Tenable Blog

Welcome to the Tenable Network Security Podcast - Episode 45

Hosts: Paul Asadoorian, Product Evangelist & Kelly Todd, Compliance Analyst

Announcements

• Several new blog posts have been published this week, including:
  • Blackhat 2010 Round Up -
  • Security Metrics - Is This Network Getting Better?
• The new course titled "Advanced Vulnerability Scanning Techniques Using Nessus" is now being offered at BruCon 2010. It's a two-day course that will put students into a real-world environment where they will have to solve problems and identify vulnerabilities using the advanced features of the Nessus vulnerability scanner.
  
• Be certain to check out our video channel on YouTube that contains the latest Nessus tutorials.


• We're hiring! - Visit the web site for more information about open positions. There are currently 10 open positions listed:
• Sales Engineer
• Regional Sales Manager
• Inside Sales Representative
• Tenable Nessus Trainer
• Customer Support Engineer
• Quality Assurance Analyst/Engineer
• Compliance Auditor
• Vulnerability Research Engineer
• Linux Appliance Engineer
• Flex/Flash Developer
• You can subscribe to the Tenable Network Security Podcast on iTunes!


• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, Nessus plugin statistics and more!

Tenable was in attendance for Black Hat 2010 in Las Vegas last week. In addition to having a vendor’s booth, we presented four days of Nessus training, our very own Carole Fennelly organized Hacker Court and we hosted a party at Margaritaville. Below are some pictures and more details on the events:

Intro

The first time I was asked to scan a Class B network, my initial reaction was “Are you kidding me?” I actually thought it was a trick question to see how I reacted to unexpected situations. I had just two weeks to develop a strategy and perform the scan. This seemed to be a daunting task.

Ten years later, I had provided assessments for Class B (or bigger) networks over a dozen times, mostly for government agencies and the occasional university. Performing an audit of tens of thousands of IP addresses is no different from any other audit, unless time is restrictive. Large IP blocks in small time periods require you to revise your normal assessment methodology. Where you typically scan 65,535 ports on a machine, you may only be able to scan a dozen or two. Instead of examining every open port on a machine, time constraints may force you to focus on low-hanging fruit and services that are prone to high-risk vulnerabilities.

Developing a Methodology

Thinking about the polar opposites in assessment, you have a single IP address on one side, and a Class B network on the other. Adjusting your methodology to account for the number of machines becomes a balancing act between allotted time and number of targets. As the number of systems to scan increases, while the time allocated to scan remains constant, the amount of time per system must decrease.

Cars, Cell Phone, GPS, and Blenders.... Oh My!

I recently read an article titled, 10 Everyday Items Hackers Are Targeting Right Now. It was quite the list, and while possibly a bit far-fetched, it made me think about security in the context of these devices as they relate to enterprise security:

1. Your Car - Your company may have vehicles, and certainly a good percentage of your employees drive to work every day. The security implications surrounding company vehicles are not something you need to lose sleep over now, but you may want to keep an eye on this for the future. I had some fun with injecting audio into Bluetooth systems on cars some time ago. While this is a neat “party trick", there is no immediate security threat to your organization's data via audio injection attacks. However, what if I told you I was able to listen to conversations happening in the car? This might be a threat, especially if your executives like to have conversations on the way to work with clients, potential customers or each other. If we take this a step further, what if Wifi systems inside cars could be compromised and used as a trojan horse to get within wireless proximity of a secure building? I don't think this is something that most organizations need to take proactive steps to prevent today, but high security facilities could possibly be infiltrated this way some time in the near future (of course, you could also attach a device to the car that is authorized to enter the secure facility).

Web application auditing is really difficult if you don’t know about the presence of a website or specific application. You may not know about a web server. You may not know what applications run on that single web server. You may even have malicious websites installed on your network by malware or Trojans. Nessus is great for scanning and finding web servers, even on uncommon ports, but you need to scan often to get the most benefit. Fortunately, Tenable’s Passive Vulnerability Scanner (PVS) can discover new web servers and all of their active web sites in real-time and without any impact to your network. This blog discusses how the PVS can be used to audit networks to find all authorized and malicious websites in use.