No matter how hard you work no matter how much you patch no matter how many security controls you apply
you're not going to know that you're really out of the woods until you check.
And that is what a vulnerability assessment is all about.
A vulnerability assessment is an action we do and we use vulnerability assessment tools to actually
go about that process.
So what I want to do in this episode is actually go through some of the tools we use to reform a vulnerability
assessment.
Now the challenge we run into is that today's infrastructures are complicated.
Not only do we have our local area networks we have wireless we've got cloud servers.
We've got phones we've got all kinds of stuff that can make a aggressive vulnerability assessment very
very challenging.
However there's a lot of tools that are incredibly simple when it comes to vulnerability assessment.
Let me show you right here
so here I'm just running trace route if you take a look I've done a trace route of that total sim dot
com.
And if you look out you can see you know what my internal LAN addresses.
You can see what my forward facing IP addresses my public address.
That's why I've got to Great out.
And you could also see things like for example I'm using Comcast so even a simple tool like trace route
gives me a lot of good information about the network and I can use that as a tool to be part of my assessment.
Now simple tools like this are great but a lot of times we find ourselves in a situation where we want
to use scanning tools.
Now we use the word scanner fairly loosely here.
A lot of times we hear the word port scanner or port analyzer these are all fairly inter connecting
terms.
But let's take a look at a couple of them.
The first one I want to show you is called the Advanced IP scanner.
This is a wonderful freeware tool it's been around forever.
And what I've done is I've had it go through and scanned this network because I ran the traceroute so
I know what the internal network ideas so I'm going to have to run that.
And tools like this will actually not only let me see the systems but it'll tell me what kind of Nic
I got in their MAC address IP address whatever the windows name is for that particular system.
And I can even get a pulldown like this and I can see that this particular system is running a web server
and it's sharing a couple of folders.
Now is this a good thing or a bad thing.
I don't know but I'm going to have to go to that system and actually check it out.
Now Port scanners are not unique to Windows in fact probably one of the most famous ones out there is
the cool Unmap.
So I've got a map running over here on my Linux box.
So and that's a bit of a challenge because unmap to simply call it a port scanners almost unfair it's
an incredibly powerful network discovery tool unfortunately and that takes a little bit of learning.
So you can see you have to type in these fairly esoteric commands and I'm basically telling IMAP to
go out there find everybody on the network and tell me what open ports they're running.
And as you go through it you can see it does all kinds of amazing output as it's going through look
at all these open ports it's discovered lots and lots of open ports and even got different certificates
out there which I'm going to scroll through because I don't want you guys seen my certificates.
But the bottom line is was that these types of tools perform.
Network Discovery Network Discovery is great but network discovery by itself is not really a vulnerability
assessment.
If we go back over and take a look at advanced IP scanner one more time you'll see it's running HTP
but you'll see that it's running.
I guess so it's running the Windows web server.
So is it running the latest version of I guess are we using good passwords.
I don't know that kind of stuff.
So what I need is a more advanced tool beyond a simple port scanner that can actually go into the system
and check this stuff out in detail.
Luckily for us that's a Windows system.
And luckily for us Microsoft provides an amazing tool called the Microsoft baseline security analyzer.
So I've already run and BSA on this system.
So what we're looking at is the Microsoft baseline security analyzer.
Microsoft has built up the famous Microsoft Knowledge Base for decades now.
And the Microsoft Knowledge Base is a list of problems within the Microsoft Windows product line and
the types of patches and fixes that Microsoft has applied over yé these many years.
So tools like inby as a can actually refer to the Microsoft knowledge database and look at the system
that it's run on and make a determination of what vulnerabilities it has.
So as we take a look at this you'll see that it's run security scan and you can see it has the severity
index is red is really bad.
Yellow is be aware this is here.
Green is just informative.
Sophie take a look in great detail.
You can see it says a security update is missing or lots of security updates are missing.
In fact if we come down here automatic updates feature hasn't even been configured.
You're absolutely right because I've turned it off and they're letting me know that there is a problem.
Here's good information for example Windows Firewall is enabled.
But there are exceptions configured Well yeah there is.
Because I needed this system to run some exceptions for some of the programs that it's running.
But what we have here is a tool that knows the Windows operating system knows the applications.
If the Microsoft applications running on it and can give us a report that allows us to do a really good
vulnerability assessment on this particular system.
So tools like MBIA say are fantastic when you've got an individual windows system that you want to check
out.
The problem that we run into though is what are we going to do if I've got an entire network.
What are we going to do if I've got not only Windows systems but Linux boxes and Cisco routers and wireless
access points and all kinds of stuff out there.
In that case we have to turn to what are known generically as vulnerability assessment tools vulnerability
assessment tools are incredibly powerful tools that can go out and look at your entire infrastructure
while none of them are perfect but some of them are pretty good and give you just as we saw with NCSA
for one system it can do it for your entire infrastructure.
There's lots of them out there.
But when we're talking about a simple normal network one like here total seminars We've got one broadcast
domain and we've got a internet service provider connection and we've got a couple of wireless access
points for folks like that.
There's probably three tools that you're going to turn to Nessus by tenable network security.
Next suppose by rapid seven an open VHS which is freeware so it's from the open VHS community.
Now these are all great tools.
To me they're highly interchangeable but I want to show you one in particular and that is open VHS.
Now this is the green bone Security Assistant the green dreamboat security assistant is simply the web
front end for open VHS open VHS itself is running somewhere on my network in a virtual machine.
I don't even care about that.
But what I do is I can get to it and do whatever I need to through this web interface.
All right.
Now what I've done is you see I've actually already scanned one system open VHS would allow me to scan
my entire network it would take a while but it could do it.
However I just scanned one system and I want you to be able to see the output.
So let's take a look at the output here and you'll see just like we saw within the essay you see we've
got the severity indexes but you'll notice that these problems are very very different.
And be the one unspecified remote code execution shadow brokers.
OK where do they get all this stuff.
Basically what takes place is that organizations like for example let me show you right here.
The national vulnerability database create databases of vulnerabilities tens of thousands of vulnerabilities
and these powerful tools like open vs access these databases which are completely free and open to the
public and they will scan a system look for problems that are known for a Windows system.
Check those out and then make a determination of what we need to do.
So it's a very very clever way of handling these things.
And that's where open VHS gets this information.
So does Ness's soda's and Expo's everybody uses these same databases.
The cool part to all this is that a true tool like this isn't going to necessarily fix this stuff.
Remember what we're going to be doing is a vulnerability assessment not a vulnerability repair.
And the only job that these tools have is to let you know that these things are taking place.
It's up to you as an I.T. person to actually make those fixes.