Jason: Scanning parameters. 2 2
In this short lesson, 3 3
we're going to talk about some scanning parameters 4 4
that you're going to need to configure and think about 5 5
inside of your vulnerability scanning tools. 6 6
Now, vulnerability scanners must be configured 7 7
with different parameters 8 8
to be effective in scanning your networks. 9 9
If you don't set them up right, 10 10
they're not going to be effective 11 11
in finding those vulnerabilities. 12 12
Now, there are two main areas of concern 13 13
that we have to think about. 14 14
One is segmentation, 15 15
and the other is firewalls, IDSs, and IPSs. 16 16
Now, when we talk about segmentation, 17 17
this is the division of a network into separate zones 18 18
through the use of VLANs and subnetting. 19 19
And if you went through Security+ or Network+ with me, 20 20
you remember that segmentation 21 21
is a great way to add some security to your network. 22 22
Why is that? 23 23
Because segmentation forces traffic 24 24
to flow predictably between zones, 25 25
usually through a firewall or a router 26 26
where we can apply access control lists to them 27 27
and really control where that traffic is going. 28 28
By doing this segmentation, 29 29
we really do create these choke points 30 30
that allows us to see 31 31
what information is going to what place 32 32
and be able to analyze it 33 33
using things like firewalls and routers. 34 34
So when you start performing vulnerability scanning 35 35
across a segmented network, 36 36
you really need to consider the requirements 37 37
and the limitations that you may face. 38 38
For example, in this network, I have an inside network, 39 39
an outside network, and a screened subnet. 40 40
Let's assume I'm going to scan all of my things from PC1. 41 41
Well, it'd be very easy for me 42 42
to go from PC1 to PC2 and PC3 43 43
because they're all in the same subnet, that internal LAN. 44 44
But if I want to go over to the screened subnet 45 45
and scan the email and the web server, 46 46
I'm going to have to go through that router 47 47
and through that firewall to get into the screened subnet. 48 48
Now, to do this using a server-based scanner 49 49
like the one I installed on PC1, 50 50
I have to be able to communicate with these remote subnets, 51 51
and that means I'm going to have to go through multiple VLANs 52 52
or through a firewall or a router. 53 53
Now, alternatively, if I don't want to do that, 54 54
I can have PC1 only scan PC2 and 3, 55 55
and then I can install another machine 56 56
inside the screened subnet 57 57
that could scan the things in the screened subnet, 58 58
like email and the web. 59 59
And then if I wanted to do something 60 60
from an external perspective, 61 61
I could have something come from over the internet 62 62
and try to scan in that way. 63 63
To do this, 64 64
I would have multiple different segments as shown here, 65 65
but I'd also have multiple scanners 66 66
attached to those segments. 67 67
And then I would just send those reports 68 68
back to a centralized management server 69 69
where I can analyze them. 70 70
Now, if you're using agent-based scanners, 71 71
they have to be able to communicate the reports 72 72
back to the management server. 73 73
So let's say that the web server 74 74
also is being my management server. 75 75
Well, everything from PC1, 2 and 3 76 76
are going to have to have a firewall rule in place 77 77
that allows them to communicate 78 78
back over to the screened subnet 79 79
to give that information to that web server. 80 80
And so you can see this does require 81 81
a little bit more configuration. 82 82
And so if you're using segmentation, 83 83
you have to think this through. 84 84
Otherwise, you're not going to get valid results. 85 85
Now, my big point here in all of this 86 86
is that vulnerability scanners must be properly configured 87 87
to work with the network's firewalls, 88 88
intrusion detection, and intrusion prevention systems. 89 89
If you don't configure them properly, 90 90
they're not going to be able to be accessed 91 91
across these things because of those rules. 92 92
In addition to that, 93 93
your firewalls have to be configured 94 94
to allow agent-based scanners 95 95
to report to that centralized management server. 96 96
That's one of the first things you have to think about. 97 97
Another thing you have to think about 98 98
is that your intrusion detection 99 99
and intrusion prevention systems 100 100
have to be configured with exceptions 101 101
to allow for agent-based scanning. 102 102
Wait, why do I need an exception, Jason? 103 103
Well, if you have an agent here on a system 104 104
and it starts trying to scan for different vulnerabilities, 105 105
those vulnerabilities are essentially exploits, 106 106
and those tools, those IDSs and IPSs, 107 107
could alert on those. 108 108
So if you're going to be scanning those 109 109
with an agent-based scan, 110 110
the IDS and IPS needs to know this is trusted software, 111 111
you can allow it to happen. 112 112
Otherwise, it's going to try to block it 113 113
and you're not going to get your vulnerability scans done. 114 114
Another thing you need to think about 115 115
when you're dealing with firewalls, IDSs, and IPSs 116 116
is that they're likely to block server-based scanning 117 117
unless exemptions are created. 118 118
Again, you have to tell these things, 119 119
"It's okay if you see this activity 120 120
from this particular server 121 121
because this is a trusted server that we own. 122 122
But if you see it from anywhere else, 123 123
flag that and alert it because we might be under attack." 124 124
And so this is, again, one of those things 125 125
that would have to be an exception 126 126
that you have to put into place. 127 127
Now because of that, what I recommend 128 128
is if you're going to use server-based scanning, 129 129
you need to make sure those servers 130 130
have static IP addresses. 131 131
That way you can configure 132 132
the IDS, the IPS, and the firewalls 133 133
to ignore scanning attempts from those 134 134
and not flag on them and not block them. 135 135
That way they know where they're coming from 136 136
and where they're going to, 137 137
which in this case would be your targets. 138 138
Now, some organizations 139 139
will use what's called a scanning window, 140 140
and basically what they'll do 141 141
is they will disable their firewall and they'll say, 142 142
"Okay, from midnight to 2:00 AM, 143 143
we're going to disable the firewall 144 144
and allow all of our scanning to occur." 145 145
Now, I do not think this is a good idea. 146 146
I personally think this is a horrible idea. 147 147
But it is mentioned in your textbook, 148 148
which is why I'm bringing it up. 149 149
I would never personally use this practice. 150 150
I think it is horrible. 151 151
Instead, what I would recommend 152 152
is that you install scanners into each enclave or segment 153 153
and have them report back to a centralized server. 154 154
Yes, it costs more money 155 155
'cause you have to have multiple scanners, 156 156
but it's a heck of a lot better 157 157
than turning off your firewall. 158 158
Now again, these are just two options 159 159
that are being presented. 160 160
One is turning off your firewall, 161 161
two is putting a scanner in each enclave. 162 162
The third one you can do is just put one of these scanners 163 163
in one enclave that you want, 164 164
and then open up the right firewall rules 165 165
with the right exceptions. 166 166
But again, each of these carries some risk, 167 167
and you have to measure that 168 168
with your organization's risk appetite. 169 169
Now, the final thing you have to remember 170 170
is these scanners need to be updated. 171 171
Now, the reason for this is these scanners have an engine, 172 172
and essentially just like antivirus, 173 173
they have to get their updates. 174 174
If they don't get their updates, 175 175
they won't know about new vulnerabilities 176 176
that are out there. 177 177
So what happens is there's this vulnerability feed, 178 178
and we're going to talk more 179 179
about these vulnerability feeds later, 180 180
that it's going to download. 181 181
And based on that feed, 182 182
it's going to know in its database 183 183
all the vulnerabilities that exist 184 184
and what it should be testing for. 185 185
Think of them like antivirus signatures. 186 186
It's the same idea, but in this case, 187 187
it's for a wide range of exploits and vulnerabilities. 188 188
So one of the things you have to do in your configuration 189 189
is make sure your firewall is allowing your scanner 190 190
to reach out to the internet 191 191
to be able to get its feed from that particular website. 192 192
Most of the time, 193 193
you want to make sure your scanner is locked down 194 194
so it can't go to every website out there. 195 195
It should only be able to go to the sites 196 196
it needs to get these updates. 197 197
Other than that, it really doesn't need internet access, 198 198
and so you should block internet access 199 199
except for these update sites. 200 200
That's the main key here when you start 201 201
dealing with configuring your scanning parameters.