1 1 00:00:00,180 --> 00:00:02,040 Scanning parameters. 2 2 00:00:02,040 --> 00:00:03,180 In this short lesson, 3 3 00:00:03,180 --> 00:00:05,190 we're going to talk about some scanning parameters 4 4 00:00:05,190 --> 00:00:07,140 that you're going to need to configure and think about 5 5 00:00:07,140 --> 00:00:09,780 inside of your vulnerability scanning tools. 6 6 00:00:09,780 --> 00:00:12,180 Now, vulnerability scanners must be configured 7 7 00:00:12,180 --> 00:00:13,320 with different parameters 8 8 00:00:13,320 --> 00:00:15,450 to be effective in scanning your networks. 9 9 00:00:15,450 --> 00:00:16,650 If you don't set them up right, 10 10 00:00:16,650 --> 00:00:17,760 they're not going to be effective 11 11 00:00:17,760 --> 00:00:19,680 in finding those vulnerabilities. 12 12 00:00:19,680 --> 00:00:21,330 Now, there are two main areas of concern 13 13 00:00:21,330 --> 00:00:22,380 that we have to think about. 14 14 00:00:22,380 --> 00:00:23,790 One is segmentation, 15 15 00:00:23,790 --> 00:00:27,540 and the other is firewalls, IDSs, and IPSs. 16 16 00:00:27,540 --> 00:00:29,190 Now, when we talk about segmentation, 17 17 00:00:29,190 --> 00:00:31,494 this is the division of a network into separate zones 18 18 00:00:31,494 --> 00:00:34,230 through the use of VLANs and subnetting. 19 19 00:00:34,230 --> 00:00:36,930 And if you went through Security+ or Network+ with me, 20 20 00:00:36,930 --> 00:00:38,280 you remember that segmentation 21 21 00:00:38,280 --> 00:00:41,160 is a great way to add some security to your network. 22 22 00:00:41,160 --> 00:00:42,090 Why is that? 23 23 00:00:42,090 --> 00:00:43,950 Because segmentation forces traffic 24 24 00:00:43,950 --> 00:00:46,290 to flow predictably between zones, 25 25 00:00:46,290 --> 00:00:48,510 usually through a firewall or a router 26 26 00:00:48,510 --> 00:00:50,460 where we can apply access control lists to them 27 27 00:00:50,460 --> 00:00:53,130 and really control where that traffic is going. 28 28 00:00:53,130 --> 00:00:54,450 By doing this segmentation, 29 29 00:00:54,450 --> 00:00:56,162 we really do create these choke points 30 30 00:00:56,162 --> 00:00:57,450 that allows us to see 31 31 00:00:57,450 --> 00:00:59,310 what information is going to what place 32 32 00:00:59,310 --> 00:01:00,600 and be able to analyze it 33 33 00:01:00,600 --> 00:01:03,150 using things like firewalls and routers. 34 34 00:01:03,150 --> 00:01:05,250 So when you start performing vulnerability scanning 35 35 00:01:05,250 --> 00:01:06,960 across a segmented network, 36 36 00:01:06,960 --> 00:01:08,730 you really need to consider the requirements 37 37 00:01:08,730 --> 00:01:11,010 and the limitations that you may face. 38 38 00:01:11,010 --> 00:01:13,650 For example, in this network, I have an inside network, 39 39 00:01:13,650 --> 00:01:15,810 an outside network, and a screened subnet. 40 40 00:01:15,810 --> 00:01:19,290 Let's assume I'm going to scan all of my things from PC1. 41 41 00:01:19,290 --> 00:01:20,850 Well, it'd be very easy for me 42 42 00:01:20,850 --> 00:01:23,160 to go from PC1 to PC2 and PC3 43 43 00:01:23,160 --> 00:01:26,430 because they're all in the same subnet, that internal LAN. 44 44 00:01:26,430 --> 00:01:28,500 But if I want to go over to the screened subnet 45 45 00:01:28,500 --> 00:01:30,390 and scan the email and the web server, 46 46 00:01:30,390 --> 00:01:31,800 I'm going to have to go through that router 47 47 00:01:31,800 --> 00:01:34,410 and through that firewall to get into the screened subnet. 48 48 00:01:34,410 --> 00:01:36,570 Now, to do this using a server-based scanner 49 49 00:01:36,570 --> 00:01:38,640 like the one I installed on PC1, 50 50 00:01:38,640 --> 00:01:41,280 I have to be able to communicate with these remote subnets, 51 51 00:01:41,280 --> 00:01:43,680 and that means I'm going to have to go through multiple VLANs 52 52 00:01:43,680 --> 00:01:45,780 or through a firewall or a router. 53 53 00:01:45,780 --> 00:01:48,480 Now, alternatively, if I don't want to do that, 54 54 00:01:48,480 --> 00:01:51,330 I can have PC1 only scan PC2 and 3, 55 55 00:01:51,330 --> 00:01:52,950 and then I can install another machine 56 56 00:01:52,950 --> 00:01:54,120 inside the screened subnet 57 57 00:01:54,120 --> 00:01:55,890 that could scan the things in the screened subnet, 58 58 00:01:55,890 --> 00:01:57,300 like email and the web. 59 59 00:01:57,300 --> 00:01:58,320 And then if I wanted to do something 60 60 00:01:58,320 --> 00:01:59,610 from an external perspective, 61 61 00:01:59,610 --> 00:02:01,260 I could have something come from over the internet 62 62 00:02:01,260 --> 00:02:03,090 and try to scan in that way. 63 63 00:02:03,090 --> 00:02:03,923 To do this, 64 64 00:02:03,923 --> 00:02:05,940 I would have multiple different segments as shown here, 65 65 00:02:05,940 --> 00:02:07,320 but I'd also have multiple scanners 66 66 00:02:07,320 --> 00:02:08,550 attached to those segments. 67 67 00:02:08,550 --> 00:02:10,290 And then I would just send those reports 68 68 00:02:10,290 --> 00:02:12,000 back to a centralized management server 69 69 00:02:12,000 --> 00:02:13,770 where I can analyze them. 70 70 00:02:13,770 --> 00:02:15,600 Now, if you're using agent-based scanners, 71 71 00:02:15,600 --> 00:02:17,130 they have to be able to communicate the reports 72 72 00:02:17,130 --> 00:02:18,780 back to the management server. 73 73 00:02:18,780 --> 00:02:20,520 So let's say that the web server 74 74 00:02:20,520 --> 00:02:22,440 also is being my management server. 75 75 00:02:22,440 --> 00:02:24,420 Well, everything from PC1, 2 and 3 76 76 00:02:24,420 --> 00:02:26,430 are going to have to have a firewall rule in place 77 77 00:02:26,430 --> 00:02:27,480 that allows them to communicate 78 78 00:02:27,480 --> 00:02:28,770 back over to the screened subnet 79 79 00:02:28,770 --> 00:02:30,630 to give that information to that web server. 80 80 00:02:30,630 --> 00:02:32,010 And so you can see this does require 81 81 00:02:32,010 --> 00:02:33,360 a little bit more configuration. 82 82 00:02:33,360 --> 00:02:35,070 And so if you're using segmentation, 83 83 00:02:35,070 --> 00:02:36,180 you have to think this through. 84 84 00:02:36,180 --> 00:02:38,880 Otherwise, you're not going to get valid results. 85 85 00:02:38,880 --> 00:02:40,590 Now, my big point here in all of this 86 86 00:02:40,590 --> 00:02:43,650 is that vulnerability scanners must be properly configured 87 87 00:02:43,650 --> 00:02:45,330 to work with the network's firewalls, 88 88 00:02:45,330 --> 00:02:48,270 intrusion detection, and intrusion prevention systems. 89 89 00:02:48,270 --> 00:02:49,830 If you don't configure them properly, 90 90 00:02:49,830 --> 00:02:51,390 they're not going to be able to be accessed 91 91 00:02:51,390 --> 00:02:53,460 across these things because of those rules. 92 92 00:02:53,460 --> 00:02:54,660 In addition to that, 93 93 00:02:54,660 --> 00:02:56,310 your firewalls have to be configured 94 94 00:02:56,310 --> 00:02:57,630 to allow agent-based scanners 95 95 00:02:57,630 --> 00:02:59,910 to report to that centralized management server. 96 96 00:02:59,910 --> 00:03:02,130 That's one of the first things you have to think about. 97 97 00:03:02,130 --> 00:03:03,630 Another thing you have to think about 98 98 00:03:03,630 --> 00:03:04,950 is that your intrusion detection 99 99 00:03:04,950 --> 00:03:06,249 and intrusion prevention systems 100 100 00:03:06,249 --> 00:03:08,310 have to be configured with exceptions 101 101 00:03:08,310 --> 00:03:10,350 to allow for agent-based scanning. 102 102 00:03:10,350 --> 00:03:12,720 Wait, why do I need an exception, Jason? 103 103 00:03:12,720 --> 00:03:15,270 Well, if you have an agent here on a system 104 104 00:03:15,270 --> 00:03:17,910 and it starts trying to scan for different vulnerabilities, 105 105 00:03:17,910 --> 00:03:20,520 those vulnerabilities are essentially exploits, 106 106 00:03:20,520 --> 00:03:22,680 and those tools, those IDSs and IPSs, 107 107 00:03:22,680 --> 00:03:23,820 could alert on those. 108 108 00:03:23,820 --> 00:03:25,890 So if you're going to be scanning those 109 109 00:03:25,890 --> 00:03:27,390 with an agent-based scan, 110 110 00:03:27,390 --> 00:03:30,570 the IDS and IPS needs to know this is trusted software, 111 111 00:03:30,570 --> 00:03:32,010 you can allow it to happen. 112 112 00:03:32,010 --> 00:03:33,510 Otherwise, it's going to try to block it 113 113 00:03:33,510 --> 00:03:36,090 and you're not going to get your vulnerability scans done. 114 114 00:03:36,090 --> 00:03:37,470 Another thing you need to think about 115 115 00:03:37,470 --> 00:03:40,350 when you're dealing with firewalls, IDSs, and IPSs 116 116 00:03:40,350 --> 00:03:42,690 is that they're likely to block server-based scanning 117 117 00:03:42,690 --> 00:03:44,400 unless exemptions are created. 118 118 00:03:44,400 --> 00:03:46,297 Again, you have to tell these things, 119 119 00:03:46,297 --> 00:03:48,300 "It's okay if you see this activity 120 120 00:03:48,300 --> 00:03:49,770 from this particular server 121 121 00:03:49,770 --> 00:03:52,170 because this is a trusted server that we own. 122 122 00:03:52,170 --> 00:03:53,730 But if you see it from anywhere else, 123 123 00:03:53,730 --> 00:03:56,190 flag that and alert it because we might be under attack." 124 124 00:03:56,190 --> 00:03:57,480 And so this is, again, one of those things 125 125 00:03:57,480 --> 00:03:58,500 that would have to be an exception 126 126 00:03:58,500 --> 00:04:00,330 that you have to put into place. 127 127 00:04:00,330 --> 00:04:01,860 Now because of that, what I recommend 128 128 00:04:01,860 --> 00:04:04,050 is if you're going to use server-based scanning, 129 129 00:04:04,050 --> 00:04:05,610 you need to make sure those servers 130 130 00:04:05,610 --> 00:04:07,320 have static IP addresses. 131 131 00:04:07,320 --> 00:04:08,640 That way you can configure 132 132 00:04:08,640 --> 00:04:11,220 the IDS, the IPS, and the firewalls 133 133 00:04:11,220 --> 00:04:13,350 to ignore scanning attempts from those 134 134 00:04:13,350 --> 00:04:15,630 and not flag on them and not block them. 135 135 00:04:15,630 --> 00:04:17,340 That way they know where they're coming from 136 136 00:04:17,340 --> 00:04:18,300 and where they're going to, 137 137 00:04:18,300 --> 00:04:20,550 which in this case would be your targets. 138 138 00:04:20,550 --> 00:04:21,527 Now, some organizations 139 139 00:04:21,527 --> 00:04:23,940 will use what's called a scanning window, 140 140 00:04:23,940 --> 00:04:24,870 and basically what they'll do 141 141 00:04:24,870 --> 00:04:26,737 is they will disable their firewall and they'll say, 142 142 00:04:26,737 --> 00:04:28,530 "Okay, from midnight to 2:00 AM, 143 143 00:04:28,530 --> 00:04:29,940 we're going to disable the firewall 144 144 00:04:29,940 --> 00:04:31,732 and allow all of our scanning to occur." 145 145 00:04:31,732 --> 00:04:33,810 Now, I do not think this is a good idea. 146 146 00:04:33,810 --> 00:04:35,670 I personally think this is a horrible idea. 147 147 00:04:35,670 --> 00:04:37,830 But it is mentioned in your textbook, 148 148 00:04:37,830 --> 00:04:39,510 which is why I'm bringing it up. 149 149 00:04:39,510 --> 00:04:41,340 I would never personally use this practice. 150 150 00:04:41,340 --> 00:04:42,960 I think it is horrible. 151 151 00:04:42,960 --> 00:04:44,610 Instead, what I would recommend 152 152 00:04:44,610 --> 00:04:47,850 is that you install scanners into each enclave or segment 153 153 00:04:47,850 --> 00:04:49,728 and have them report back to a centralized server. 154 154 00:04:49,728 --> 00:04:51,330 Yes, it costs more money 155 155 00:04:51,330 --> 00:04:52,980 'cause you have to have multiple scanners, 156 156 00:04:52,980 --> 00:04:54,148 but it's a heck of a lot better 157 157 00:04:54,148 --> 00:04:56,310 than turning off your firewall. 158 158 00:04:56,310 --> 00:04:58,020 Now again, these are just two options 159 159 00:04:58,020 --> 00:04:58,853 that are being presented. 160 160 00:04:58,853 --> 00:05:00,330 One is turning off your firewall, 161 161 00:05:00,330 --> 00:05:02,250 two is putting a scanner in each enclave. 162 162 00:05:02,250 --> 00:05:04,890 The third one you can do is just put one of these scanners 163 163 00:05:04,890 --> 00:05:06,150 in one enclave that you want, 164 164 00:05:06,150 --> 00:05:07,770 and then open up the right firewall rules 165 165 00:05:07,770 --> 00:05:09,030 with the right exceptions. 166 166 00:05:09,030 --> 00:05:10,740 But again, each of these carries some risk, 167 167 00:05:10,740 --> 00:05:11,820 and you have to measure that 168 168 00:05:11,820 --> 00:05:13,980 with your organization's risk appetite. 169 169 00:05:13,980 --> 00:05:15,210 Now, the final thing you have to remember 170 170 00:05:15,210 --> 00:05:17,580 is these scanners need to be updated. 171 171 00:05:17,580 --> 00:05:20,490 Now, the reason for this is these scanners have an engine, 172 172 00:05:20,490 --> 00:05:22,050 and essentially just like antivirus, 173 173 00:05:22,050 --> 00:05:23,610 they have to get their updates. 174 174 00:05:23,610 --> 00:05:24,660 If they don't get their updates, 175 175 00:05:24,660 --> 00:05:25,983 they won't know about new vulnerabilities 176 176 00:05:25,983 --> 00:05:27,300 that are out there. 177 177 00:05:27,300 --> 00:05:29,610 So what happens is there's this vulnerability feed, 178 178 00:05:29,610 --> 00:05:30,443 and we're going to talk more 179 179 00:05:30,443 --> 00:05:32,160 about these vulnerability feeds later, 180 180 00:05:32,160 --> 00:05:33,240 that it's going to download. 181 181 00:05:33,240 --> 00:05:34,290 And based on that feed, 182 182 00:05:34,290 --> 00:05:35,820 it's going to know in its database 183 183 00:05:35,820 --> 00:05:37,530 all the vulnerabilities that exist 184 184 00:05:37,530 --> 00:05:39,090 and what it should be testing for. 185 185 00:05:39,090 --> 00:05:40,860 Think of them like antivirus signatures. 186 186 00:05:40,860 --> 00:05:42,660 It's the same idea, but in this case, 187 187 00:05:42,660 --> 00:05:45,262 it's for a wide range of exploits and vulnerabilities. 188 188 00:05:45,262 --> 00:05:48,120 So one of the things you have to do in your configuration 189 189 00:05:48,120 --> 00:05:50,520 is make sure your firewall is allowing your scanner 190 190 00:05:50,520 --> 00:05:51,440 to reach out to the internet 191 191 00:05:51,440 --> 00:05:54,872 to be able to get its feed from that particular website. 192 192 00:05:54,872 --> 00:05:55,860 Most of the time, 193 193 00:05:55,860 --> 00:05:57,930 you want to make sure your scanner is locked down 194 194 00:05:57,930 --> 00:06:00,150 so it can't go to every website out there. 195 195 00:06:00,150 --> 00:06:01,680 It should only be able to go to the sites 196 196 00:06:01,680 --> 00:06:03,000 it needs to get these updates. 197 197 00:06:03,000 --> 00:06:05,460 Other than that, it really doesn't need internet access, 198 198 00:06:05,460 --> 00:06:06,990 and so you should block internet access 199 199 00:06:06,990 --> 00:06:08,820 except for these update sites. 200 200 00:06:08,820 --> 00:06:10,170 That's the main key here when you start 201 201 00:06:10,170 --> 00:06:12,670 dealing with configuring your scanning parameters.