1. Office of the Vice President Copyright Notice Copyright Greg Hedrick, Matthew Wirges 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the authors. To disseminate otherwise or to republish requires written permission from the authors.

2. Office of the Vice President Vulnerability Scanning Cluster (VSC)

3. Office of the Vice PresidentIntroduction Greg Hedrick, CISSP Manager, Security Services Matt Wirges IT Security and Privacy Analyst

4. Office of the Vice President VSC Agenda  Motivations  Design and Implementation of the VSC  Problems Encountered  Current and Future Development  Summary  Resources  Questions

5. Office of the Vice President VSC Motivations  CERIAS Ability to review or perform vulnerability scans in incident response/analysis.  ITSP Centrally organize scanning reports. Increase computing power required for vulnerability scanning especially simultaneous scanning. Provide necessary bandwidth for scanning the entire campus, for example. Make it self-serve. Scan when necessary. No internal Security development skills.

6. Office of the Vice President VSC Design Three main components  Web Interface  Scanning Queue  Scanning Cluster

7. Office of the Vice President VSC Implementation  Web Interface  Scanning Queue  Scanning Cluster Nessus LVS Cluster configuration

8. Office of the Vice President VSC Implementation

9. Office of the Vice President VSC Implementation

10. Office of the Vice President VSC Implementation

11. Office of the Vice President

16. VSC Problems Encountered  Many problems encountered with testing version 1.0 and follow-up production version 1.1 Web Interface Scanning Queue Scanning Cluster

17. Office of the Vice President VSC Current and Future Work  Development towards VSC 2.0 Adds many new features Attempts to fix most of the problems encountered with initial releases  Redeployment of VSC production environment

18. Office of the Vice President VSC 2.0  Redesigned interface Better layout, smarter navigation More consistent widgets More efficient management of scanning policies and plugins Abandon Nessus report formats for customizable report generation Overhaul people management Abandon PHP OOP in favor of database interface libraries; result is a quicker application, but still easy to develop with

19. Office of the Vice President VSC 2.0  Redesigned queue PHP dropped in favor of a Perl daemon Nessus client abandoned in favor of Net::Nessus::ScanLite module Allows the queue to talk directly to the scanner server Results stored directly in database in custom tables to allow easy lookup of data Many cron-based tasks (plugin nightly updates) and resource consuming tasks from web interface moved to Perl daemon (i.e. DNS lookup, NetBIOS name querying)

20. Office of the Vice President VSC 2.0 CVS  Features already implemented Redesigned page layout; better presentation of menus Increased usability of management interfaces Expanded policy and scan-time configuration options for the Nessus scanner DNS and NetBIOS lookups for hosts Rewritten scan queue in Perl; added many enhancements to scheduling algorithm Policy weighting Scan priorities Hosts scanned in batches, rather than one at a time NetBIOS lookups (where applicable) at scan time to correlate scan results with DHCP hosts

21. Office of the Vice President VSC 2.0 Development  Features in development Enhanced scan reporting tool Customizable Differential Available in a variety of formats Ability to pause scans Better LDAP integration

22. Office of the Vice President VSC Summary  Benefits Free  More to do

23. Office of the Vice President VSC Resources  Vulnerability Scanning Cluster homepage: http://vscweb.sourceforge.net VSC 1.99 Preview Release CVS repository Help us out! Bug reports, feature requests, development contributions!  Linux Virtual Server software http://www.linuxvirtualserver.org  Nessus Vulnerability Scanner http://www.nessus.org

24. Office of the Vice President VSC Resources  VSC Development List Questions Bugs Development discussion vscweb-devel@lists.sourceforge.net  General Questions itap-vsc@purdue.edu hedrick@purdue.edu wirges@purdue.edu

25. Office of the Vice PresidentQuestions

26. VSC Current and Future work

27. Office of the Vice President VSC Current and Future work

28. Office of the Vice President