1 1 00:00:00,000 --> 00:00:02,579 Scan Sensitivity. 2 2 00:00:02,579 --> 00:00:03,660 In this lesson, 3 3 00:00:03,660 --> 00:00:05,940 we're going to talk about scanner sensitivity 4 4 00:00:05,940 --> 00:00:08,220 and when I talk about the scan sensitivity, 5 5 00:00:08,220 --> 00:00:09,750 this is the amount and intensity 6 6 00:00:09,750 --> 00:00:12,360 of vulnerabilities to test against a target. 7 7 00:00:12,360 --> 00:00:13,343 As I mentioned before, 8 8 00:00:13,343 --> 00:00:14,865 when you start scanning your network 9 9 00:00:14,865 --> 00:00:16,470 for these vulnerabilities, 10 10 00:00:16,470 --> 00:00:17,907 the vulnerability tool is actually going to try 11 11 00:00:17,907 --> 00:00:20,755 to exploit these different vulnerabilities for you. 12 12 00:00:20,755 --> 00:00:23,190 And you can actually have these things called safe scan 13 13 00:00:23,190 --> 00:00:24,510 or not safe scan. 14 14 00:00:24,510 --> 00:00:25,494 If you're doing a safe scan, 15 15 00:00:25,494 --> 00:00:27,607 it won't actually try any vulnerabilities 16 16 00:00:27,607 --> 00:00:29,730 that it thinks might corrupt your system 17 17 00:00:29,730 --> 00:00:30,990 or crash your system. 18 18 00:00:30,990 --> 00:00:32,300 If you do a not safe scan, 19 19 00:00:32,300 --> 00:00:33,551 it will throw that out the window 20 20 00:00:33,551 --> 00:00:35,700 and it will try everything it has 21 21 00:00:35,700 --> 00:00:38,010 to find every vulnerability possible. 22 22 00:00:38,010 --> 00:00:39,804 Now, again, this is one of those things you have to decide 23 23 00:00:39,804 --> 00:00:42,330 when you're setting up your profiles. 24 24 00:00:42,330 --> 00:00:45,150 One of these profiles is known as a scan template. 25 25 00:00:45,150 --> 00:00:47,041 A scan template is going to define the settings used 26 26 00:00:47,041 --> 00:00:49,216 for each vulnerability scan. 27 27 00:00:49,216 --> 00:00:51,232 Now, there's lots of different types of vulnerability scans 28 28 00:00:51,232 --> 00:00:52,380 that we're going to talk about. 29 29 00:00:52,380 --> 00:00:55,050 We're going to talk about four basic ones here in this lesson. 30 30 00:00:55,050 --> 00:00:56,880 We're going to talk about a discovery scan, 31 31 00:00:56,880 --> 00:00:58,626 a fast or basic assessment scan, 32 32 00:00:58,626 --> 00:01:02,103 a full or deep assessment scan, and a compliance scan. 33 33 00:01:02,103 --> 00:01:03,990 When we talk about a discovery scan, 34 34 00:01:03,990 --> 00:01:05,340 this is used to create and update 35 35 00:01:05,340 --> 00:01:07,050 an inventory of your assets, 36 36 00:01:07,050 --> 00:01:08,749 and it does this by conducting an enumeration 37 37 00:01:08,749 --> 00:01:10,791 of your network by mapping it out 38 38 00:01:10,791 --> 00:01:12,187 and it finds all of the different targets 39 39 00:01:12,187 --> 00:01:15,030 without scanning for any vulnerabilities. 40 40 00:01:15,030 --> 00:01:16,977 Think about this like an Nmap scan. 41 41 00:01:16,977 --> 00:01:19,320 Essentially, your vulnerability management tool 42 42 00:01:19,320 --> 00:01:21,651 is going to go out and do a ping sweep of the entire network 43 43 00:01:21,651 --> 00:01:23,675 and find out who's up and who's down, 44 44 00:01:23,675 --> 00:01:25,590 which ones have which ports open. 45 45 00:01:25,590 --> 00:01:27,900 That's the idea of using a discovery scan. 46 46 00:01:27,900 --> 00:01:29,086 These tend to be very fast, 47 47 00:01:29,086 --> 00:01:31,199 at least in comparison to the other types of scans, 48 48 00:01:31,199 --> 00:01:33,060 but they are not very in-depth. 49 49 00:01:33,060 --> 00:01:35,820 They are mostly used for enumeration. 50 50 00:01:35,820 --> 00:01:36,870 The next one we're going to talk about 51 51 00:01:36,870 --> 00:01:39,265 is a fast or basic assessment scan. 52 52 00:01:39,265 --> 00:01:40,667 This is a scan that contains options 53 53 00:01:40,667 --> 00:01:44,130 for analyzing hosts for unpatched software vulnerabilities 54 54 00:01:44,130 --> 00:01:46,080 and configuration issues. 55 55 00:01:46,080 --> 00:01:49,050 Now, when we talk about this fast or basic assessment scan, 56 56 00:01:49,050 --> 00:01:50,519 it looks something like this. 57 57 00:01:50,519 --> 00:01:51,780 When you go to set it up, 58 58 00:01:51,780 --> 00:01:53,616 you're going to give it a name, give it a description, 59 59 00:01:53,616 --> 00:01:55,230 give it a place to save, 60 60 00:01:55,230 --> 00:01:56,343 list out the targets that you want to use, 61 61 00:01:56,343 --> 00:01:58,159 all the different IP addresses, 62 62 00:01:58,159 --> 00:02:02,040 and then, you're going to go ahead and save it and off you go. 63 63 00:02:02,040 --> 00:02:03,390 You'll pick out which plugins you want, 64 64 00:02:03,390 --> 00:02:04,890 which credentials if you want to use a credentialed 65 65 00:02:04,890 --> 00:02:05,838 or non-credentialed scan, 66 66 00:02:05,838 --> 00:02:08,250 and it will go out and do its scan. 67 67 00:02:08,250 --> 00:02:10,614 It's going to find anything that has a minor vulnerability 68 68 00:02:10,614 --> 00:02:13,290 and any kind of minor configuration issues. 69 69 00:02:13,290 --> 00:02:14,203 Now, these aren't really in-depth, 70 70 00:02:14,203 --> 00:02:15,873 but they are going to do a basic scan, 71 71 00:02:15,873 --> 00:02:18,815 meaning it's going to look at a couple of plugins. 72 72 00:02:18,815 --> 00:02:20,760 When you do this under the plugins tab, 73 73 00:02:20,760 --> 00:02:23,340 you'll actually select which ones you want to use. 74 74 00:02:23,340 --> 00:02:24,391 If you're doing a more intense scan, 75 75 00:02:24,391 --> 00:02:26,550 you'll select every single plugin, 76 76 00:02:26,550 --> 00:02:27,810 but for a fast or a basic scan, 77 77 00:02:27,810 --> 00:02:29,071 it's going to use the information 78 78 00:02:29,071 --> 00:02:31,140 it got from the discovery scan. 79 79 00:02:31,140 --> 00:02:32,485 It'll know that this is a Windows system 80 80 00:02:32,485 --> 00:02:34,466 versus a Linux system, for instance, 81 81 00:02:34,466 --> 00:02:38,010 and it will select the right plugins for that host. 82 82 00:02:38,010 --> 00:02:39,526 Because if you're going to be scanning a Linux system, 83 83 00:02:39,526 --> 00:02:42,300 there's no reason to have the Windows plugins enabled, 84 84 00:02:42,300 --> 00:02:43,307 so you'll disable those, 85 85 00:02:43,307 --> 00:02:45,390 and that will save you a lot of time. 86 86 00:02:45,390 --> 00:02:48,420 That's the idea of a fast or a basic scan. 87 87 00:02:48,420 --> 00:02:49,821 Now, the next one we can do is what's known 88 88 00:02:49,821 --> 00:02:51,998 as a full or deep scan. 89 89 00:02:51,998 --> 00:02:54,148 Now, when you deal with a full or deep assessment scan, 90 90 00:02:54,148 --> 00:02:56,190 this is a comprehensive scan 91 91 00:02:56,190 --> 00:02:58,440 that forces the use of more plugin types. 92 92 00:02:58,440 --> 00:02:59,273 It's going to take you you a lot longer 93 93 00:02:59,273 --> 00:03:00,960 to conduct this host scanning 94 94 00:03:00,960 --> 00:03:03,900 and it has more risk of causing a service disruption. 95 95 00:03:03,900 --> 00:03:06,450 For instance, you might turn off that safe scan function 96 96 00:03:06,450 --> 00:03:08,730 and test every single plugin you have 97 97 00:03:08,730 --> 00:03:11,190 even though they may crash a system. 98 98 00:03:11,190 --> 00:03:12,682 Now, full and deep assessment scans 99 99 00:03:12,682 --> 00:03:15,030 will ignore your previous scan result 100 100 00:03:15,030 --> 00:03:17,891 and they are going to fully rescan every single host. 101 101 00:03:17,891 --> 00:03:19,193 This is actually one of the nice things 102 102 00:03:19,193 --> 00:03:21,690 about some of the fast or basic scans 103 103 00:03:21,690 --> 00:03:23,278 is that if you've done a scan on that host before 104 104 00:03:23,278 --> 00:03:25,723 and it already knows that this vulnerability doesn't exist 105 105 00:03:25,723 --> 00:03:27,016 because you've patched it, 106 106 00:03:27,016 --> 00:03:29,370 it'll skip that and save you some time. 107 107 00:03:29,370 --> 00:03:31,230 Now, a full or deep scan won't do that. 108 108 00:03:31,230 --> 00:03:32,806 It will ignore any previous scan you did 109 109 00:03:32,806 --> 00:03:35,730 and it scans everything as if it was the first time, 110 110 00:03:35,730 --> 00:03:37,975 really intrusively and really in-depth. 111 111 00:03:37,975 --> 00:03:39,600 The last type of scan we have 112 112 00:03:39,600 --> 00:03:41,550 is what's known as a compliance scan. 113 113 00:03:41,550 --> 00:03:43,098 Now, a compliance scan is a scan 114 114 00:03:43,098 --> 00:03:46,140 that's based on a compliance template or a checklist, 115 115 00:03:46,140 --> 00:03:47,270 and this is going to ensure the controls 116 116 00:03:47,270 --> 00:03:49,325 and configuration settings are properly applied 117 117 00:03:49,325 --> 00:03:51,540 to a given target or host. 118 118 00:03:51,540 --> 00:03:53,670 Now, what's a great example of a compliance scan? 119 119 00:03:53,670 --> 00:03:56,580 Well, the one I'd love to think about is PCI DSS. 120 120 00:03:56,580 --> 00:03:57,413 Here, for example, 121 121 00:03:57,413 --> 00:04:01,250 you can see a template for a PCI DSS quarterly external scan 122 122 00:04:01,250 --> 00:04:03,060 that you can run inside a Nessus. 123 123 00:04:03,060 --> 00:04:05,220 There's really no configuration you have to do 124 124 00:04:05,220 --> 00:04:07,473 except tell it, give it a name, give it a description, 125 125 00:04:07,473 --> 00:04:09,780 and tell it which target you want to hit, 126 126 00:04:09,780 --> 00:04:12,316 and it will go out and it will do that scan for you. 127 127 00:04:12,316 --> 00:04:14,253 It's going to know exactly which plugins to look for, 128 128 00:04:14,253 --> 00:04:16,108 exactly which configurations to look for 129 129 00:04:16,108 --> 00:04:17,580 because this is a scan 130 130 00:04:17,580 --> 00:04:19,230 that anybody who uses credit cards 131 131 00:04:19,230 --> 00:04:21,840 has to run across their networks once a quarter. 132 132 00:04:21,840 --> 00:04:23,518 And so, this is something that is very well known 133 133 00:04:23,518 --> 00:04:25,013 and so they build it right into the tool. 134 134 00:04:25,013 --> 00:04:27,036 This is the idea of using a compliance scan 135 135 00:04:27,036 --> 00:04:29,040 using a template like this. 136 136 00:04:29,040 --> 00:04:30,669 Now, some external compliance organizations 137 137 00:04:30,669 --> 00:04:33,780 require scanning frequencies at a certain time. 138 138 00:04:33,780 --> 00:04:36,390 I've already mentioned PCI DSS is one of them. 139 139 00:04:36,390 --> 00:04:37,223 This is actually one 140 140 00:04:37,223 --> 00:04:39,540 that they like to ask about on the exam sometimes. 141 141 00:04:39,540 --> 00:04:41,552 If you see PCI DSS on the exam, 142 142 00:04:41,552 --> 00:04:43,455 the answer is a quarterly scan. 143 143 00:04:43,455 --> 00:04:44,340 If they ask, 144 144 00:04:44,340 --> 00:04:47,130 which of these regulatory things requires a quarterly scan? 145 145 00:04:47,130 --> 00:04:49,470 The answer is PCI DSS. 146 146 00:04:49,470 --> 00:04:50,303 On the exam, 147 147 00:04:50,303 --> 00:04:51,821 there is no other regulatory requirements 148 148 00:04:51,821 --> 00:04:53,670 that they require you to memorize, 149 149 00:04:53,670 --> 00:04:56,308 but for some reason, they'd love to ask PCI DSS, 150 150 00:04:56,308 --> 00:04:58,374 and it's probably because almost every organization 151 151 00:04:58,374 --> 00:04:59,670 uses it these days 152 152 00:04:59,670 --> 00:05:01,410 because if you accept credit cards, 153 153 00:05:01,410 --> 00:05:03,907 you fall subject to PCI DSS.