1 1 00:00:00,270 --> 00:00:02,550 Vulnerability feeds. 2 2 00:00:02,550 --> 00:00:04,260 Just like your antivirus software 3 3 00:00:04,260 --> 00:00:06,330 needs to be updated with the latest definitions 4 4 00:00:06,330 --> 00:00:08,820 so does your vulnerability scanning tools. 5 5 00:00:08,820 --> 00:00:09,750 The way they do this 6 6 00:00:09,750 --> 00:00:12,000 is through a vulnerability management feed. 7 7 00:00:12,000 --> 00:00:14,100 Now, these vulnerability feeds are also known 8 8 00:00:14,100 --> 00:00:15,510 by other names as well. 9 9 00:00:15,510 --> 00:00:17,220 When we talk about a vulnerability feed 10 10 00:00:17,220 --> 00:00:18,930 these are synchronized lists of data 11 11 00:00:18,930 --> 00:00:21,480 and scripts that are used to check for vulnerabilities. 12 12 00:00:21,480 --> 00:00:23,850 If you're using Nessus, they like to call these plug-ins. 13 13 00:00:23,850 --> 00:00:25,140 If you're using OpenVAS 14 14 00:00:25,140 --> 00:00:28,590 they call them NVTs or Network Vulnerability Tests. 15 15 00:00:28,590 --> 00:00:29,670 Either way you slice it, 16 16 00:00:29,670 --> 00:00:32,670 they all fall into this category of vulnerability feeds, 17 17 00:00:32,670 --> 00:00:35,130 and I like to equate them to an antivirus signature, 18 18 00:00:35,130 --> 00:00:36,720 'cause it really is what they are. 19 19 00:00:36,720 --> 00:00:37,590 But the difference here 20 20 00:00:37,590 --> 00:00:39,300 is that they're not just looking for a snippet. 21 21 00:00:39,300 --> 00:00:40,200 These are actually scripts 22 22 00:00:40,200 --> 00:00:42,000 that can check those vulnerabilities. 23 23 00:00:42,000 --> 00:00:43,350 So when you run this scan 24 24 00:00:43,350 --> 00:00:45,600 and you're testing for some kind of an exploit, 25 25 00:00:45,600 --> 00:00:47,100 it's actually running that exploit 26 26 00:00:47,100 --> 00:00:49,890 against your system to see if it will be successful. 27 27 00:00:49,890 --> 00:00:51,330 And if it is, it reports back to you 28 28 00:00:51,330 --> 00:00:52,470 that there's a vulnerability there 29 29 00:00:52,470 --> 00:00:54,090 because it was able to exploit it. 30 30 00:00:54,090 --> 00:00:56,640 So keep that in mind when you start using these tools. 31 31 00:00:56,640 --> 00:00:58,830 Now, many of these commercial vulnerability scanners 32 32 00:00:58,830 --> 00:01:02,760 require an ongoing paid subscription to access the feeds. 33 33 00:01:02,760 --> 00:01:04,620 For example, if you use Nessus, 34 34 00:01:04,620 --> 00:01:05,970 which is made by Tenable, 35 35 00:01:05,970 --> 00:01:07,590 that is a commercial tool 36 36 00:01:07,590 --> 00:01:09,660 and it requires an ongoing paid subscription 37 37 00:01:09,660 --> 00:01:11,190 for you to access the feeds. 38 38 00:01:11,190 --> 00:01:12,807 If you as a company don't pay for that 39 39 00:01:12,807 --> 00:01:14,400 you can still use the tool, 40 40 00:01:14,400 --> 00:01:16,050 but you're going to be using old definitions 41 41 00:01:16,050 --> 00:01:17,010 that are out of date. 42 42 00:01:17,010 --> 00:01:18,960 And if you're using old out-of-date definitions 43 43 00:01:18,960 --> 00:01:20,700 you're not going to find the latest vulnerabilities 44 44 00:01:20,700 --> 00:01:22,650 and you're going to be vulnerable. 45 45 00:01:22,650 --> 00:01:24,240 Now, when we start looking at these tools 46 46 00:01:24,240 --> 00:01:26,070 they all use a common format. 47 47 00:01:26,070 --> 00:01:27,270 It's known as SCAP, 48 48 00:01:27,270 --> 00:01:29,070 and we've mentioned this one before. 49 49 00:01:29,070 --> 00:01:31,440 The Security Content Automation Protocol 50 50 00:01:31,440 --> 00:01:34,590 is a NIST framework that outlines various accepted practices 51 51 00:01:34,590 --> 00:01:36,480 for automating vulnerability scanning 52 52 00:01:36,480 --> 00:01:39,000 by adhering to standards for scanning processes, 53 53 00:01:39,000 --> 00:01:40,650 results reporting and scoring 54 54 00:01:40,650 --> 00:01:42,750 and vulnerability prioritization. 55 55 00:01:42,750 --> 00:01:44,070 This is what SCAP is. 56 56 00:01:44,070 --> 00:01:46,020 And SCAP is used to uphold internal 57 57 00:01:46,020 --> 00:01:48,240 and external compliance requirements. 58 58 00:01:48,240 --> 00:01:50,760 Because everybody's using the same language 59 59 00:01:50,760 --> 00:01:53,070 it makes it easy for us to transfer information 60 60 00:01:53,070 --> 00:01:54,600 from one tool to another 61 61 00:01:54,600 --> 00:01:57,750 because we're all speaking in the same language, SCAP. 62 62 00:01:57,750 --> 00:02:00,060 Now SCAP has two main components to it. 63 63 00:02:00,060 --> 00:02:03,630 They're known as OVAL and XCCDF. 64 64 00:02:03,630 --> 00:02:05,610 Now, OVAL is the open vulnerability 65 65 00:02:05,610 --> 00:02:08,580 and assessment language, also known as OVAL. 66 66 00:02:08,580 --> 00:02:11,910 It's an XML schema for describing system security states 67 67 00:02:11,910 --> 00:02:14,940 and querying vulnerability reports and information. 68 68 00:02:14,940 --> 00:02:17,640 Now, on the other hand we have XCCDF. 69 69 00:02:17,640 --> 00:02:19,290 This is the extensible configuration 70 70 00:02:19,290 --> 00:02:21,390 checklist description format. 71 71 00:02:21,390 --> 00:02:23,280 This is an XML schema for developing 72 72 00:02:23,280 --> 00:02:25,050 and auditing best practice configuration 73 73 00:02:25,050 --> 00:02:26,460 checklist and rules. 74 74 00:02:26,460 --> 00:02:28,770 Now, previously best Practice Guides 75 75 00:02:28,770 --> 00:02:31,470 were actually a big long written essay, almost, 76 76 00:02:31,470 --> 00:02:32,820 with step-by-step guidance 77 77 00:02:32,820 --> 00:02:34,050 that told you what to do. 78 78 00:02:34,050 --> 00:02:35,430 And an administrator would print out this thing, 79 79 00:02:35,430 --> 00:02:37,650 it was 30, 40, 50 pages 80 80 00:02:37,650 --> 00:02:38,820 and they would go through the checklist 81 81 00:02:38,820 --> 00:02:40,350 to make sure they did everything. 82 82 00:02:40,350 --> 00:02:42,300 Now, the problem with that is there is no automated way 83 83 00:02:42,300 --> 00:02:43,440 to check against that, 84 84 00:02:43,440 --> 00:02:47,100 but XCCDF provides you with this machine readable format 85 85 00:02:47,100 --> 00:02:47,933 that can be applied 86 86 00:02:47,933 --> 00:02:50,070 and validated using compatible software. 87 87 00:02:50,070 --> 00:02:51,930 So if there was 30 or 40 steps 88 88 00:02:51,930 --> 00:02:53,850 that we're all dealing with configurations, 89 89 00:02:53,850 --> 00:02:55,890 you could use it through XCCDF 90 90 00:02:55,890 --> 00:02:57,420 inside of a compatible tool 91 91 00:02:57,420 --> 00:02:58,770 and it will run those for you. 92 92 00:02:58,770 --> 00:03:00,000 So the administrator doesn't have to do it all 93 93 00:03:00,000 --> 00:03:01,110 him or herself. 94 94 00:03:01,110 --> 00:03:03,630 Instead, the software can do it for you and check it. 95 95 00:03:03,630 --> 00:03:05,190 So these are great tools 96 96 00:03:05,190 --> 00:03:07,560 and one of the great things about using things like OVAL 97 97 00:03:07,560 --> 00:03:09,990 and XCCDF is that they are compatible 98 98 00:03:09,990 --> 00:03:12,390 across all of the different vulnerability tools. 99 99 00:03:12,390 --> 00:03:14,010 And so as you start using these tools 100 100 00:03:14,010 --> 00:03:15,240 they're going to help you be more 101 101 00:03:15,240 --> 00:03:16,590 and more compatible with the different tools 102 102 00:03:16,590 --> 00:03:17,613 and get more done.