Trainer: Vulnerability feeds. 2 2
Just like your antivirus software 3 3
needs to be updated with the latest definitions 4 4
so does your vulnerability scanning tools. 5 5
The way they do this 6 6
is through a vulnerability management feed. 7 7
Now, these vulnerability feeds are also known 8 8
by other names as well. 9 9
When we talk about a vulnerability feed 10 10
these are synchronized lists of data 11 11
and scripts that are used to check for vulnerabilities. 12 12
If you're using Nessus, they like to call these plug-ins. 13 13
If you're using OpenVAS 14 14
they call them NVTs or Network Vulnerability Tests. 15 15
Either way you slice it, 16 16
they all fall into this category of vulnerability feeds, 17 17
and I like to equate them to an antivirus signature, 18 18
'cause it really is what they are. 19 19
But the difference here 20 20
is that they're not just looking for a snippet. 21 21
These are actually scripts 22 22
that can check those vulnerabilities. 23 23
So when you run this scan 24 24
and you're testing for some kind of an exploit, 25 25
it's actually running that exploit 26 26
against your system to see if it will be successful. 27 27
And if it is, it reports back to you 28 28
that there's a vulnerability there 29 29
because it was able to exploit it. 30 30
So keep that in mind when you start using these tools. 31 31
Now, many of these commercial vulnerability scanners 32 32
require an ongoing paid subscription to access the feeds. 33 33
For example, if you use Nessus, 34 34
which is made by Tenable, 35 35
that is a commercial tool 36 36
and it requires an ongoing paid subscription 37 37
for you to access the feeds. 38 38
If you as a company don't pay for that 39 39
you can still use the tool, 40 40
but you're going to be using old definitions 41 41
that are out of date. 42 42
And if you're using old out-of-date definitions 43 43
you're not going to find the latest vulnerabilities 44 44
and you're going to be vulnerable. 45 45
Now, when we start looking at these tools 46 46
they all use a common format. 47 47
It's known as SCAP, 48 48
and we've mentioned this one before. 49 49
The Security Content Automation Protocol 50 50
is a NIST framework that outlines various accepted practices 51 51
for automating vulnerability scanning 52 52
by adhering to standards for scanning processes, 53 53
results reporting and scoring 54 54
and vulnerability prioritization. 55 55
This is what SCAP is. 56 56
And SCAP is used to uphold internal 57 57
and external compliance requirements. 58 58
Because everybody's using the same language 59 59
it makes it easy for us to transfer information 60 60
from one tool to another 61 61
because we're all speaking in the same language, SCAP. 62 62
Now SCAP has two main components to it. 63 63
They're known as OVAL and XCCDF. 64 64
Now, OVAL is the open vulnerability 65 65
and assessment language, also known as OVAL. 66 66
It's an XML schema for describing system security states 67 67
and querying vulnerability reports and information. 68 68
Now, on the other hand we have XCCDF. 69 69
This is the extensible configuration 70 70
checklist description format. 71 71
This is an XML schema for developing 72 72
and auditing best practice configuration 73 73
checklist and rules. 74 74
Now, previously best Practice Guides 75 75
were actually a big long written essay, almost, 76 76
with step-by-step guidance 77 77
that told you what to do. 78 78
And an administrator would print out this thing, 79 79
it was 30, 40, 50 pages 80 80
and they would go through the checklist 81 81
to make sure they did everything. 82 82
Now, the problem with that is there is no automated way 83 83
to check against that, 84 84
but XCCDF provides you with this machine readable format 85 85
that can be applied 86 86
and validated using compatible software. 87 87
So if there was 30 or 40 steps 88 88
that we're all dealing with configurations, 89 89
you could use it through XCCDF 90 90
inside of a compatible tool 91 91
and it will run those for you. 92 92
So the administrator doesn't have to do it all 93 93
him or herself. 94 94
Instead, the software can do it for you and check it. 95 95
So these are great tools 96 96
and one of the great things about using things like OVAL 97 97
and XCCDF is that they are compatible 98 98
across all of the different vulnerability tools. 99 99
And so as you start using these tools 100 100
they're going to help you be more 101 101
and more compatible with the different tools 102 102
and get more done.