INTRODUCTION

It’s human nature to pay attention to the problems that are big and flashy, attracting lots of interest, such as advanced persistent threat (APT) groups—state-­sponsored attackers. APT-linked attackers have compromised major retailers, financial institutions, and even government networks. But when we focus all of our attention on APTs and other headline-generating activity, we miss basic issues. Even though you have new firewalls protecting your system and powerful traffic-monitoring devices, if you don’t keep up with the bread and butter of your security responsibilities, you’re leaving many chinks in your system’s armor. Neglecting the basics, like keeping your systems updated, can lead to serious consequences.

Consider this example: suppose you’re an information security manager at a medium-sized e-commerce business. You’ve set up firewalls to block incoming traffic except for traffic to internet-facing services on systems in your demilitarized zone (DMZ). You’ve turned on egress filtering to block unauthorized exit traffic. An antivirus is on the endpoints, and you’ve hardened your servers. You believe your system is safe.

But an old web service is running on an outdated version of Tomcat on a Linux server in the DMZ. It’s a relic from an ill-advised foray into selling some of your company’s valuable proprietary data to selected business partners. The initiative failed, but because you made some sales, you had a contractual obligation to keep that server up for another year. At the end of the year, the project was quietly shuttered, but the server is still running. Everyone has forgotten about it. But someone on the outside notices it. An attack comes in from a compromised server in Moldova, and your unpatched Tomcat server is vulnerable to a five-year-old Java issue. Now the attacker has a foothold in your network, and all your protections couldn’t stop it. Where did you fail?

This guide demonstrates the value of strong information security fundamentals. These are the most important components of a successful information security program. Unfortunately, they’re regularly neglected in favor of sexier topics, such as traffic analysis and automated malware sandboxing. Don’t get me wrong; these are great advances in the state of the art of information security. But without a strong grasp of the fundamentals, investment in more advanced tools and techniques is futile.

Who This Book Is For

This book is for security practitioners tasked with defending their organization on a small budget and looking for ways to replicate functionality from commercially available vulnerability management tools. If you’re familiar with vulnerability management as a process, you’ll have a head start. To build your own vulnerability management system, you should be familiar with Linux and database concepts and have some experience in a programming language like Python. The scripts in this book are written in Python, but you can functionally re-create them in whichever modern scripting or programming language you prefer.

Back to Basics

You can consider a number of security topics as foundational, such as authentication management, network design, and asset management. Although these elements might not be exciting or interesting for an analyst to work on, they’re of critical importance.

Vulnerability management is one of the foundational concepts of information security. A perfectly written and configured software package doesn’t exist. Bugs are an inevitable part of software, and many bugs have security implications. Dealing with these software vulnerabilities is a perennial issue in information security; the practice of vulnerability management is required for a baseline level of security that can serve as a trusted foundation upon which to deploy more advanced and specialized tools.

Vulnerabilities affect an organization’s IT infrastructure at all levels, so vulnerability management affects all aspects of an IT security program. Endpoint security relies on workstations and servers being up-to-date with the latest software versions to minimize the attack surface. Zero-day vulnerabilities are always a concern. But removing the low-hanging fruit of known (and sometimes long-standing) vulnerabilities makes it more difficult for attackers to compromise an endpoint and gain a foothold in your environment. Network security does its best to ensure that only necessary traffic passes among internal network segments and to and from the internet. But if systems or network devices contain known vulnerabilities, even otherwise legitimate traffic might contain network-based attacks using known and trusted protocols. Identity and access management (IAM) restricts users to the specific systems and data to which they’re entitled. But if the identity systems are vulnerable, attackers can simply sidestep them.

If your environment has a baseline level of security, any countermeasures you put in place can’t be easily bypassed by exploiting known vulnerabilities. Let’s consider an analogy: after World War I, France tried to protect itself from Germany by building a long line of forts and entrenchments along its German border. It was named the Maginot Line after the French minister of war. But when World War II began, the Germans ignored the barrier by simply going around it, invading France across the Belgian border instead. All of that expensive defensive infrastructure was irrelevant. The same goes for your environment. If it doesn’t have a foundational level of security, any additional countermeasures are no more than a Maginot Line. Attackers can easily avoid them because there is an easier path elsewhere. But by establishing a vulnerability management baseline and maintaining it via an active vulnerability management program, you can trust that additional security measures will add real value to your security program.

Vulnerability Management Is Not Patch Management

Patch management, perhaps in conjunction with a full software configuration management (SCM) system, keeps track of the versions and patch levels of servers and endpoints across an enterprise. It can push patches remotely to keep systems up-to-date. But although traditional patch management and vulnerability management (as described in this guide) share many similarities, the underlying assumptions are very different.

Patch management assumes that patches are available, a patch management system can manage all the devices on the network that need patches, and there is enough time and manpower to apply all patches. But in real environments, it’s very rare for all of these conditions to hold. Devices exist that aren’t managed by the SCM: for example, network devices like routers and firewalls, test machines, abandoned servers, and devices running operating systems that aren’t compatible with SCM agents. All these components are invisible to a typical SCM deployment and could easily become out-of-date without anyone noticing. Even if automated patching is practicable for endpoints, often you must handle servers and network devices manually, because automatically patching a server might lead to downtime when the organization can least afford it. On the other hand, manually patching servers and network devices takes time that overworked IT staff often can’t spare.

Vulnerability management takes a more pragmatic approach. Instead of asking, “How can we apply all of these patches?” vulnerability management asks, “Given our limited resources, how can we best improve our security posture by addressing the most important vulnerabilities?” Vulnerability management looks at the problem through a risk management lens. We start with the full domain of vulnerabilities that exist on networked devices—managed and unmanaged—and determine which of these vulnerabilities present the highest risk to the organization’s security. Once we’ve gathered that data, we have enough information to prioritize patching and remediation activities. If after this process is complete we have the capacity to apply more updates and remediation, so much the better. But by looking at the highest-risk issues first and using our limited time and resources wisely, we can improve the system’s security posture significantly with comparatively little effort.

Main Topics Covered

This technical guide is divided into two main parts: conceptual and practical. In the first part, you’ll learn about the concepts and components of the vulnerability management process. In the second and larger part, you’ll look at a practical approach to building a free or low-cost vulnerability management system. Although you can follow the guide exactly, it’s most important for you to understand the concepts behind each script to adapt it to your own needs. Toward the end of the book, you’ll explore topics you might want to tackle once your vulnerability management system is up and running. One of those topics is purchasing a commercial tool to improve your vulnerability management program when you have the budget to do so.

How This Book Is Organized

Although there’s a natural flow from chapter to chapter and part to part, from theoretical to practical guidance, if you’re an experienced practitioner, you can jump to the specific topics of most interest. Similarly, the scripts naturally build from one to the next. But you can apply them on a piecemeal basis, depending on which tools and processes are already in place in your environment.

A summary of each chapter follows:

Outcomes

This book’s goal is to take you from having no vulnerability management knowledge to having a functional vulnerability management program so you can generate accurate and usable vulnerability intelligence. This intelligence can help you increase your understanding of your organization’s vulnerability landscape and improve the organization’s overall security posture. By working through this guide, you’ll strengthen your organization’s vulnerability management capabilities, which is one of the fundamentals of a successful information security program.

Get the Code

As you are working through the steps to build yourself a vulnerability management system, you can always check the GitHub repository at https://github.com/magnua/practicalvm/. This repository contains all of the code in this book, as well as a few example configuration files that you can use in your own environment. Pull requests and suggestions are welcome!

Important Disclaimer

As is the case with most computer security tools or practices, you can use the tools and techniques in this guide offensively as well as defensively. Scanning can be an adversarial and malicious activity, and you should only perform it on systems (and networks) that you own or those you’ve been authorized to scan. I repeat: do not scan or otherwise probe systems that aren’t yours. Even when used properly, such tools can potentially cause negative outcomes including, in extreme cases, system crash and data loss. Be aware of the potential risks before engaging in any scanning or exploitation-related activity.