Vulnerability Management - (Rapid7) Leftover data from deleted sites and assets

One of our clients has Rapid7-Splunk integration in place. Here Splunk is used exclusively for vulnerability analytics. While Splunk team was performing some data analysis, they found few asset IDs with no corresponding vulnerability/asset data. They gave the list to us for investigation. I tried finding the relevant details in InsightVM but did not find anything.

Now that the context is set, this is why one should perform maintenance procedures on InsightVM database. Regular maintenance helps clean up the database and remove leftover data from deleted sites and assets. You might delete an asset from site/asset group but still the asset exists in InsightVM DB. This in turn results in number mismatch between solutions (wherever integration is in place, for e.g. in this case count of assets between Splunk-Rapid7).

Please find the below URL:
https://help.rapid7.com/insightvm/en-us/Files/Administration.html

Happy Learning !!
hashtag#vulnerabilitymanagement hashtag#cybersecurity hashtag#Rapid7

CyberSecurity - Technical Documentation

One must have the following points documented when a cybersecurity project transition from implementation phase to operational phase:

1. Scope (Project Scope)
2. Architecture
3. Roles and Responsibilities
4. Escalation Path
5. Run Books
6. Asset Lists
7. SLA Review and Documentation
8. Metrics and Reporting Documentation
9. Training Materials
10. Knowledge Transfer (From Project to BAU team)

Happy Learning
hashtag#vulnerabilitymanagement hashtag#cybersecurity

Vulnerability Management - Nessus on a Windows Server OS versus a Windows Desktop OS

Microsoft Windows desktop systems have network limitations that may impact the performance of Nessus. The TCP/IP stack limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit is reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate (10 per second). If too many enter the queue, they may be dropped.

This has the effect of causing a Nessus scan on a Windows desktop OS to potentially have false negatives. For better accuracy, it is recommended that Nessus on a Windows desktop OS have its port scan throttle setting down to the following, which is found in the "Performance" setting type under General Settings of a new policy:

Max number of hosts: 10

Max number of security checks: 4

Max number of packets per second for a port scan: 50

For increased performance and scan reliability, it is highly recommended that Nessus Windows be installed on a server product from the Microsoft Windows family.

Please refer the below URL for more details:
https://www.tenable.com/products/nessus/nessus-faq

Happy Learning
hashtag#vulnerabilitymanagement hashtag#cybersecurity

Vulnerability Management - Determining Scan Frequency

1. Scan on quarterly basis

Suitable when ->
a. The enterprise is small
b. Resources are constrained for scanning and/or analysis
c. Vulnerability scanning is done by an external firm (i.e. an MSSP)

Drawback -> Difficult to increase frequency while focused on the entire enterprise

2. Scan on weekly/monthly basis
Suitable when ->
a. The enterprise is large and identifiable units
b. Scanning timetables can be coordinated with remediation actions by business unit IT staff
c. Analysis and prioritization of vulnerabilities can occur quickly

Drawback -> Requires coordination with IT to ensure coordinated remediation

3. Continuous Scanning -> Always some part of the enterprise is being scanned
Suitable when ->
a. The VM team has the skills and resources to maintain continuous scanning
b. Assets in the enterprise change quickly

Drawback -> Analysis of vulnerabilities need to happen at scale and very quickly

Starting point for a typical scanning strategy:

1. Discovery Scan -> Scan all IP address ranges on daily basis, but leave out all the hosts known from previous scans.
2. Full Vulnerability Scan -> Scan live systems found in discovery scan on weekly basis (This means only doing time-consuming port-scanning for up-and-running hosts, since this scan is done against known targets, not entire IP address ranges. This massively reduces the time required for the scan while delivering complete and precise results.)

Please refer the below URL for more details:
https://www.tenable.com/blog/5-tips-on-how-to-conduct-a-vulnerability-assessment

Happy Learning
hashtag#vulnerabilitymanagement hashtag#cybersecurity