Vulnerability Management and Patching

Vulnerability Management and Patching Activities

  • Vulnerability management is defined as an ongoing, risk-based approach to discovering, prioritizing, and remediating vulnerabilities and misconfigurations within an environment.

  • This process is not simply a matter of finding every vulnerability and fixing it immediately. It involves an assessment of the level of severity associated with each vulnerability to inform the specific remediation strategy.

  • Software deployment inherently involves vulnerabilities; they are a constant factor after deployment, and new ones are discovered continuously.

  • Patching refers to the specific act of fixing these identified vulnerabilities.

Vulnerability vs. Risk: Definitions and Assessment

  • A vulnerability is defined as a weakness or a hole in a defense system that can be exploited by an adversary.

  • Risk is distinct from vulnerability and is calculated by considering two primary factors:

    1. The likelihood of the vulnerability being exploited.

    2. The impact of the exploitation if it were to occur successfully.

  • Relationship of Likelihood and Impact:

    • Vulnerabilities can possess low likelihood and high impact.

    • Vulnerabilities can possess high likelihood and low impact.

    • Vulnerabilities can be high or low in both categories.

  • Comparison Example:

    • Scenario A: A vulnerability allowing remote code execution on a Virtual Machine (VM) situated behind a firewall or in an internal network.

    • Scenario B: A vulnerability on a public-facing server.

    • Assessment: Scenario B is significantly more important to remediate because it is easier for an adversary to reach the point where exploitation is possible.

Asset Discovery and Endpoint Management

  • Vulnerability management is a continuous, early-stage process rather than a one-time event.

  • Asset Discovery involves identifying the landscape of the network, specifically finding out which systems and services are present.

    • It identifies hosts within a network.

    • It identifies specific services running on those hosts.

    • It identifies the versions of those services.

  • Common Tools for Asset Discovery:

    • Microsoft Defender: Used for identifying vulnerabilities and managing endpoints on Windows systems.

    • Zeke and Suricata: Network monitoring tools that can assist in discovery.

    • nMap: A simple Unix-based tool used for network scanning and host detection.

  • Asset Management involves the central administration of endpoints to identify vulnerabilities and remediate them from a single location.

    • Wazuh: An open-source SIEM (Security Information and Event Management) tool that can be used for asset management and vulnerability identification.

Practical Asset Discovery and Service Scanning using nMap

  • nMap is utilized for asset discovery to identify active hosts (endpoint devices) on a network that can receive traffic.

  • Scanning Process:

    • A scan was performed on a network prefix to look for active hosts. Looking for hosts in a range of $1000$ IP addresses was conducted.

    • In one office scan instance, $6$ available hosts were identified from the range.

  • Service Discovery:

    • Once a host is identified (e.g., a specific IP address), nMap scans the $1000$ most common ports by default.

    • In a specific test scan, four ports were found available:

      1. Port 2222: Running SSH (specifically the Dropbear SSH daemon).

      2. Port 5353: Providing DNS services (identified as Cloudflare public DNS).

      3. Port 8080: HTTP web traffic.

      4. Port 443443: HTTPS web traffic.

    • Further scanning determined that the web services (Ports 8080 and 443443) were hosted via the NGINX web server version 1.17.71.17.7 running on a Linux OS.

    • Accessing the IP via a browser revealed an admin console for a router device.

Vulnerability Enumeration and Software Inventory

  • Vulnerability Enumeration involves listing attributes of the network, including Operating Systems (OSs) on endpoints, applications running, and open ports, to create a profile of available assets.

  • Mapping: The list of identified services and applications is mapped against known vulnerability databases.

  • Methods of Enumeration:

    • Non-authenticated (Remote) Enumeration: Poking the system from the outside without logging in to see what is visible.

    • Authenticated Vulnerability Integration: Logging into the device with specific privileges to see deeper into the software stack and report findings.

  • Simplified Workflow:

    1. Asset Discovery: Finding what is out there.

    2. Software/Service Identification: Determining what is running.

    3. Vulnerability Identification: Determining which vulnerabilities apply by comparing identified software against known vulnerability lists.

    4. Prioritization: Determining the cost and benefit of fixing specific items.

    5. Remediation: Implementing a plan to patch, mitigate, or remove the service.

Software Bill of Materials (SBOM) and Scanning Tools

  • Software Bill of Materials (SBOM) is a machine-readable inventory (often in JSON format) of all software components running on an endpoint. It allows other programs to ingest the data to check for vulnerabilities when new ones are exposed.

  • Syft: An open-source command-line tool used for automatically generating SBOMs. It can scan images (like Docker), directories, or entire file systems (e.g., scanning the root directory).

  • Juice Shop: An intentionally insecure web application created by OWASP, used for testing vulnerability tools. Scanning a Juice Shop Docker image with Syft reveals various NPM packages with specific version numbers.

  • Grype: An open-source tool that takes an SBOM as input and compares it against known vulnerability databases to identify affected packages.

  • Grype Output Data Fields:

    • Name: The software package name.

    • Installed Version: The current version running.

    • Fixed In: The version number required to remediate the vulnerability.

    • Vulnerability ID: Specifically CVE (Common Vulnerabilities and Exposures) IDs or GHSA (GitHub Security Advisory) IDs.

    • Severity: An estimate of the consequences if the vulnerability is exploited.

    • EPSS (Exploit Prediction Scoring System): Estimates the probability of exploitation within the next $30$ days.

    • Risk: A combination of likelihood (EPSS) and impact (Severity).

Standardized Vulnerability Identification Systems

  • Vulnerabilities are discovered by software companies and security researchers. Researchers typically notify vendors before publishing papers to allow for a fix.

  • Common Identifiers:

    • CVE (Common Vulnerabilities and Exposures): A tag or identifier for a vulnerability; it does not indicate severity, only a naming convention.

    • CVSS (Common Vulnerability Scoring System): Provides a severity score on a scale from 11 to 1010. A score of 1010 is considered critical, exploitable remotely without login, and resulting in high impact.

    • CISA KEV (Known Exploited Vulnerabilities Catalog): Maintained by the US Cybersecurity and Infrastructure Security Agency. It lists exploits with actual evidence of being exploited in the real world, distinguishing them from theoretical or proof-of-concept exploits.

  • Prioritization Refinement: A high CVSS score (e.g., 9.89.8) on an internal test VM that is difficult to reach and has no history of real-world exploitation may be less of a priority than a lower-severity vulnerability on a public-facing port that is actively being exploited.

SSVC Decision Framework

  • Stakeholder-Specific Vulnerability Categorization (SSVC): A decision tree proposed by CISA to assist in moving from identifying an exploit to determining an outcome.

  • The system walks through five major decisions:

    1. Exploitation: Is it theoretical, proof-of-concept, or active in the real world?

    2. Automatable: Can the exploit be automated, or does it require a human at a terminal?

    3. Technical Impact: What happens to the machine if affected?

    4. Environment/Mission Well-being: How many other systems does it touch and what is the overall harm potential?

  • Outcomes of SSVC:

    • Track: Monitor the situation.

    • Track Star.

    • Attend.

    • Act: Immediate remediation.

  • Example: A Linux Kernel exploit (allowing local users root access via a specific module) would be analyzed as:

    • Exploitation: Active (it is in the KEV).

    • Automatable: No (requires the user to already be on the system).

    • Technical Impact: Total (provides root privileges).

    • Mission Well-being: Medium (context-dependent, e.g., a research service versus a safety service).

    • Result: Typically categorized as "Attend."

Automated Application Security Testing

  • Application Security Testing involves tools that poke and prod an application to find vulnerabilities.

  • ZAP (Zed Attack Proxy): An OWASP-developed tool that performs numerous HTTP requests against a website to find vulnerabilities.

  • Scan Characteristics:

    • Can be time-intensive; a scan on the Juice Shop application can take approximately $30$ minutes.

    • Produces alerts categorized by risk levels (High, Medium, etc.).

    • Provides recommended solutions for identified problems.

NIST Vulnerability Life Cycle and Remediation

  • The NIST (National Institute of Standards and Technology) recommends a high-level lifecycle for vulnerability management:

    1. Identification: Discovering the problem.

    2. Response Planning: Prioritizing using methods like SSVC and deciding on implementation.

    3. Implementation: Executing the fix.

  • Remediation Options:

    • Patching: Updating the software.

    • Mitigation: Reducing the risk without a full patch.

    • Removal: Getting rid of the service.

  • Interim Risk Reduction: Temporary fixes used when immediate patching is impossible (e.g., software is end-of-life, business dependencies prevent downtime, or no patch is available).

    • Disabling specific features.

    • Implementing firewall rules.

    • Moving the asset to a different, isolated network segment or firewall zone.

Questions & Discussion

  • Question: In individual reports, is a meta-analysis or summary report required?

  • Response: A summary is a necessary component, but the report must involve a substantial analytical component. The student must synthesize inputs from other works to do something methodical. A meta-analysis is acceptable as long as it is more than just a summary; it must notice gaps or suggest future research directions carefully and methodically.

  • Question: Is original work or a major problem solution expected?

  • Response: Students are not expected to solve major global security problems or invent complex new theories in a few weeks. The goal is a humble and modest approach. A contribution consists of a careful, methodical look at existing information to identify a gap that has not been explored, which is significant in itself. The project should be based on topics that interest the student to ensure an enjoyable exploration within the provided time constraints.