1 00:00:00,020 --> 00:00:00,960 In this lesson, 2 00:00:00,960 --> 00:00:01,793 we're going to discuss 3 00:00:01,793 --> 00:00:04,170 the Security Content Automation Protocol. 4 00:00:04,170 --> 00:00:06,300 Now, the Security Content Automation Protocol, 5 00:00:06,300 --> 00:00:08,640 also known as SCAP, or SCAP, 6 00:00:08,640 --> 00:00:11,010 plays a vital role in maintaining the security posture 7 00:00:11,010 --> 00:00:13,530 of an organization's technology infrastructure. 8 00:00:13,530 --> 00:00:15,540 The Security Content Automation Protocol is 9 00:00:15,540 --> 00:00:16,710 a suite of open standards 10 00:00:16,710 --> 00:00:19,260 that enhances the automation of vulnerability management, 11 00:00:19,260 --> 00:00:20,790 measurement and policy compliance, 12 00:00:20,790 --> 00:00:22,230 evaluation of systems 13 00:00:22,230 --> 00:00:24,570 that are deployed across your organization. 14 00:00:24,570 --> 00:00:26,820 So what exactly is SCAP? 15 00:00:26,820 --> 00:00:27,960 Well, SCAP was developed 16 00:00:27,960 --> 00:00:30,150 by the National Institute of Standards and Technology, 17 00:00:30,150 --> 00:00:31,170 known as NIST, 18 00:00:31,170 --> 00:00:32,910 and is designed to provide organizations 19 00:00:32,910 --> 00:00:33,990 with a standardized approach 20 00:00:33,990 --> 00:00:35,940 to maintaining the security of their systems 21 00:00:35,940 --> 00:00:37,320 and includes a number of components 22 00:00:37,320 --> 00:00:39,660 that are used together to automate security tasks, 23 00:00:39,660 --> 00:00:42,180 including vulnerability scanning, configuration checking, 24 00:00:42,180 --> 00:00:43,950 and software inventory. 25 00:00:43,950 --> 00:00:46,230 Now, the security content automation protocol is 26 00:00:46,230 --> 00:00:49,110 a NIST framework that outlines various accepted practices 27 00:00:49,110 --> 00:00:50,760 for automating vulnerability scanning 28 00:00:50,760 --> 00:00:53,130 by adhering to standards for scanning processes, 29 00:00:53,130 --> 00:00:54,660 results reporting and scoring, 30 00:00:54,660 --> 00:00:56,910 as well as vulnerability prioritization. 31 00:00:56,910 --> 00:00:58,320 SCAP is also heavily used 32 00:00:58,320 --> 00:01:00,420 with internal and external compliance requirements 33 00:01:00,420 --> 00:01:02,130 because of all the different vulnerability scanners 34 00:01:02,130 --> 00:01:05,489 and tools will now support the same SCAP-formatted data. 35 00:01:05,489 --> 00:01:07,710 This makes it really easy to transfer information 36 00:01:07,710 --> 00:01:09,240 from one tool to another tool 37 00:01:09,240 --> 00:01:11,430 because they're all speaking that exact same language, 38 00:01:11,430 --> 00:01:12,510 which we call SCAP. 39 00:01:12,510 --> 00:01:14,550 Now, there are three main languages 40 00:01:14,550 --> 00:01:16,080 that are used inside a SCAP. 41 00:01:16,080 --> 00:01:19,980 These are OVAL, XCCDF, and ARF. 42 00:01:19,980 --> 00:01:23,370 The first one we have is OVAL, which is pronounced oval. 43 00:01:23,370 --> 00:01:26,220 Now OVAL is the Open Vulnerability and Assessment Language, 44 00:01:26,220 --> 00:01:29,310 which is an XML schema for describing system security states 45 00:01:29,310 --> 00:01:32,160 and querying vulnerability reports and information. 46 00:01:32,160 --> 00:01:34,260 OVAL is used to describe the systems information, 47 00:01:34,260 --> 00:01:35,093 the machine state, 48 00:01:35,093 --> 00:01:37,560 and the reporting for a given scan target. 49 00:01:37,560 --> 00:01:39,090 OVAL will allow us to have a consistent 50 00:01:39,090 --> 00:01:40,050 and interoperable way 51 00:01:40,050 --> 00:01:41,610 of collecting and assessing information 52 00:01:41,610 --> 00:01:43,050 about all of our targets, 53 00:01:43,050 --> 00:01:45,690 regardless of what tool's actually used to conduct the scan 54 00:01:45,690 --> 00:01:48,330 and vulnerability assessment of that target. 55 00:01:48,330 --> 00:01:50,790 Second, we have XCCDF. 56 00:01:50,790 --> 00:01:52,140 Now, XCCDF is 57 00:01:52,140 --> 00:01:55,050 the Extensible Configuration Checklist Description Format, 58 00:01:55,050 --> 00:01:56,820 which is also an XML schema, 59 00:01:56,820 --> 00:01:58,590 but this one is used for developing and auditing 60 00:01:58,590 --> 00:02:01,200 best-practice configuration checklist and rules. 61 00:02:01,200 --> 00:02:03,270 Before XCCDF was available, 62 00:02:03,270 --> 00:02:05,130 the best practice guides were long documents 63 00:02:05,130 --> 00:02:06,630 containing step-by-step guidance 64 00:02:06,630 --> 00:02:08,430 that told you exactly what to check. 65 00:02:08,430 --> 00:02:11,070 Each one might include 30 or 40 or 50 pages 66 00:02:11,070 --> 00:02:12,300 of detailed information. 67 00:02:12,300 --> 00:02:13,410 And during an assessment, 68 00:02:13,410 --> 00:02:14,520 you would print out that guide 69 00:02:14,520 --> 00:02:16,800 and then manually check all the steps in that guide 70 00:02:16,800 --> 00:02:18,840 one by one as you went through it. 71 00:02:18,840 --> 00:02:20,910 By migrating to XCCDF, though, 72 00:02:20,910 --> 00:02:23,040 we can now use scanning tools and automation 73 00:02:23,040 --> 00:02:23,970 to check our systems 74 00:02:23,970 --> 00:02:25,860 against those best practice guidelines 75 00:02:25,860 --> 00:02:28,680 using the XCCDF machine-readable format 76 00:02:28,680 --> 00:02:30,210 that can then be applied and validated 77 00:02:30,210 --> 00:02:32,010 using compatible software. 78 00:02:32,010 --> 00:02:33,420 Now, if your software doesn't support 79 00:02:33,420 --> 00:02:35,010 performing these checks automatically, 80 00:02:35,010 --> 00:02:36,660 it can still be used as your checklist 81 00:02:36,660 --> 00:02:38,160 as you're performing the manual steps 82 00:02:38,160 --> 00:02:40,980 and collecting your responses in that software tool as well, 83 00:02:40,980 --> 00:02:44,700 making XCCDF a really great option for you to consider. 84 00:02:44,700 --> 00:02:47,400 The third one we have is known as ARF. 85 00:02:47,400 --> 00:02:50,100 Now, ARF stands for the Asset Reporting Format. 86 00:02:50,100 --> 00:02:51,900 And this is, again, an XML schema. 87 00:02:51,900 --> 00:02:54,600 But it's being used to express information about the assets 88 00:02:54,600 --> 00:02:57,750 and the relationships between the assets and the reports. 89 00:02:57,750 --> 00:03:00,720 The standardized ARF data model is going to help us facilitate 90 00:03:00,720 --> 00:03:03,780 reporting, correlating, and fusing of asset information 91 00:03:03,780 --> 00:03:06,780 throughout and between our different organizations. 92 00:03:06,780 --> 00:03:07,613 ARF is really great 93 00:03:07,613 --> 00:03:09,600 because it's vendor and technology neutral, 94 00:03:09,600 --> 00:03:10,830 and it makes it very flexible 95 00:03:10,830 --> 00:03:14,250 and well-suited to a wide variety of reporting applications. 96 00:03:14,250 --> 00:03:16,080 Now, in addition to these three languages 97 00:03:16,080 --> 00:03:18,450 used by the Security Content and Automation Protocol, 98 00:03:18,450 --> 00:03:20,550 or SCAP, we're also going to be supporting 99 00:03:20,550 --> 00:03:23,250 three different methods of enumerating our assets. 100 00:03:23,250 --> 00:03:26,940 These are known as CCE, CPE, and CVE. 101 00:03:26,940 --> 00:03:29,460 Now first we have CCE. 102 00:03:29,460 --> 00:03:32,280 CCE is the Common Configuration Enumeration. 103 00:03:32,280 --> 00:03:33,750 The CCE is a scheme 104 00:03:33,750 --> 00:03:35,730 for provisioning secure configuration checks 105 00:03:35,730 --> 00:03:37,350 across multiple sources. 106 00:03:37,350 --> 00:03:39,390 Essentially, CCE is a collection 107 00:03:39,390 --> 00:03:41,220 of configuration best practice statements 108 00:03:41,220 --> 00:03:42,930 that allows us to have these configurations 109 00:03:42,930 --> 00:03:44,220 and then use an automated tool 110 00:03:44,220 --> 00:03:47,010 to verify they're actually being properly used. 111 00:03:47,010 --> 00:03:49,470 The Common Configuration Enumeration will then go ahead 112 00:03:49,470 --> 00:03:51,030 and provide us with the unique identifiers 113 00:03:51,030 --> 00:03:53,190 for different system configuration issues. 114 00:03:53,190 --> 00:03:55,860 That way we can quickly and accurately get a correlation 115 00:03:55,860 --> 00:03:56,970 of the configuration data 116 00:03:56,970 --> 00:04:00,000 across multiple information sources and tools. 117 00:04:00,000 --> 00:04:02,130 Second, we have CPE. 118 00:04:02,130 --> 00:04:05,130 Now, CPE stands for the Common Platform Enumeration. 119 00:04:05,130 --> 00:04:07,170 The Common Platform Enumeration is a scheme 120 00:04:07,170 --> 00:04:08,700 for identifying hardware devices, 121 00:04:08,700 --> 00:04:10,800 operating systems and applications. 122 00:04:10,800 --> 00:04:13,350 CPE is written in a machine-readable format 123 00:04:13,350 --> 00:04:16,079 that begins with cpe:/ 124 00:04:16,079 --> 00:04:17,430 and then is a series of information 125 00:04:17,430 --> 00:04:19,079 that's separated by colons. 126 00:04:19,079 --> 00:04:21,480 Now, the standard format of a CPE message is 127 00:04:21,480 --> 00:04:26,480 cpe:/part:vendor:product:version:update:edition:language. 128 00:04:31,800 --> 00:04:34,740 Now, each platform being shared as a CPE will then be sent 129 00:04:34,740 --> 00:04:35,760 in this format. 130 00:04:35,760 --> 00:04:38,400 For example, the part portion of the CPE refers 131 00:04:38,400 --> 00:04:39,750 to whether or not the platform is 132 00:04:39,750 --> 00:04:41,820 actually an operating system, an application, 133 00:04:41,820 --> 00:04:43,050 or a piece of hardware. 134 00:04:43,050 --> 00:04:46,290 And to do this, we list this as either O, A, or H, 135 00:04:46,290 --> 00:04:48,450 depending of if it's an operating system, application, 136 00:04:48,450 --> 00:04:50,010 or piece of hardware. 137 00:04:50,010 --> 00:04:52,020 Third, we have CVEs. 138 00:04:52,020 --> 00:04:55,320 Now, a CVE is the Common Vulnerabilities and Exposures. 139 00:04:55,320 --> 00:04:57,120 The Common Vulnerabilities and Exposures is 140 00:04:57,120 --> 00:04:58,950 a list of records where each item contains 141 00:04:58,950 --> 00:05:00,120 a unique identifier 142 00:05:00,120 --> 00:05:02,850 that's used to describe a publicly known vulnerability. 143 00:05:02,850 --> 00:05:05,970 Each CVE begins with CVE, followed by the year, 144 00:05:05,970 --> 00:05:07,410 and then a unique number. 145 00:05:07,410 --> 00:05:11,190 For example, if you search the CVE of CVE-2017-0144, 146 00:05:14,310 --> 00:05:16,590 this indicates this was a common vulnerability 147 00:05:16,590 --> 00:05:19,350 that was first identified back in 2017, 148 00:05:19,350 --> 00:05:21,690 and it was the 144th vulnerability 149 00:05:21,690 --> 00:05:23,340 that was identified that year. 150 00:05:23,340 --> 00:05:25,710 If you look up the description of this unique vulnerability, 151 00:05:25,710 --> 00:05:26,880 you'll see it's a vulnerability 152 00:05:26,880 --> 00:05:29,250 that affects Microsoft Windows operating systems. 153 00:05:29,250 --> 00:05:32,100 It's associated with an SMB protocol vulnerability. 154 00:05:32,100 --> 00:05:33,690 If you dig into this a little bit more, 155 00:05:33,690 --> 00:05:35,760 you'll start to see a description of the vulnerability, 156 00:05:35,760 --> 00:05:37,710 some references about the vulnerability, 157 00:05:37,710 --> 00:05:39,450 how the vulnerability can be exploited, 158 00:05:39,450 --> 00:05:41,790 and what you can do to stop or patch this vulnerability 159 00:05:41,790 --> 00:05:43,110 on your systems. 160 00:05:43,110 --> 00:05:45,840 Now, this particular CVE is actually pretty well known. 161 00:05:45,840 --> 00:05:47,880 And if you've been in the cybersecurity world for a while, 162 00:05:47,880 --> 00:05:49,650 you've probably heard of the CVE, 163 00:05:49,650 --> 00:05:52,140 which is known as EternalBlue as its nickname, 164 00:05:52,140 --> 00:05:56,430 which is CVE-2017-0144. 165 00:05:56,430 --> 00:05:58,560 Now, technically, EternalBlue is actually the tool 166 00:05:58,560 --> 00:06:00,960 that was used to exploit this SMB vulnerability, 167 00:06:00,960 --> 00:06:03,270 but most people in our industry started using it 168 00:06:03,270 --> 00:06:06,060 interchangeably to call it the EternalBlue vulnerability 169 00:06:06,060 --> 00:06:10,230 when they were talking about CVE-2017-0144. 170 00:06:10,230 --> 00:06:12,000 Now, why do you care about EternalBlue? 171 00:06:12,000 --> 00:06:13,230 What makes it so important? 172 00:06:13,230 --> 00:06:14,760 Well, back in 2017, 173 00:06:14,760 --> 00:06:17,490 this vulnerability was used by the WannaCry ransomware 174 00:06:17,490 --> 00:06:19,680 and it was spreading all over the internet. 175 00:06:19,680 --> 00:06:20,790 WannaCry was assigned 176 00:06:20,790 --> 00:06:22,830 to exploit this specific vulnerability. 177 00:06:22,830 --> 00:06:26,760 So if you looked up CVE-2017-0144 178 00:06:26,760 --> 00:06:27,870 and you followed the suggestions 179 00:06:27,870 --> 00:06:29,820 for installing the hot fix that Microsoft released, 180 00:06:29,820 --> 00:06:32,430 or to disable SMB V1, 181 00:06:32,430 --> 00:06:33,960 this was actually going to make sure 182 00:06:33,960 --> 00:06:36,000 you are not vulnerable to this exploit 183 00:06:36,000 --> 00:06:37,710 because only SMB V1, 184 00:06:37,710 --> 00:06:39,690 or people who missed the software patch, 185 00:06:39,690 --> 00:06:40,830 would be exploited 186 00:06:40,830 --> 00:06:43,740 as WannaCry started spreading across the internet. 187 00:06:43,740 --> 00:06:45,840 Next, we need to talk about how SCAP is going to be used 188 00:06:45,840 --> 00:06:47,430 to provide us with a metric system 189 00:06:47,430 --> 00:06:49,410 that's going to be called the CVSS, 190 00:06:49,410 --> 00:06:51,840 or Common Vulnerability Scoring System. 191 00:06:51,840 --> 00:06:54,690 Now, there are currently multiple versions of CVSS, 192 00:06:54,690 --> 00:06:57,720 but the latest version is CVSS 3. 193 00:06:57,720 --> 00:07:00,810 CVSS 3 is going to be used to provide a numerical score 194 00:07:00,810 --> 00:07:03,510 to reflect the severity of a given vulnerability. 195 00:07:03,510 --> 00:07:05,370 This score ranges from 0 to 10, 196 00:07:05,370 --> 00:07:06,720 and this score will then be translated 197 00:07:06,720 --> 00:07:07,890 into a qualitative rating 198 00:07:07,890 --> 00:07:09,690 of how serious of vulnerability it is 199 00:07:09,690 --> 00:07:13,470 by calling it either none, low, medium, high, or critical. 200 00:07:13,470 --> 00:07:15,300 If you have a CVSS score of zero, 201 00:07:15,300 --> 00:07:16,620 then it's going to be considered none 202 00:07:16,620 --> 00:07:18,360 in terms of its criticality. 203 00:07:18,360 --> 00:07:20,583 If you have a score between 0.1 and 3.9, 204 00:07:20,583 --> 00:07:22,320 it's going to be considered low. 205 00:07:22,320 --> 00:07:24,720 If you have a score between 4.0 and 6.9, 206 00:07:24,720 --> 00:07:26,070 it's considered medium. 207 00:07:26,070 --> 00:07:28,350 If you have a score between 7.0 and 8.9, 208 00:07:28,350 --> 00:07:29,700 it's considered high. 209 00:07:29,700 --> 00:07:31,890 And if you have a score of 9.0 to 10.0, 210 00:07:31,890 --> 00:07:33,480 it's considered critical. 211 00:07:33,480 --> 00:07:34,770 Now, while these scores are helpful 212 00:07:34,770 --> 00:07:35,940 in aiding in your determination 213 00:07:35,940 --> 00:07:37,980 of how critical vulnerability really is, 214 00:07:37,980 --> 00:07:39,720 it does not account for any mitigation 215 00:07:39,720 --> 00:07:42,510 that you may already have in place inside of your networks. 216 00:07:42,510 --> 00:07:45,120 For example, the EternalBlue vulnerability is rated 217 00:07:45,120 --> 00:07:48,450 as an 8.1 on the CVSS 3 scale, 218 00:07:48,450 --> 00:07:50,640 making it a high level of criticality. 219 00:07:50,640 --> 00:07:53,580 But if your network already has SMB V1 disabled 220 00:07:53,580 --> 00:07:56,070 before the exploit for the vulnerability was discovered, 221 00:07:56,070 --> 00:07:56,903 guess what? 222 00:07:56,903 --> 00:07:58,440 You're not subject to this attack 223 00:07:58,440 --> 00:07:59,700 and it would become very low 224 00:07:59,700 --> 00:08:01,410 on your priority list of criticality 225 00:08:01,410 --> 00:08:02,910 in terms of remediation efforts 226 00:08:02,910 --> 00:08:05,160 because you're already protected against it. 227 00:08:05,160 --> 00:08:07,320 Finally, let's discuss the use of SCAP 228 00:08:07,320 --> 00:08:08,400 inside of benchmarking, 229 00:08:08,400 --> 00:08:09,840 which is one of the reasons for using SCAP 230 00:08:09,840 --> 00:08:10,980 in the first place. 231 00:08:10,980 --> 00:08:13,320 Now, a benchmark is a set of configuration rules 232 00:08:13,320 --> 00:08:14,760 for some specific set of products 233 00:08:14,760 --> 00:08:16,200 to provide a detailed checklist 234 00:08:16,200 --> 00:08:17,730 that can be used to secure the systems 235 00:08:17,730 --> 00:08:19,470 back to a specific baseline. 236 00:08:19,470 --> 00:08:21,270 These benchmarks are usually going to be expressed 237 00:08:21,270 --> 00:08:22,560 in the Extensible Configuration 238 00:08:22,560 --> 00:08:23,940 Checklist Description Format, 239 00:08:23,940 --> 00:08:25,590 known as XCCDF, 240 00:08:25,590 --> 00:08:28,260 which is an XML format specifying security checklist 241 00:08:28,260 --> 00:08:30,510 and reporting results of security benchmarks 242 00:08:30,510 --> 00:08:32,340 for your compliance and testing. 243 00:08:32,340 --> 00:08:34,559 Now, there are many SCAP benchmarks available for use 244 00:08:34,559 --> 00:08:36,510 by a variety of different system applications, 245 00:08:36,510 --> 00:08:39,030 including things like Red Hat Enterprise Linux Benchmarks 246 00:08:39,030 --> 00:08:40,409 and the Center for Internet Security's 247 00:08:40,409 --> 00:08:43,049 Microsoft Windows 10 Enterprise Benchmarks. 248 00:08:43,049 --> 00:08:44,280 For example, if you're using 249 00:08:44,280 --> 00:08:46,290 the Red Hat Enterprise Linux Benchmarks, 250 00:08:46,290 --> 00:08:48,720 these provide you a comprehensive set of configuration rules 251 00:08:48,720 --> 00:08:50,640 for Red Hat Enterprise Linux Servers 252 00:08:50,640 --> 00:08:53,010 that includes rules for configuring system authentication, 253 00:08:53,010 --> 00:08:54,180 setting up your firewalls, 254 00:08:54,180 --> 00:08:56,610 configuring your system logging, and much more. 255 00:08:56,610 --> 00:08:59,550 The CIS Microsoft Windows 10 Enterprise Benchmark 256 00:08:59,550 --> 00:09:02,070 will also provide you a set of security configuration rules 257 00:09:02,070 --> 00:09:02,903 by this time 258 00:09:02,903 --> 00:09:05,100 for the Microsoft Windows 10 Enterprise Edition, 259 00:09:05,100 --> 00:09:07,350 which includes rules for the user account control, 260 00:09:07,350 --> 00:09:09,750 data execution prevention, system firewall settings, 261 00:09:09,750 --> 00:09:11,070 and much more. 262 00:09:11,070 --> 00:09:12,270 These benchmarks when used 263 00:09:12,270 --> 00:09:14,670 with a SCAP-compliant tool can help organizations 264 00:09:14,670 --> 00:09:16,980 automate the process of maintaining system security 265 00:09:16,980 --> 00:09:18,930 and ensuring that your systems are configured correctly 266 00:09:18,930 --> 00:09:21,900 and that vulnerabilities are being identified and mitigated. 267 00:09:21,900 --> 00:09:24,420 So remember, the Security Content Automation Protocol, 268 00:09:24,420 --> 00:09:26,370 or SCAP, 269 00:09:26,370 --> 00:09:27,810 is a suite of open standards 270 00:09:27,810 --> 00:09:30,300 designed to automate vulnerability management, measurement, 271 00:09:30,300 --> 00:09:32,340 and policy compliance evaluation. 272 00:09:32,340 --> 00:09:35,130 SCAP benchmarks are set of security configuration rules 273 00:09:35,130 --> 00:09:36,570 for specific sets of products, 274 00:09:36,570 --> 00:09:38,790 and there are three main languages used in SCAP, 275 00:09:38,790 --> 00:09:42,360 including OVAL, XCCDF, and ARF. 276 00:09:42,360 --> 00:09:44,190 When you're using SCAP for benchmarking, 277 00:09:44,190 --> 00:09:46,560 you're usually going to be using the XCCDF, 278 00:09:46,560 --> 00:09:49,470 or Extensible Configuration Checklist Description Format, 279 00:09:49,470 --> 00:09:51,000 with your SCAP-compliant tools 280 00:09:51,000 --> 00:09:52,980 to help your organization to automate the process 281 00:09:52,980 --> 00:09:54,780 of maintaining your system security.