Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Web Services Indicator Dashboard

The same services we use to connect our networks to the vast resources of the internet can be used against us if not properly secured. Many of the most effective exploits leverage vulnerabilities in common web services, making our jobs more difficult because connectivity is synonymous with exposure. Finding the balance between easy access to resources and securing the network against exploitation is a major challenge that every organization faces, but one that Tenable can help overcome. With the Web Services Indicator dashboard in Tenable.io™, the information you need to earn leadership support to strengthen network defenses against web service exploitation is at your fingertips.

Web Services Indicator Dashboard

Locating the links

The Malicious URL matrix in the Web Services Indicator dashboard counts detections of HTTP and HTTPS that link to malicious content. The matrix leverages the Web Site Links to Malicious Content Nessus plugin (ID 52670) to detect website URLs that link to malicious sources. Since malware is so often distributed via web traffic, you should look into the causes for these detections promptly.

The easiest way to learn more about the hosts with links to malicious content is to apply an Advanced Filter to the Vulnerabilities workbench. Using a filter for plugin ID 52670 will present a list of all hosts on which the plugin detected malicious links:

Vulnerabilities Workbench

Advanced filter for plugin ID

You can find lots of useful details on the drill-down page for a specific result. This includes the plugin description as well as the assets the activity was detected on. Plugin output, when the result was first seen, reference information, and links to more information may also be included. Often most importantly, solutions for remediating detected vulnerabilities are given.

The cells in the External URL Indicator matrix turn purple when a URL containing the specified Uniform Resource Identifier is discovered during a scan. The matrix uses the External URLs active plugin (ID 49704) to identify over 150 URIs on hosts. Common URIs include http, ftp, and about. URIs are typically the first section of a URL, followed by a colon and two slashes. If you notice results for unexpected URIs, you should investigate the source to ensure that only reliable and authorized external URLs are being accessed. Often, these results will just be links to a company’s additional resources in their support documentation. However, malware regularly contains URLs that are called back or connected to, so keeping an eye on these results is the safest bet.

Spotting the services

The Web Internet Services dashboard matrix provides indicators for the detection of 30 unique web services. The matrix uses the Web Servers plugin family to filter for plugins of particular concern, and the cells turn purple when a specific service or vulnerability is detected. I would recommend monitoring this information closely, since the presence of unexpected or unapproved web services could be indicative of an unauthorized or misconfigured device connecting to the network.

You can use an Advanced filter on the Vulnerabilities workbench to find detailed information about specific results. Applying a plugin family filter for the Web Servers family will display all the results reflected in this matrix. Adding a plugin name filter for keywords related to particular services will help you isolate the hosts causing a single indicator to turn purple.

Advanced Filter for plugin family names

The SSL Plugins matrix narrows the focus to detections and vulnerabilities related to TLS and SSL. Using filters for plugin ID, CVE ID, and plugin output, the 30 cells change color when specific TLS- or SSL-related vulnerabilities are detected. Since TLS and SSL are so commonly exploited, I like to keep a keen eye on these results. In a single glance I can get an overview of whether these protocols are being used and whether they are vulnerable to exploitation.

Validating the vulnerabilities

The Web Service Vulnerabilities by Port matrix displays the counts of detected vulnerabilities for specific web service ports by severity. The columns break out the counts by severity as well as exploitability to give you a clearer understanding of vulnerability. HTTP/HTTPS, HTTP Management, Proxy, SOAP, and VNC services are specifically identified by port number. You will likely want to prioritize the identification and remediation of hosts that have critical or exploitable vulnerabilities; use Advanced filters to track down hosts that use specific ports and have critical or exploitable vulnerabilities.

Web Service Vulnerability by Port matrix

The Hosts with Web Service Vulnerabilities by Plugin Family matrix provides counts of plugin results from four different families by severity. The four families included are CGI Abuses, Databases, FTP, and Web Services. The columns display counts for each severity as well as for exploitability. By prioritizing the areas with critical and exploitable vulnerabilities, I can more effectively secure my network against intrusion and infection. Oftentimes simply applying the patches, updates, or upgrades needed to remediate a critical vulnerability will also take care of others.

To track down the most severely impacted hosts, use an Advanced filter for the plugin family, severity, or exploitability. This can help to identify the hosts that are affected by relevant vulnerabilities and give insight into how to respond:

Advance Filter for multiple factors

A variety of other Advanced filters can be used to investigate scan results related to web services. For example, adding a filter for CPE, hostname, or vulnerability state can help to focus efforts on securing web services in your environment.

Reducing risk

As you have likely inferred through reading this review of the Web Services Indicator dashboard, the primary goal is the ability to monitor the degree of vulnerability due to web services. Gaining insight into the available links, malicious and benign, enables you to ensure that your users can connect where they need to without exposing your organization to exploitation. The information in this dashboard also enables you to detect outdated configurations that should be targeted for removal or upgrade in order to dramatically reduce the risk of exploitation. With the ability to focus the lens on web service vulnerabilities by port, protocol, or plugin family, you can be ready to demonstrate where the organization’s greatest risk lies. By gathering all this insight, you can be prepared to enlighten your organization’s leadership and garner the support you need to effectively defend your network.

Try Tenable.io

Tenable.io provides accurate information on how well your organization is addressing security risks, and helps track improvements over time. Try Tenable.io Vulnerability Management free for 60 days.

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training