NopSec.com uses cookies to make interactions with the Company’s Websites easy and meaningful. When you visit one of the Company’s Websites, NopSec.com’s servers send a cookie to your computer. Standing alone, cookies do not personally identify you; they merely recognize your Web browser. Unless you choose to identify yourself to NopSec.com, either by responding to a promotional offer, opening an account, or filling out a Web form (such as a “Contact Us” or a “Free Trial” Web form), you remain anonymous to the Company. Please go to our privacy statement for details.

Acknowledge

Achieving SANS top 20 Critical Security Controls with Unified VRM

Why IAM Technology is Critical to Your Vulnerability Management Program

Recently I got the chance to spend a little more time examining the SANS top 20 Critical Security Controls for a customer engagement. I was familiar with these 20 critical security controls but for this engagement I spent a little more time analyzing their content.

Recently I got the chance to spend a little more time examining the SANS top 20 Critical Security Controls for a customer engagement. I was familiar with these 20 critical security controls but for this engagement I spent a little more time analyzing their content.

From this exercise, an idea came into my mind to try to map those top 20 critical security controls with the Unified VRM system. Obviously, Unified VRM is a Vulnerability Risk Management solution and not a silver bullet covering every single control in the 20 critical security controls list. However, a lot of Unified VRM functionality can be easily mapped to that list. But let’s start with a definition.

After the definition, we will talk about how to map the first control in the SANS list with the Unified VRM system. We will address one control on each blog post. We are starting today with the first control on “Critical Control 1: Inventory of Authorized and Unauthorized Devices”

SANS “20 Critical Security Controls” definition

The definition of the SANS “20 Critical Security Control” can be found here.

This is the definition:

“The Critical Security Controls effort focuses first on prioritizing security functions that are effective against the latest Advanced Targeted Threats, with a strong emphasis on “What Works” – security controls where products, processes, architectures and services are in use that have demonstrated real world effectiveness. Standardization and automation is another top priority, to gain operational efficiencies while also improving effectiveness. The US State Department has previously demonstrated more than 94% reduction in “measured” security risk through the rigorous automation and measurement of the Top 20 Controls.”

Here you can find a brief history of the SANS top 20 Critical Security Controls: https://www.sans.org/critical-security-controls/history

Critical Control 1: Inventory of Authorized and Unauthorized Devices

When talking about vulnerability management, I always tell companies I work with that before protecting, they would need to know what to protect. That means taking an inventory of their Internet exposed, internal, infrastructure and mobile assets. Only then they can protect them. Furthermore, when we scope our our penetration testing engagements we often ask the questions: “how many hosts do you have in your DMZ? How many hosts do you have in your internal networks?”. Most often than not, the people do not know the answers to this questions because they have no idea how many assets they have under protection.

Unified VRM makes it easy to take an inventory of your authorized and unauthorized devices in your networks.

The asset ranges are entered in the back end to have as much control as possible of the asset under management / assessment. We tend to include IP address range to be most comprehensive in our detection regardless of whether the assets are live or not.

Unified VRM has also a specific navigation tag called “Assets” to help visualize graphically the assets under management, including detailed OS fingerprinting, asset fingerprinting, asset tags and business impact, open ports and latest risk score.

A way to inventory live assets out of IP address range is to ping scan a network to detect responding live hosts. Fortunately Unified VRM works in close cooperation with the de-facto standard in network mapping, the nmap network scanner. Prior to launching a network scan, the scan configuration template can be modified so that:

1. For external scan, ICMP ping scan is disable since it would only be deflected by the external firewall.

2. For internal scan, ping scan can be enabled with ICMP, TCP ping scan, and ARP scan. Also in the nmap configuration, OS fingerprinting, Service Fingerprinting and RPC scan can also be enabled.

For web applications the same can be done by doing TCP applicative ping against port 80 and 443.

For wireless networks, Unified VRM wireless module helps performing wireless network site survey detecting company-owned access points and rogue access points.

In the next installment of this series of blog posts on the SANS 20 Critical Security Controls we will addressing how to map the “Critical Control 2: Inventory of Authorized and Unauthorized Software” to Unified VRM.

For more information on NopSec’s approach to vulnerability management, please see Best Practices Guide: Vulnerability Management

Schedule a Product Demo Today!

See how NopSec's security insights and cyber threat exposure management platform can organize your security chaos.