1. Vulnerabilities

2. flaws in systems that allow them to be exploited provide means for attackers to compromise hosts, servers and networks

3. Vulnerabilities 2 flavors bugs – programming mistakes Errors in code that could cause a system to hang to an insecure state or allow root access Incorrect firewall/router/IDS rules flaws – improper design failing to account for all possibilities in design leads to code with vulnerable ‘features’

4. Vulnerabilities 2-edged sword publishing vulnerabilities and patches is only way to fix problem once published – the network of hackers is aware of the vulnerability patch management is a MAJOR security problem! zero-day vulnerability – a new, or unknown, vulnerability

5. Vulnerabilities ‘Security by Obscurity’ attempts to use secrecy to prevent knowledge of vulnerabilities vendors of proprietary code are often accused of this zero-day attack attack takes place during the window before a patch is available for a vulnerability

6. Between a ‘rock and a hard place’ what do you do if you discover a vulnerability in a product and a patch is not available? do you keep it secret until a patch is developed? this leaves customers vulnerable the vendor may not work to fix it since there is no pressure do you publicize it to put pressure on the vendor? knowing that by doing so you have notified all of the hacker community

7. Between a ‘rock and a hard place’ Example 1: In 2009 Microsoft announced vulnerability in SMB subsystem that could leave servers vulnerable to DOS attack there was no patch yet IT managers had two choices disable SMB – meaning some systems would not work wait for patch and pray there would not be an incident

8. Between a ‘rock and a hard place’ Example 2: in 2008 a Mass. Dist. Judge ordered MIT students to NOT present information at DefCon regarding a vulnerability in the MTA ‘CharlieTicket’ system judge said intent was not to silence students but enforce a reasonable period during which a fix could be found the gag order was overturned, but not until after DefCon had concluded http://www.informationweek.com/news/security/vulnerabilities/210002185

9. Vulnerability Management many strategies for managing vulnerabilities vulnerability scanners vulnerability notification vulnerability information online through CERT vulnerability and penetration testing services these go hand-in-hand with adequate patch management

10. Vulnerability Scanners programs that scan a network, host or application for known vulnerabilities Types port scanner – looks for open ports (nmap) network enumerator – provides information on groups, usernames, shares and services (nmap and nessus) network vulnerability scanner – looks for vulnerabilities in network resources and servers (nessus, SAINT) Web application security scanner – looks for vulnerabilities in Web servers and scripts (SAINT, Metasploit Pro) Database security scanner – Looks for vulnerabilities in DBMS and SQL code (Safety Lab Shadow)

11. Vulnerability Notification many vendors will either mail a notification or post to a Web site when a vulnerability has been found and how to patch it services exist that maintain vulnerability lists for multiple products and will provide notification with many of these you provide a list of the software and versions in your organization

12. Vulnerability Notification examples Vupen Security vulnerability services http://www.vupen.com/english/services/ SecureNet Solutions vulnerability notification service http://www.securenetsol.com/am_trial_term s.html Secundia CSI free for home users http://secunia.com/vulnerability_scanning/p ersonal/

13. Vulnerability Notification CERT (Computer Emergency Readiness Team) at CMU provides weekly list of known vulnerabilities organization security team matches inventory of software and versions to this list http://www.cert.org/advisories/ http://www.us-cert.gov/cas/bulletins/

14. Vulnerability Notification

15. CERT Vulnerability Summary for 12-Sep-2011 Listed 48 ‘high’ vulnerabilities 12 in Adobe acrobat 7 in MS Office 2 in MS Windows 2 in Google Chrome 11 involve buffer overflow 5 involve SQL injection All allow attackers to execute ‘arbitrary code’ All have patches available

16. Vulnerability Notification Example: Vulnerability in Microsoft Office #CVE-2011-1982 Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Office Uninitialized Object Pointer Vulnerability.“ CVSS Severity (version 2.0): CVSS v2 Base Score:9.3 (HIGH) US-CERT Tech Alert #TA11-256A9.3 Impact Subscore: 10.0 Patch available from Microsoft Exploitability Subscore: 8.6

17. Vulnerability Notification Example: Vulnerability in Microsoft Office #CVE-2011-1982 CVSS Version 2 Metrics: Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism Access Complexity: Medium Authentication: Not required to exploit Impact Type:Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

18. Vulnerability Notification Example: Vulnerability in Microsoft Office #CVE-2011-1982 Common Weakness Enumeration: The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program. Full listing of Common System/Software Weaknesses from CERT http://nvd.nist.gov/cwe.cfm#cwes

19. Threats – the counterpart to vulnerabilities Threats exploit vulnerabilities vulnerability – you left your car unlocked threat – criminals going through shopping center parking lots looking for unlocked cars Fortinet’s FortiGuard Center Threat Research and Response Center provides Threat reports and advisories http://www.fortiguard.com/ Awareness of threat landscape can help to prioritize vulnerabilities

20. Top 3 Application Vulnerabilities 1 – Buffer overflow software may not enforce array bounds can allow buffers (arrays used for I/O) to overflow and overwrite code area some malware works this way ‘smashing the stack’ mainly aimed at systems that allow code to be executed with privileged rights best addressed in design and programming patches can often fix this in vendor-supplied software http://www.windowsecurity.com/articles/Analysis_of_Buffer_O verflow_Attacks.html http://www.youtube.com/watch?v=kZZgNnhxA_4http://www.youtube.com/watch?v=kZZgNnhxA_4 (6 min)

21. Top 3 Application Vulnerabilities 1 – Buffer overflow

22. Top 3 Application Vulnerabilities 2 – cross-site scripting code is injected into communications from a Web site most ‘drive-by’ malware uses this method often relies on social engineering to get user to follow link (Banks are especially targeted) Web script writers can validate input and clense output script disabling (although not always practical) use of least-privilege account http://www.ibm.com/developerworks/tivoli/library/s-csscript/

23. Top 3 Application Vulnerabilities 2 – cross-site scripting

24. Top 3 Application Vulnerabilities 3 – SQL injection commands passed through Web form to SQL DBMS can exploit lack of security and gain control of server solution is to add code to validate input http://www.youtube.com/watch?v=jMQ2wdOmMIAhttp://www.youtube.com/watch?v=jMQ2wdOmMIA (3 min)

25. Top 3 Application Vulnerabilities 3 – SQL injection Code uses: “SELECT name FROM users WHERE name=‘ “. param(“name”). “ ‘ AND passwd=‘ “. param(“passwd”). “ ‘ “; Entering ‘ OR “=‘ as name will always generate true condition Solution is to check input for special characters before passing string to SQL engine

26. Vulnerability Management Gartner defines 6 steps for vulnerability management Define policy Baseline the environment Prioritize vulnerabilities Mitigate vulnerabilities Maintain and monitor

27. Patch Management requires coordinated effort knowing which patches are available testing patches scheduling patch installation http://www.patchmanagement.org/pmessentials.asp however – many systems remain unpatched some applications (such as firefox) push patches others (such as adobe) allow users to decide

28. Patch Management although recognized as a major security problem – patch management is seen as a burden by traditional IT management it sucks up resources it adds nothing to the bottom-line http://www.computerworld.com.au/article/44872/p atch_management_burdens_customers/?fp=16& fpid=0

29. Summary Vulnerability management is mainly an issue of sloppy software/system development and sloppy management of IT IT budgets need to reflect the proper maintenance of systems IT development budgets need to provide for security as part of system development life cycle Security staff can help with penetration and vulnerability testing, prioritization, policy development, auditing, etc.