Karen Scarfone

Scarfone Cybersecurity
Agenda
 Assessment
 Why do assessment?
 Risk Management Framework
 Assessment methodology phases
 Technical assessment techniques

Content from NIST Special Publication 800-115

2
Assessment
 Determining how effectively an entity being assessed
meets specific security objectives
 Gaining understanding, achieving clarification, or
obtaining evidence
 Three types of assessment methods
 Testing: exercising one or more assessment objects to
compare actual and expected behaviors
 Examination: checking, inspecting, reviewing,
observing, studying, or analyzing assessment objects
 Interviewing: conducting discussions

3
Why do assessment?
 Help confirm that systems are properly secured
 Identify any organization security requirements that
are not met, and other security weaknesses that should
be addressed
 Meet requirements to periodically assess systems
 Not intended to take the place of implementing
security controls and maintaining system security

4
Risk Management Framework
From NIST SP 800-37
Starting Point

CATEGORIZE
Information System
Define criticality/sensitivity of
information system according to
MONITOR potential worst-case, adverse impact SELECT
Security Controls to mission/business. Security Controls
Continuously track changes to the Select baseline security controls; apply
information system that may affect tailoring guidance and supplement
security controls and reassess control controls as needed based on risk
effectiveness. assessment.
Security Life Cycle

AUTHORIZE IMPLEMENT
Information System Security Controls
Determine risk to organizational operations Implement security controls within
and assets, individuals, other enterprise architecture using sound
organizations, and the Nation; systems engineering practices; apply
if acceptable, authorize operation. ASSESS security configuration settings.
Security Controls
Determine security control effectiveness
(i.e., controls implemented correctly, operating
as intended, meeting security requirements for
information system).
5
Assessment methodology phases
 Planning: Gather information needed for assessment
execution and develop the assessment approach
 Should treat an assessment as any other project
 Execution: Identify vulnerabilities and validate them
when appropriate
 Post-Execution: Analyze identified vulnerabilities to
determine root causes, establish mitigation
recommendations, and develop a final report
 Several accepted methodologies for conducting
different types of security assessments
6
Technical assessment techniques
 Review Techniques
 Examination techniques, generally conducted manually
 Evaluate systems, applications, networks, policies, and
procedures to discover vulnerabilities
 Techniques include
 Documentation review
 Log review
 Ruleset and system configuration review
 Network sniffing
 File integrity checking

7
Technical assessment techniques
(cont.)
 Target Identification and Analysis Techniques
 Testing techniques, generally performed using
automated tools
 Identify systems, ports, services, and potential
vulnerabilities
 Techniques include
 Network discovery
 Network port and service identification
 Vulnerability scanning
 Wireless scanning
 Application security examination

8
Technical assessment techniques
(cont.)
 Target Vulnerability Validation Techniques
 Testing techniques that corroborate the existence of
vulnerabilities
 May be performed manually or with automated tools
 Techniques include
 Password cracking
 Penetration testing
 Social engineering
 Application security testing

9
Combinations of techniques
 No one technique can provide a complete picture of
the security of a system or network
 Organizations should combine appropriate techniques
 One technique often relies on others
 Multiple ways exist to meet an assessment requirement,
such as determining whether patches have been applied
properly
 Organizations have the flexibility to choose the
techniques that best meet their requirements

10
Questions?
 karen@scarfonecybersecurity.com

11
Introduction to Information Security
Testing and Assessment

5th Annual Safeguarding Health Information:

Building Assurance through HIPAA Security
June 7, 2012
Richard L. Metzer D.Sc.
 Agenda
• Background
• Risk Management
• Threats
• Vulnerabilities
• Assessment and Testing
– Vulnerability Scanning
– Classical Security Testing
– Penetration Testing
– Fuzzing

Lockheed Martin Proprietary

2 information 2
Background
• Overarching Considerations
– Business Mission, Tasks and Functions
o Strategy and Tactics
– Measurement
– Risk Management
– HIPAA as an Example
• Risk Management
– Assets
– Threats
– Vulnerabilities
– Impact
• System Development Life Cycle (SDLC)

Lockheed Martin Proprietary

3 information 3
Positioning Security Considerations3

Lockheed Martin Proprietary

4 information 4
The SDLC: A Conceptual View

Lockheed Martin Proprietary

5 information 5
Relating Security in the Initiation Phase3

Lockheed Martin Proprietary

6 information 6
Risk Model 1

Factor of Risk Diagram

Lockheed Martin Proprietary information 7

Threat Agent Components - Example
Subsets of the overall threat agent population that share key characteristics1

The notion of threat communities is a powerful tool for understanding who

and what we’re up against as we try to manage risk. For example, consider
the following threat community profile:

Motive: ideology
Primary intent: damage/destroy
Sponsorship: unofficial
Preferred general target characteristics: entities or people who clearly
represent a conflicting ideology
Preferred specific target characteristics: high profile, high visibility
Preferred targets: human, infrastructure (buildings, communications, power, etc.)
Capability: varies by attack vector (technological: moderate)
Personal risk tolerance: high
Concern for collateral damage: low

Lockheed Martin Proprietary

8 information 8
Threat Agent Characteristics – Example 1

There are four primary components of our risk taxonomy that we want to
identify threat agent characteristics for, those characteristics that affect:

■ The frequency with which threat agents come into contact with our
organizations or assets
■ The probability that threat agents will act against our organizations or
assets
■ The probability of threat agent actions being successful in overcoming
protective controls
■ The probable nature (type and severity) of impact to our assets

It’s important for us to understand the factors that drive these differentiating
characteristics in order to effectively assess the probability of being subject to
attack and, if subjected to attack, the likely nature, objective, and outcome of
the attack. We’ll examine these factors a bit more as we go along.

Lockheed Martin Proprietary

9 information 9
Common Vulnerabilities and Exposures (CVE)

http://cve.mitre.org/

Lockheed Martin Proprietary

10 information 10
 Mapping Risk Category to Impact and Vulnerability2
• Business Impact Likelihood is the product of two probabilities*
– Probability event will occur (Threat Level)
– Probability controls will fail when event occurs (Vulnerability Level)
• Assessments difficult without historical data
• There are no guarantees that history will repeat itself
• Previously learned method (High, Medium, Low) summarized in the figure below

High C B A
Vulnerability

Green Yellow Red

Medium C B B
Green Yellow Yellow

Low D C C
Blue Green Green

Low Medium High

Business Impact
• Vulnerability assessments vary with circumstances but include: testing, auditing,
scanning, penetration testing, dependency tree modeling and brain storming.
2Enterprise Security Architecture, Figure 9-3, p.208
Lockheed Martin Proprietary
11 information 11
 Vulnerability and Patch Management
• Several NIST Special Publications on the topic
– 800-24 PBX Vulnerability Analysis: Finding Holes in Your PBX Before Someone Else
Does;
– 800-40 Creating a Patch and Vulnerability Management Program; and
– 800-51 Guide to Using Vulnerability Naming Schemes.
• Establish Goals/Metrics
• Develop a Process
• Acquire Tools
• Security Content Automation Protocol (SCAP)
• Hold Personnel Accountable

Lockheed Martin Proprietary

12 information 12
Jenny is located in the Herndon/Ashburn area so Arlington is not good for her. She’ll probably want to teleconference. Arlington is fine for me – Ballston, Roslyn
Rick Metzer

Sample Vulnerability (V) and Patch (P) Management Process

V&P V&P P P Rept CCB

V or P
Discovery Review Test Results
V
Collect Dev/Acq Deploy
Data Sig P

Comp
Metrics V V
Test Test
Rept
Results Rept
Rept
Results
Results
Y
OK? Y
Success
N Dev/Acq
Impr P N
Process

Lockheed Martin Proprietary

13 information 13
 Vulnerability Assessment
• Types of Vulnerabilities
– Physical, Personnel, and Technical
• Physical
– Typically Examination/Inspection methods (e.g., Locks, Visitor
Access Control, etc., physical searches, OPSEC (Dumpster
Dives))
– May include Technical (e.g., Wireless Scanning)
• Personnel
– Typically involves all three methods (e.g., examination of
training records, interviews with personnel to determine
knowledge of security policies, processes, etc., and execution
of password cracking tools).

Lockheed Martin Proprietary

14 information 14
 Vulnerability Assessment (Continued)
• Technical
– Typically Examination (e.g., Documentation, Demonstration of
Security Tools, and Tool Outputs), Technical (e.g., execution of
vulnerability scanning software, Security Test and Evaluation
(ST&E) tests).

Lockheed Martin Proprietary

15 information 15
 Vulnerability Scanning Software
• Types of Vulnerability Scanning Software Include
– Network Scanning Software identifies weak networking device
settings (e.g., vulnerable ports left open, default passwords)
– Web Application Scanning software identifies weak web
application settings, failure to implement patches to known
web application vulnerabilities etc.
– Database Scanning Software identifies similar weaknesses in
database management systems and database applications.
• One list of Scanning Software and Vendors can be found at:
http://www.timberlinetechnologies.com/products/vulnerability.ht
ml

Lockheed Martin Proprietary

16 information 16
 Security Testing and Evaluation
• Classical Security Testing Method
– Use the FIPS 199 Security Category and NIST SP 800-53 to
create a list of security controls for the system
– Decompose each control into specific security requirements
that can be tested (e.g., Strong Passwords (IA-5) lists several
specific requirements each of which requires one or more tests
to verify proper functioning (password length (minimum &
maximum), variety of character types, age of password, etc.)
– Develop tests and test them to ensure they work correctly.
o Some tests require test data
o Test rerun/expected results problem
– Organize tests for maximum efficiency and automate
execution and recording of results as much as possible
Lockheed Martin Proprietary
17 information 17
 Security Testing and Evaluation (continued)
• Classical Security Testing Method
– Validate tests with Designated Accrediting Authority or
designee if possible prior to certification/acceptance testing
– Store tests in a test library for future use (e.g., new releases of
software, patch testing, new systems)
– Retain test results for auditors
o Some tests require test data
o Test rerun/expected results problem

Lockheed Martin Proprietary

18 information 18
 Penetration Testing
• Definition – Security testing in which evaluators attempt to
circumvent the security features of a system based on their
understanding of the system design and implementation.4
• Process
– Planning and Preparation
o Authority
o Reconnaissance
o Vulnerability Identification and Prioritization
o Tactical Planning
o Weaponization
o Delivery/Penetration

Lockheed Martin Proprietary

19 information 19
 Penetration Testing (Continued)
• Process (Continued)
– Assessment
o Exploitation
o Installation
o Command and Control
o Actions on Objectives
– Reporting and Cleanup
o Prepare and Present Findings
o Clean up all pen testing artifacts

Lockheed Martin Proprietary

20 information 20
 Fuzz Testing or Fuzzing
• History
– Professor Barton Miller, Univ. of Wisconsin, 1988 class project
– Software testing technique that automatically inputs invalid,
random, unexpected data to software to determine it’s
reaction. (e.g., where software expects 1-12 alphabetic
characters for username fuzzer automatically inputs 0-2K of
random alphanumeric and special characters or non-ascii
characters)
– Originally tested operating system command line input
handling then progressed to GUI tools, APIs and network
protocols
o Good for testing software that has no control over input
o Can test simple features but not complex software code

Lockheed Martin Proprietary

21 information 21
 Fuzz Testing (Continued)
• Features
– Good for testing software that has no control over input
– Used to test simple features but not complex software code
– Fuzzer Technology Still Requires High Level of Skill to Use
o Individual Fuzzers For Each Protocol or Application
o Requires Deep Protocol or Application Knowledge &
Software Development Skills
– Free & Open Source Fuzzing Software is Free Not Open Source

Lockheed Martin Proprietary

22 information 22
 Bibliography

1. FAIRWIKI, The Definitive Guide to the Factor Analysis of Information Risk (FAIR)
Risk Landscape Components,
http://fairwiki.riskmanagementinsight.com/?page_id=10
2. Sherwood, J., Clark, A., Lynas, D. (2005). Enterprise security architecture: A
business-driven approach. San Francisco:CMPBooks.
3. Kissel, R., Stine, K., Sholl, M., Rossman, H., Falsing, J. & Gulik, J. (2008). Security
considerations in the system development life cycle. Gaithersburg, MD 20899-
8930:NIST Special Publication 800-64 Rev. 2. National Institute of Standards and
Technology, U.S. Dept. of Commerce.
4. Committee on National Security Systems. (2003). National information
assurance glossary: CNSS Instruction No. 4009. Ft Meade, MD:CNSS Secretariat
(142), National Security Agency, U.S. Dept. of Defense.

Lockheed Martin Proprietary

23 information 23