180 --> 00:03:08,040 which is why you just see those nine dots together 95 95 00:03:08,040 --> 00:03:10,202 in the middle of my screen. 96 96 00:03:10,202 --> 00:03:11,460 Now, as we learn more about vulnerability scanners, 97 97 00:03:11,460 --> 00:03:13,350 you'll learn how to configure them better 98 98 00:03:13,350 --> 00:03:15,150 to be able to get exactly the information you want 99 99 00:03:15,150 --> 00:03:15,983 out of them. 100 100 00:03:15,983 --> 00:03:17,370 But this is just to start getting you introduced 101 101 00:03:17,370 --> 00:03:19,590 to what these tools look like. 102 102 00:03:19,590 --> 00:03:22,744 Now, when we start talking about things like scope, 103 103 00:03:22,744 --> 00:03:24,720 I want to make sure you understand what scope is. 104 104 00:03:24,720 --> 00:03:26,160 When we talk about scope in a network, 105 105 00:03:26,160 --> 00:03:28,380 we're talking about some portion of the network, right? 106 106 00:03:28,380 --> 00:03:33,380 So if I said 192.1 68.1.1/24, 107 107 00:03:34,020 --> 00:03:35,677 you from your network plus study should know, 108 108 00:03:35,677 --> 00:03:40,677 "Oh, that is a scope of network IP addresses of 256 IPs. 109 109 00:03:41,070 --> 00:03:42,330 But when we talk about scope 110 110 00:03:42,330 --> 00:03:44,490 inside of a vulnerability scanner 111 111 00:03:44,490 --> 00:03:46,770 we're really talking about the range of hosts or subnets 112 112 00:03:46,770 --> 00:03:49,020 that's going to be included within a single job. 113 113 00:03:49,866 --> 00:03:51,240 Now, this can be done using an IP address, 114 114 00:03:51,240 --> 00:03:53,340 or an IP address with CIDR notation, 115 115 00:03:53,340 --> 00:03:55,130 something like /24 to be able 116 116 00:03:55,130 --> 00:03:57,150 to say I want that entire subnet, 117 117 00:03:57,150 --> 00:03:59,190 or you can have multiple different subnets, 118 118 00:03:59,190 --> 00:04:00,990 or multiple different IPs. 119 119 00:04:00,990 --> 00:04:02,880 A lot of these tools will let you import 120 120 00:04:02,880 --> 00:04:05,430 a list of IP addresses as a CSV file, 121 121 00:04:05,430 --> 00:04:07,860 and so I can have the 50 IPs that I really care about, 122 122 00:04:07,860 --> 00:04:10,320 and they could be across all sorts of different subnets. 123 123 00:04:10,320 --> 00:04:11,640 That's okay too. 124 124 00:04:11,640 --> 00:04:12,780 When we're talking about scope here, 125 125 00:04:12,780 --> 00:04:16,050 we're just talking about this grouping of computers or hosts 126 126 00:04:16,050 --> 00:04:18,630 that we want to look at using our tool. 127 127 00:04:18,630 --> 00:04:20,790 Now, it's important for us to adjust the scope 128 128 00:04:20,790 --> 00:04:22,650 to make our scanning more efficient, 129 129 00:04:22,650 --> 00:04:24,870 and there's lots of ways to do this. 130 130 00:04:24,870 --> 00:04:26,820 For example, one of the things we can do 131 131 00:04:26,820 --> 00:04:29,850 is we can schedule scans on different portions of the scope 132 132 00:04:29,850 --> 00:04:31,650 for different times of the day. 133 133 00:04:31,650 --> 00:04:32,970 One of the reasons we want to do this 134 134 00:04:32,970 --> 00:04:35,190 is if we scan everything all at once, 135 135 00:04:35,190 --> 00:04:36,570 we can overload our network. 136 136 00:04:36,570 --> 00:04:38,580 We're causing network traffic to be used, 137 137 00:04:38,580 --> 00:04:41,280 we're causing CPU and memory to be used on the host 138 138 00:04:41,280 --> 00:04:43,500 that we're scanning and responding to all of our queries. 139 139 00:04:43,500 --> 00:04:46,530 So we don't want to scan everything all at the same time. 140 140 00:04:46,530 --> 00:04:48,690 So by breaking things into scopes, 141 141 00:04:48,690 --> 00:04:50,430 we can scan at different times a day 142 142 00:04:50,430 --> 00:04:52,442 for different environments. 143 143 00:04:52,442 --> 00:04:53,700 For example, I might say I'm going to scan 144 144 00:04:53,700 --> 00:04:55,200 the Accounting Department overnight, 145 145 00:04:55,200 --> 00:04:57,510 because nobody works after five o'clock in Accounting 146 146 00:04:57,510 --> 00:04:59,910 so that's not going to affect their daily business. 147 147 00:04:59,910 --> 00:05:02,400 Or I may want to defer scanning my web servers 148 148 00:05:02,400 --> 00:05:04,050 in the middle of the Christmas holiday, 149 149 00:05:04,050 --> 00:05:05,160 because I'm an e-commerce store, 150 150 00:05:05,160 --> 00:05:07,050 and I'm doing a lot of business at that time, 151 151 00:05:07,050 --> 00:05:09,210 and so I'll wait till after the holiday to do that. 152 152 00:05:09,210 --> 00:05:10,980 There might be some risk that I'm assuming there, 153 153 00:05:10,980 --> 00:05:12,780 but it is one of the ways you can schedule your scans 154 154 00:05:12,780 --> 00:05:14,820 to figure out which portions of the network 155 155 00:05:14,820 --> 00:05:16,770 should be scanned at which time, 156 156 00:05:16,770 --> 00:05:18,420 some of them will be done at different times of the day 157 157 00:05:18,420 --> 00:05:20,160 or even on different days 158 158 00:05:20,160 --> 00:05:22,410 based on how you need to break up your network. 159 159 00:05:22,410 --> 00:05:24,000 The second thing we want to think about 160 160 00:05:24,000 --> 00:05:25,620 is how are you going to configure your scope 161 161 00:05:25,620 --> 00:05:28,260 based on a particular compliance objective? 162 162 00:05:28,260 --> 00:05:30,360 For example, if you're trying to be compliant 163 163 00:05:30,360 --> 00:05:33,510 with PCI DSS that has to do with payment card data, 164 164 00:05:33,510 --> 00:05:35,460 do you need to scan the video editor's computer 165 165 00:05:35,460 --> 00:05:37,950 to make sure it's in compliance with PCI DSS? 166 166 00:05:37,950 --> 00:05:39,660 Well, no, because they're probably not dealing 167 167 00:05:39,660 --> 00:05:41,460 with any kind of credit card data, 168 168 00:05:41,460 --> 00:05:44,490 but you may need to do that for Bookkeeping or Accounting, 169 169 00:05:44,490 --> 00:05:46,470 or the web server, or the e-commerce server, 170 170 00:05:46,470 --> 00:05:47,940 or the e-commerce database 171 171 00:05:47,940 --> 00:05:50,550 'cause all of those things may touch that credit card data, 172 172 00:05:50,550 --> 00:05:52,500 in which case they would have to be part of that scope, 173 173 00:05:52,500 --> 00:05:53,790 and that compliance scan. 174 174 00:05:53,790 --> 00:05:55,950 So we can have a particular scan set 175 175 00:05:55,950 --> 00:05:57,840 for just PCI DSS assets, 176 176 00:05:57,840 --> 00:06:00,960 and those are the 10 or 15 computers across our organization 177 177 00:06:00,960 --> 00:06:02,610 that touch credit card data. 178 178 00:06:02,610 --> 00:06:03,780 The third thing we want to consider 179 179 00:06:03,780 --> 00:06:05,400 is how we can re-scan scopes 180 180 00:06:05,400 --> 00:06:08,010 containing critical assets more often. 181 181 00:06:08,010 --> 00:06:09,990 Now, what I mean by this is I might have a scope 182 182 00:06:09,990 --> 00:06:12,630 of my web servers that are sitting in the DMZ. 183 183 00:06:12,630 --> 00:06:13,890 Because they're in the DMZ, 184 184 00:06:13,890 --> 00:06:15,510 they're more vulnerable to attack 185 185 00:06:15,510 --> 00:06:18,090 than something that was inside my internal network. 186 186 00:06:18,090 --> 00:06:20,220 So I may want to scan those every week 187 187 00:06:20,220 --> 00:06:22,590 where I only do my internal network once a month. 188 188 00:06:22,590 --> 00:06:24,300 Again, these are just numbers I'm making up, 189 189 00:06:24,300 --> 00:06:25,890 and you as an organization get to decide 190 190 00:06:25,890 --> 00:06:27,660 what the right frequency is for you. 191 191 00:06:27,660 --> 00:06:29,700 But if you have something that's more critical, 192 192 00:06:29,700 --> 00:06:31,650 you probably want to scan it more often. 193 193 00:06:31,650 --> 00:06:33,150 Now, the other thing we have to look at 194 194 00:06:33,150 --> 00:06:35,250 when we start looking at these scopes and scanning 195 195 00:06:35,250 --> 00:06:36,960 is how are we going to scan them? 196 196 00:06:36,960 --> 00:06:39,000 Are we going to do this as an internal scan, 197 197 00:06:39,000 --> 00:06:40,770 or an external scan? 198 198 00:06:40,770 --> 00:06:42,720 Now, if I'm dealing with internal scanning, 199 199 00:06:42,720 --> 00:06:44,160 this is where a vulnerability scan 200 200 00:06:44,160 --> 00:06:46,200 is being conducted on your local network 201 201 00:06:46,200 --> 00:06:48,360 from within your local network. 202 202 00:06:48,360 --> 00:06:49,770 Now, the real benefit here 203 203 00:06:49,770 --> 00:06:51,300 is you're going to be able to scan things 204 204 00:06:51,300 --> 00:06:52,800 without having to go through the firewall, 205 205 00:06:52,800 --> 00:06:55,290 because you're inside the local network already. 206 206 00:06:55,290 --> 00:06:56,610 Now, if you're doing things externally 207 207 00:06:56,610 --> 00:06:58,110 using an external scan 208 208 00:06:58,110 --> 00:07:00,240 this is a vulnerability scan that's being conducted 209 209 00:07:00,240 --> 00:07:02,220 against your network from outside 210 210 00:07:02,220 --> 00:07:03,690 of your local area network. 211 211 00:07:03,690 --> 00:07:06,780 Therefore, it's going to be coming in through the firewall. 212 212 00:07:06,780 --> 00:07:08,400 Now, when you do internal scanning, 213 213 00:07:08,400 --> 00:07:10,290 you can actually do this with permissions 214 214 00:07:10,290 --> 00:07:11,820 called credentialed scans, 215 215 00:07:11,820 --> 00:07:13,320 and this will give you additional details 216 216 00:07:13,320 --> 00:07:14,700 on the vulnerabilities that exist, 217 217 00:07:14,700 --> 00:07:17,370 because essentially you're already behind the firewall, 218 218 00:07:17,370 --> 00:07:19,710 you're already talking directly to those clients, 219 219 00:07:19,710 --> 00:07:21,120 and now you're logging into them 220 220 00:07:21,120 --> 00:07:22,710 using an administrator password. 221 221 00:07:22,710 --> 00:07:24,450 That's going to give you a lot more detail 222 222 00:07:24,450 --> 00:07:26,850 than if you were an attacker coming in from the outside. 223 223 00:07:26,850 --> 00:07:29,700 So why wouldn't we use an internal scan for everything? 224 224 00:07:29,700 --> 00:07:31,380 Well, because an internal scan 225 225 00:07:31,380 --> 00:07:33,900 is going to give you a laundry list of vulnerabilities, 226 226 00:07:33,900 --> 00:07:35,940 but not all of them are true vulnerabilities 227 227 00:07:35,940 --> 00:07:37,890 that could be exploited by an attacker. 228 228 00:07:37,890 --> 00:07:40,140 So instead, if you want to get an attacker's perspective 229 229 00:07:40,140 --> 00:07:42,360 you really have to do external scanning. 230 230 00:07:42,360 --> 00:07:43,530 By performing this, 231 231 00:07:43,530 --> 00:07:45,360 you're going to be able to get the attacker's perspective, 232 232 00:07:45,360 --> 00:07:47,280 because you're coming in through the firewall. 233 233 00:07:47,280 --> 00:07:50,130 Now, you're going to see a lot less vulnerabilities this way, 234 234 00:07:50,130 --> 00:07:51,540 because a lot of things are going to be blocked 235 235 00:07:51,540 --> 00:07:52,740 by the firewall. 236 236 00:07:52,740 --> 00:07:55,680 But again, it's good to have both perspectives, 237 237 00:07:55,680 --> 00:07:57,780 internal scans and external scans, 238 238 00:07:57,780 --> 00:07:59,010 and you're going to have to figure that out 239 239 00:07:59,010 --> 00:08:00,690 as you start doing this in the real world 240 240 00:08:00,690 --> 00:08:02,760 and how you're deciding which scopes to use, 241 241 00:08:02,760 --> 00:08:04,863 and from which perspective you want to scan.