17 posts from February 2012

 

Decoding IPv6: Four Misconceptions that Security Execs Need to Know

IPv6. It’s big, unavoidable, exciting, and concerning… 

The Internet protocol that we’ve come to know and love (IPv4) is about to get a facelift (or, at least a serious shot of HGH). The tech community is bracing for a wild ride ahead -- guaranteed to be riddled with successes, failures, and security snafus as IPv6 is rolled out. In fact, we just saw the first DDoS attack targeting IPv6 networks earlier this month -- making this a very timely topic.

Continue reading "Decoding IPv6: Four Misconceptions that Security Execs Need to Know" »

 

Not All ‘Cybers’ Are Created Equally

By Marcus Ranum, Tenable CSO

 

What do these four terms have in common?

Cyberwar, Cybercrime, Cyberespionage, and Cyberterror.

  • They all start with the word ‘Cyber’
  • They’re all bad stuff
  • And they’re all consistently confused with each other, despite significant differences (and sometimes conflicts) between them

 

Many people already know my position on ‘Cyberwar’ but things have changed significantly over the past four years in IT and physical security, technology, the government, and the military. The actual ‘Cyber’ landscape is much more nuanced than many seem to realize, which has created an unnecessary public perception of extreme vulnerability (which can lead to fear, which can be dangerous).

The people that are fully invested and overly concerned about ‘Cyberwar’ need a deeper understanding of the logistical problems that might make fighting a ‘Cyber’ conflict less than practical. We need to be asking more questions about the motive for different types of attacks.  Are they ‘state sponsored terrorism,’ are they a ‘war crime’ or what?  

And the real question that has me scratching my head; Why are our government(s) investing so much taxpayer money preparing to conduct offensive ‘Cyber’ operations when its technologically and militarily impractical?

I’ll be leading a discussion on this topic TODAY at RSA (February 29 at 8:00 a.m. - ID: HT1-201). Drink your coffee (or your 5-Hour Energy) and come prepared for a discussion.



 

Three Types of Client-side Exploits

We often hear about vulnerabilities in client software, such as web browsers and email applications, that can be exploited by malicious content. The repeated stories about botnets, infected web sites, and viruses which infect us with malicious documents, movies, and other content have ingrained the concept of an exploitable client in our minds. Unfortunately, client software can also be targeted with attacks from compromised servers accessed by the clients, and some client software actually listens for connections. In this blog entry, we will discuss auditing client software for vulnerabilities and describe the three different types of client-side exploits and how they can impact the risk of your network.

Continue reading "Three Types of Client-side Exploits" »

 

At RSA: New data reinforces intimate stories of career stress and burnout

In the last year, I’ve been part of a panel of security experts that has gathered at various security events to share what we’ve learned about stress and burnout in the IT security industry, and to help people identify when they, or somebody they know, are at risk. We’ve conducted surveys to find out more about these risks and their causes, but the heart of these sessions are the compelling anecdotes from the security professionals who share personal stories of depression or anger, as well as their scars, both emotional and physical.

Our presentations and discussions have been a developing project, each session building off of what we learn at every event before it. I’ll be moderating a panel again on this topic at RSA, and we will be revealing original research on career burnout and the causes of stress for security professionals.

We do not have enough data to make statistically defensible conclusions, but we will be making new observations and starting new conversations about how stress impacts IT security professionals, and why it happens. We’ll talk about how our personalities, larger economic issues, and substance abuse all play a role in career burnout.

In the end, the takeaways and action items of our session will depend on who participates, but we want people to be able to recognize legitimate signs of burnout.

Warning signals for professionals on a crash course

Our data focuses on three indicators of burnout. The first two – level of exhaustion and level of cynicism – are important, but are also typical stress indicators for any industry. The third indicator – self efficacy – hits the security industry harder than most.

Why? Because we security professionals, perhaps more so than folks in other industries, are proud of what we do, we tend to be good at what we do, and we’ve had to prove ourselves every step of the way. When our jobs leave us feeling unfulfilled, or don’t give us the recognition we feel we deserve, we’re more likely to be higher on the burnout scale.

Many security folks are at greater risk today because businesses are actually struggling to find and hire enough skilled employees for their security jobs. We’re slugging it out and often working multiple jobs. Demands on these people are higher, and opportunities for employee recognition are lower – all of which presents a greater opening for stress.

If you think you’re on the burnout scale, you have to stop and take an honest assessment of yourself. Find a way to increase your personal satisfaction – we’ve heard from people who take on mentoring roles, and are able to prove to themselves again that they know their stuff, and that their knowledge is valuable. 

We’ll share other steps and tips for recognizing and stopping career burnout, but more importantly, we want to let people know that they’re not alone – many of their peers are battling the same problem.

 

Using Nessus 5 to Raise the Value of Penetration Testing

Cross referencing the results of your vulnerability scans with the list of public exploits helps identify likely targets for authorized penetration testing teams. Removing these vulnerabilities significantly raises the value of a penetration test since the team will have to work much harder to find issues that aren’t found through automation. There are many subtle issues to consider when correlating available exploits with vulnerabilities. In this blog entry, we’ll highlight these issues by considering exploit correlation with attacks available from the Metasploit project, Core, and Immunity with the results of a very large Nessus scan of several thousand web servers.

Continue reading "Using Nessus 5 to Raise the Value of Penetration Testing" »

 

Tenable Network Security Podcast Episode 114 - "0day exploit sales, software backdoors, Wifi everywhere"

Welcome to the Tenable Network Security Podcast Episode 114

Hosts

  • Paul Asadoorian, Product Evangelist
  • Carlos Perez, Lead Vulnerability Researcher
  • Ron Gula, CEO/CTO

Announcements

New & Notable Plugins

Nessus:

Passive Vulnerability Scanner:

Continue reading "Tenable Network Security Podcast Episode 114 - "0day exploit sales, software backdoors, Wifi everywhere"" »

 

Exploitable Since 2002: New Nessus 5 Filters

With Nessus 5, the results from a single vulnerability scan can be filtered to show which hosts have ancient vulnerabilities, which hosts aren’t being managed, and also which hosts have been exploitable for long periods of time. This blog entry discusses the new Nessus 5 filters, how they can be used to track high-risk vulnerabilities, and how enterprise users of Tenable SecurityCenter can leverage these filters for dashboards and asset-based reporting.

Continue reading "Exploitable Since 2002: New Nessus 5 Filters" »

 

Tenable Network Security Podcast Episode 113 - "Nessus 5.0 New Features"

Welcome to the Tenable Network Security Podcast Episode 113

Hosts

  • Paul Asadoorian, Product Evangelist
  • Carlos Perez, Lead Vulnerability Researcher
  • Ron Gula, CEO/CTO

Announcements

New & Notable Plugins

Continue reading "Tenable Network Security Podcast Episode 113 - "Nessus 5.0 New Features"" »

 

Nessus 5.0 Released!

New Features

Nessus version 5.0 introduces key features and improvements, separated into the four major phases of the vulnerability scanning process:

  1. Installation and management (for enhanced usability)
  2. Scan policy creation and design (for improved effectiveness)
  3. Scan execution (for improved efficiency)
  4. Report customization and creation (for improved communication with all parts of the organization).

We've created a video showcasing the new features in Nessus 5.0 listed above:

Below you can find a more detailed list of the new features added to Nessus 5.0:

Continue reading "Nessus 5.0 Released!" »

 

New IBM iSeries Audit Policy

A new configuration auditing policy designed to test IBM Systems against the iSeries Security Reference Version 5 Release 4 is now available on the Tenable Support Portal.

Users can log into the Tenable Support Portal to obtain this audit policy. The file is called "IBM v5 r4 iseries security reference" and is located in the "IBM iSeries Configuration Audits" section.

To use this audit policy, update the plugins and create a new policy to perform compliance checks against an AS400 system.

Iseries preferences

Continue reading "New IBM iSeries Audit Policy" »

 

Real-time Enterprise Exploitability Trending

Penetration tests are typically a point-in-time exercise to determine if a remote adversary or malicious insider can compromise systems that contain sensitive data. Most organizations do not conduct penetration tests on a daily basis. Instead they schedule them annually, quarterly, or in some cases monthly. Penetration tests procured on a consulting engagement are often limited to key systems and assets rather than the entire network of systems. This diminishes the value of the penetration test as the results quickly become outdated and may not be relevant to new systems or recent network changes. However, by correlating the availability of exploits with a continuous monitoring program to identify vulnerabilities, an organization can have a better idea of how “exploitable” they are on a real-time basis.

Continue reading "Real-time Enterprise Exploitability Trending " »

 

#2 Routers, Firewalls, & Virtualization - Top Ten Things You Didn't Know About Nessus

The video below is part 2 in our series of the top ten things you didn't know about Nessus and covers how Nessus scans and audits routers, firewalls, virtualization, and integrates with your patch management systems.


Further Reading:

 

Tenable Network Security Podcast Episode 112 - "Evil USB, Detect Unsupported Devices, & Managing Mobile Risk"

Welcome to the Tenable Network Security Podcast Episode 112

Hosts

  • Paul Asadoorian, Product Evangelist
  • Carlos Perez, Lead Vulnerability Researcher
  • Ron Gula, CEO/CTO

Announcements

New & Notable Plugins

Continue reading "Tenable Network Security Podcast Episode 112 - "Evil USB, Detect Unsupported Devices, & Managing Mobile Risk"" »

 

Tenable Network Security Podcast Episode 111 - "Detecting pcAnywhere, browser vulnerabilities, & hacking cars"

Welcome to the Tenable Network Security Podcast Episode 111

Hosts

  • Paul Asadoorian, Product Evangelist
  • Carlos Perez, Lead Vulnerability Researcher
  • Ron Gula, CEO/CTO
  • Jack Daniel, Product Manager

Announcements

New & Notable Plugins

Passive Vulnerability Scanner

Nessus

Continue reading "Tenable Network Security Podcast Episode 111 - "Detecting pcAnywhere, browser vulnerabilities, & hacking cars" " »

 

#3 Dynamite Plugins - Top Ten Things You Didn't Know About Nessus

The video below is part 3 in our series of the top ten things you didn't know about Nessus and covers Nessus plugins that provide outstanding capabilities beyond detecting traditional vulnerabilities:


Further Reading:

 

#4 Nessus Licenses & Usage - Top Ten Things You Didn't Know About Nessus

The video below is part 4 in our series of the top ten things you didn't know about Nessus and covers Nessus licensing and usage:


Further Reading:

 

#5 Scheduling Nessus Scans - Top Ten Things You Didn't Know About Nessus

The video below is part 5 in our series of the top ten things you didn't know about Nessus and covers how to schedule scans from within Nessus:


Further Reading: