Tag Archive for: Schwachstellenmanagement

Greenbone AG

The new SMP federal portal in partnership with the Federal Office for Information Security (BSI)

We at Greenbone are excited to introduce the innovative Greenbone SMP-Bund-Portal in collaboration with the Federal Office for Information Security (BSI). As a leading provider of IT security solutions, we are proud to offer this platform specifically tailored to the needs of federal agencies.

A Portal Setting Standards

The Greenbone SMP-Bund-Portal is the central point of contact for IT security and vulnerability management. It has been developed to provide agencies with concrete support in addressing current IT security challenges.

Many Advantages for Federal Agencies

  1. Easy-to-Understand Insights: The portal offers clear and user-friendly information about vulnerability management. It is ideal for both beginners and experts in IT security.
  2. Exclusive Framework Contract Conditions: Federal agencies enjoy special offers and benefits. The obligation to issue public tenders is eliminated, saving time and resources.
  3. Personal Support: Our competent support team is always at our customers’ side to answer questions and ensure support.
  4. Direct Access to the Agency Sales Team: Expert advice from our team, which is well-versed in the specific requirements of federal agencies. We look forward to furthering our trusted collaboration with the BSI and are available for any questions.
  5. Opportunity for Exchange: Use the shared forum to share your experiences and questions.

https://smp-bund.greenbone.net/

Contact Free Trial Buy Here Back to Overview

/by
Greenbone AG

IT security update November 2023: Critical vulnerabilities and threats

In the November 2023 commVT Intelligence Update, several critical vulnerabilities and security threats have come to light. Cisco’s Internetworking Operating System (IOS) XE Software Web User Interface (UI) was found to be vulnerable to two actively exploited critical vulnerabilities, allowing attackers to execute arbitrary code remotely. The curl command-line tool, widely used across various platforms, faced a serious vulnerability that could result in arbitrary code execution during SOCKS5 proxy handshakes. VMware is urging immediate updates for its vCenter Server due to a critical vulnerability potentially leading to remote code execution. Multiple vulnerabilities were found in versions of PHP 8; one is a particularly critical deserialization vulnerability in the PHAR extraction process. Additionally, SolarWinds Access Rights Manager (ARM) was found susceptible to multiple critical vulnerabilities, emphasizing the urgency to update to version 2023.2.1. Lastly, two F5 BIG-IP vulnerabilities were discovered to be actively exploited, with mitigation options available and outlined below.

Cisco IOS XE: Multiple Critical Vulnerabilities

Two actively exploited critical CVSS 10 vulnerabilities were discovered in Cisco’s Internetworking Operating System (IOS) XE Software Web User Interface (UI); CVE-2023-20198 and CVE-2023-20273. Combined, they allow an attacker to remotely execute arbitrary code as the system user and are estimated to have been used to exploit tens of thousands of vulnerable devices within the past few weeks. Greenbone has added detection for both the vulnerable product by version [1], and another aimed at detecting the BadCandy implanted configuration file [2]. Both are VTs included in Greenbone’s Enterprise vulnerability feed.

Cisco IOS was created in the 1980s and used as the embedded OS in the networking technology giant’s routers. Fast forward to 2023, IOS XE is a leading enterprise networking full-stack software solution that powers Cisco platforms for access, distribution, core, wireless, and WAN. IOS XE is Linux-based, and specially optimized for networking and IT infrastructure, routing, switching, network security, and management. Cisco devices are pervasive in global IT infrastructure and used by organizations of all sizes, including large-scale enterprises, government agencies, critical infrastructure, and educational institutions.

Here’s how the two recently disclosed CVEs work:

• CVE-2023-20198 (CVSS 10 Critical): Allows a remote, unauthenticated attacker to create an account [T1136] on an affected system with privilege level 15 (aka privileged EXEC level) access [CWE-269]. Privilege level 15 is the highest level of access to Cisco IOS. The attacker can then use that account to gain control of the affected system.
• CVE-2023-20273 (CVSS 7.2 High): A regular user logged into the IOS XE web UI, can inject commands [CWE-77] that are subsequently executed on the underlying system with the system (root) privileges. This vulnerability is caused by insufficient input validation [CWE-20]. CVE is also associated with a Lua-based web-shell [T1505.003] implant dubbed “BadCandy”. BadCandy consists of an Nginx configuration file named `cisco_service.conf` that establishes a URI path to interact with the web-shell implant but requires the webserver to be restarted.

Cisco has released software updates for mitigating both CVEs in IOS XE software releases, including versions 17.9, 17.6, 17.3, and 16.12 as well as available Software Maintenance Upgrades (SMUs) and IT security teams are strongly advised to urgently install them. Cisco has also released associated indicators of compromise (IoC), Snort rules for detecting active attacks, and a TAC Technical FAQs page. Disabling the web UI prevents exploitation of these vulnerabilities and may be suitable mitigation until affected devices can be upgraded. Publicly released proof of concept (PoC) code [1][2] and a Metasploit module further increase the urgency to apply the available security updates.

Critical Vulnerability In The Curl Tool

A widespread vulnerability has been discovered in the popular curl command line tool, libcurl, and the many software applications that leverage them across a wide number of platforms. Tracked as CVE-2023-38545 (CVSS 9.8 Critical), the flaw makes curl overflow a heap-based buffer [CWE-122]] in the SOCKS5 proxy handshake that can result in arbitrary code execution [T1203]. Greenbone’s community feed includes several NVTs [1] to detect many of the affected software products and will add additional detections for CVE-2023-38545 as more vulnerable products are identified.

CVE-2023-38545 is a client-side vulnerability exploitable when passing a hostname to the SOCKS5 proxy that exceeds the maximum length of 255 bytes. If supplied with an excessively long hostname, curl is supposed to use local name resolution and pass it on to the resolved address only. However, due to the CVE-2023-38545 flaw, curl may actually copy the overly long hostname to the target buffer instead of copying just the resolved address there. The target buffer, being a heap-based buffer, and the hostname coming from the URL results in the heap-based overflow.

While the severity of the vulnerability is considered high because it can be exploited remotely and has a high impact to the confidentiality, integrity, and availability (CIA) of the underlying system, the SOCKS5 proxy method is not the default connection mode and must be declared explicitly. Additionally, for an overflow to happen an attacker also needs to cause a slow enough SOCKS5 handshake to trigger the bug. All versions of curl are affected between v7.69.0 (released March 4th, 2020) until v8.3.0. The vulnerable code was patched in v8.4.0 commit 4a4b63daaa.

VMware vCenter Server: Multiple Vulnerabilities

CVE-2023-34048 is a critical severity vulnerability that could allow a malicious actor with network access to vCenter Server to cause an out-of-bounds write [CWE-787] potentially leading to remote code execution (RCE). The affected software includes VMware vCenter Server versions 6.5, 6.7, 7.0, and 8.0. VMWare has issued a security advisory to address both vulnerabilities which states that there are no known mitigations other than installing the provided updates. Both vulnerabilities can be detected by Greenbone’s enterprise vulnerability feed [1]. The vCenter Server patch also fixes CVE-2023-34056, a medium-severity information disclosure resulting from improper authorization [CWE-285].

Although there are no reports that CVE-2023-34048 is being actively exploited in the wild attackers have proven adept at swiftly converting threat intelligence into exploit code. Research by Palo Alto Networks Unit 42 threat research group shows that on average an exploit is published 37 days after a security patch is released.

Here are some brief details on both CVEs:

• CVE-2023-34048 (CVSS 9.8 Critical): vCenter Server contains an out-of-bounds write [CWE-787] vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability to achieve remote code execution (RCE). The Distributed Computing Environment Remote Procedure Call (DCERPC) protocol facilitates remote procedure calls (RPC) in distributed computing environments, allowing applications to communicate and invoke functions across networked systems.
• CVE-2023-34056 (CVSS 4.3 Medium): vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.

Multiple Vulnerabilities Discovered In PHP 8

Several vulnerabilities were identified in PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3. Although the group of vulnerabilities does include one critical and two high-severity vulnerabilities, these require particular contexts to be present for exploitation; either deserializing PHP applications using PHAR or else using PHP’s core path resolution functions on untrusted input. Greenbone’s enterprise VT feed includes multiple detection tests for these vulnerabilities across multiple platforms.

Here are brief descriptions of the most severe recent PHP 8 vulnerabilities:

• CVE-2023-3824 (CVSS 9.8 Critical): A PHAR file (short for PHP Archive) is a compressed packaging format in PHP, which is used to distribute and deploy complete PHP applications in a single archive file. While reading directory entries during the PHAR archive loading process, insufficient length checking may lead to a stack buffer overflow [CWE-121], potentially leading to memory corruption or remote code execution (RCE).
• CVE-2023-0568 (CVSS 8.1 High): PHP’s core path resolution function allocates a buffer one byte too small. When resolving paths with lengths close to the system `MAXPATHLEN` setting, this may lead to the byte after the allocated buffer being overwritten with NULL value, which might lead to unauthorized data access or modification. PHP’s core path resolution is used for the `realpath()` and `dirname()` functions, when including other files using the `include()`, `include_once()`, `require()`, and `require_once()`, and during the process of resolving PHP’s “magic” constants” such as `__FILE__` and `__DIR__`.
• CVE-2023-0567 (CVSS 6.2 Medium): PHP’s `password_verify()` function may accept some invalid Blowfish hashes as valid. If such an invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid [CWE-287]. Notably, this vulnerability has been assigned different CVSS scores by NIST (CVSS 6.2 Medium) and the PHP group CNA (CVSS 7.7 High), the difference being that the PHP Group CNA considers CVE-2023-0567 a high risk to confidentiality while NIST does not. CNAs are a group of independent vendors, researchers, open source software developers, CERT, hosted service, and bug bounty organizations authorized by the CVE Program to assign CVE IDs and publish CVE records within their own specific scopes of coverage.

SolarWinds Access Rights Manager (ARM): Multiple Critical Vulnerabilities

SolarWinds Access Rights Manager (ARM) prior to version 2023.2.1 is vulnerable to 8 different exploits; one critical and two additional high-severity vulnerabilities (CVE-2023-35182, CVE-2023-35185, and CVE-2023-35187). These include authenticated and unauthenticated privilege escalation [CWE-269], directory traversal [CWE-22], and remote code execution (RCE) at the most privileged “SYSTEM” level. Greebone’s Enterprise vulnerability feed includes both local security check (LSC) [1] and remote HTTP detection [2].

SolarWinds ARM is an enterprise access control software for Windows Active Directory (AD) networks and other resources such as Windows File Servers, Microsoft Exchange services, and Microsoft SharePoint as well as virtualization environments, cloud services, NAS devices, and more. The widespread use of ARM and other SolarWinds software products means that its vulnerabilities have a high potential to impact a wide range of large organizations including critical infrastructure.

These and more recent vulnerabilities are disclosed in SolarWinds’ security advisories. Although no reports of active exploitation have been released, mitigation is highly recommended and available by installing SolarWinds ARM version 2023.2.1.

F5 BIG-IP: Unauthenticated RCE And Authenticated SQL Injection Vulnerabilities

Two RCE vulnerabilities in F5 BIG-IP, CVE-2023-46747 (CVSS 9.8 Critical) and CVE-2023-46748 (CVSS 8.8 High), have been observed by CISA to be actively exploited in the wild soon after PoC code was released for CVE-2023-46747. A Metasploit exploit module has also since been published. F5 BIG-IP is a family of hardware and software IT security products for ensuring that applications are always secure and perform the way they should. The platform is produced by F5 Networks, and it focuses on application services ranging from access and delivery to security. Greenbone has added detection for both CVEs [1][2].

CVE-2023-46747 is a remote authentication bypass [CWE-288] vulnerability while CVE-2023-46748 is a remote SQL injection vulnerability [CWE-89] that can only be exploited by an authenticated user. The affected products include the second minor release (X.1) for major versions 14-17 of BIG-IP Advanced Firewall Manager (AFM) and F5 Networks BIG-IP Application Security Manager (ASM).

If you are running an affected version you can eliminate this vulnerability by installing the vendor-provided HOTFIX updates [1][2]. The term “hotfix” implies that the patch can be applied to a system while it is running and operational, without the need for a shutdown or reboot. If updating is not an option, CVE-2023-46747 can be mitigated by downloading and running a bash script that adds or updates the `requiredSecret` attribute in the Tomcat configuration, which is used for authentication between Apache and Tomcat, and CVE-2023-46748 can be mitigated by restricting access to the Configuration utility to allow only trusted networks or devices, and ensuring only trusted user accounts exist thereby limiting the attack surface.


Contact Free Trial Buy Here Back to Overview

/by
Markus Feilner

CVE News: Critical vulnerabilities Atlassian and F5 Big vulnerability tests released by Greenbone

Our developers have provided vulnerability tests for two critical vulnerabilities in widely used enterprise software. Within a very short time, tests for CVE 2023-22518 und CVE 2023-46747 were integrated, and customers of Greenbone’s Enterprise Feed were protected.

Knowledge management tools Confluence and Jira from Australian vendor Atlassian have been hit by a serious security vulnerability, rated 9.8 out of 10 on the CERT scale. Since November 8, CVE 2023-22518 has been actively exploited by attackers gaining unauthorized access to company data, according to media reports.

According to the company, the “authentication flaw” affects all versions of Confluence Data Center and Server, but not the cloud version at Atlassian itself. For anyone else, including users of Jira, but especially all publicly accessible Confluence servers, there is a “high risk and need to take immediate action”, writes Atlassian.

We reacted quickly and provided our customers with appropriate tests before ransomware attacks could be successful. Customers of the Greenbone Enterprise Feed were warned and reminded of the patch via update.

Remote code execution: F5 BIG-IP allows request smuggling

Also at the end of October, security researchers from Praetorian Labs discovered a serious vulnerability (CVE-2023-46747) in the products of application security expert F5. The American company’s solutions are designed to protect large networks and software environments; the software, which was launched in 1997 as a load balancer, is primarily used in large enterprises.

However, according to the experts, attackers can remotely execute code on the BIG-IP servers by adding arbitrary system commands to the administration tools via manipulated URLs. Details can be found at Praetorian; patches are available, and a long list of BIG-IP products of versions 13, 14, 15, 16, and 17 are affected, both in hardware and software.

We reacted quickly and integrated tests into its vulnerability scanners on the same day, which test the BIG-IP installations at Greenbone Enterprise for vulnerable versions and, if necessary, point to the patches listed at F5.

Our vulnerability management products, the Greenbone Enterprise Appliances, offer the best protection.

Professional vulnerability management is an indispensable part of IT security. It enables the early detection of risks and provides valuable instructions for their elimination.
The Greenbone Enterprise Feed is updated daily to detect new vulnerabilities. We therefore recommend that you regularly update and scan all your systems. Please also read this article on IT security and the timeline of common attack vectors.


Contact Free Trial Buy Here Back to Overview

/by
Elmar Geese

Current Report on the State of IT Security in Germany 2023

On November 2, Federal Minister of the Interior Nancy Faeser and Claudia Plattner, President of the Federal Office for Information Security (BSI), presented the latest report on the state of IT security in Germany. Attacks with ransomware represent the largest and most frequent risk, but by far not the only one. As long as these attacks cannot be completely prevented, systems must become more secure in order to prevent or at least reduce damage.

In Germany, there are a number of initiatives to improve vulnerability management. These include the National IT Security Act (IT-SiG) and the BSI’s IT-Grundschutz Compendium. The “nationwide situation picture” rightly called for by BSI President Claudia Plattner can thus map the threat situation to the situation of vulnerable systems, thereby helping to warn in advance and respond quickly and effectively in the specific event of an attack.

“Digitization makes many things in our everyday lives easier. At the same time, it creates new areas of attack,” says Federal Minister of the Interior Nancy Faeser. We need to counter the growing risks posed by progressive networking with automated tools and processes. By using them, companies and organizations can better protect their IT systems and reduce the probability of a successful cyber attack.

Insecure systems make it easier for attackers to cause damage. Improving vulnerability management is therefore an important step toward increasing IT security in Germany.Insecure systems make it easier for attackers to wreak havoc. Improving vulnerability management is therefore an important step towards increasing IT security in Germany.

Contact Free Trial Buy Here Back to Overview

/by
Greenbone AG

Critical vulnerability in Citrix Netscaler: Greenbone provides tests

On October 10th, Citrix officially informed about the vulnerability in the Netscaler software, CVE-2023-4966, which is categorized as “critical” according to CVSS with a score of 9.4 and allows unauthorized access to corporate networks.

Greenbone has reacted to these vulnerabilities and implemented vulnerability tests at an early stage. Greenbone customers using the Citrix Netscaler Gateway, or ADC, are therefore on the safe side.

Nevertheless, the vulnerability is serious, which is why the BSI issues an urgent warning:

“The vulnerability allows attackers to disclose sensitive information without authentication. This allows authenticated sessions to be hijacked and multifactor authentication (MFA) or other means of authentication to be bypassed”.

The vulnerability, which has been actively exploited since the end of August, has been reported in numerous media outlets. Users should install the patches provided by Citrix as soon as possible. Citrix’s NetScaler ADC and NetScaler Gateway products, versions 13 and 14, and versions 12 and 13 of NetScaler ADC are affected. In addition to CVE-2023-4966, an advisory has been issued for CVE-2023-4967, which allows a Denial of Service (DoS).

Keep your IT networks secure!

Vulnerability management is a key tool in securing IT networks. It enables you to identify and eliminate potential risks in your systems. The Greenbone Enterprise Feed is updated daily to detect new vulnerabilities. Therefore, we recommend regular updates and scans for all your systems. Please also read this article about IT security and the timeline of common attack vectors.

The Greenbone Enterprise Appliances are offered as hardware or as virtual appliances. Greenbone works GDPR-compliant and offers an open-source solution. This means the best data protection compliance and is thus guaranteed to be completely free of backdoors.


Contact Free Trial Buy Here Back to Overview

/by
Markus Feilner

“Vulnerability management is becoming increasingly important” – Greenbone CEO Dr. Jan-Oliver Wagner at PITS Congress

Every year, IT and cyber security experts from public authorities, federal, state and local governments as well as the armed forces, police and intelligence services meet for the cyber security congress “Public IT Security” (PITS), initiated by Behoerdenspiegel. In 2023, the topic of vulnerabilities was once again at the top of the agenda.

This year, our CEO Dr. Jan-Oliver Wagner was invited as an expert to take part in the panel discussion “Putting a finger on a wound – managing or closing vulnerabilities?” Moderated by Katharina Sook Hee Koch from the Federal Office for Information Security (BSI), the panel included representatives from the German Informatics Society (Nikolas Becker, Head of Policy & Science), the Bundestag Committee on Digital Affairs (MdB Catarina dos Santos-Wintz, CDU/CSU), the BSI itself (Dr. Dirk Häger, Head of Department Operative Cyber Security) for an exchange of views. Dirk Kunze from the North Rhine-Westphalia State Criminal Police Office (Head of the Cybercrime/Cyber Investigations Department in the Research and Investigation Centre) was present on behalf of the executive.

Panel discussion at the cyber security congress PITS 2023 with Greenbone CEO Dr. Jan-Oliver Wagner and representatives of the BSI, Bundestag, LKA NRW and Gesellschaft für Informatik on the topic of vulnerability management.

from left: Catarina dos Santos-Wintz, Dirk Kunze, Katharina Sook Hee Koch, Dr. Dirk Häger, Dr. Jan Oliver Wagner, Nikolas Becker (Photo: Greenbone AG)

Should vulnerabilities be closed? By all means!

The debate quickly centered on the question of whether and how (quickly) vulnerabilities in software should be closed and/or whether this would impair the work of investigative authorities. There was great unanimity among those present that the security of citizens had the highest priority. Keeping vulnerabilities open, even for political reasons, is hardly an option, both for cost reasons (exploits are expensive) and in risk assessment.

On the contrary, open-source software should be strengthened and more rewards (bug bounties) should be offered to experts who actively search for vulnerabilities. The BSI is also firmly convinced: “Basically, vulnerabilities must be closed.” (Häger). In criminal practice, the topic apparently plays a subordinate role anyway: the police, according to the LKA in North Rhine-Westphalia, know of only a few cases where it could have helped to keep vulnerabilities open. However, open vulnerabilities are still seen as a possible element for investigations. But of course, the decision of the politicians will be followed.

Dr. Jan-Oliver Wagner: “Vulnerability management is becoming increasingly important!”

Greenbone CEO Wagner warns that the number of open vulnerabilities will increase rather than decrease in the coming years. This is despite the fact that good progress is being made with regard to security in software development. However, the regulations and thus the pressure on companies by the legislator are also becoming stricter – not necessarily a bad thing, but it does create a need for action: “The upcoming Common Security Advisory Framework (CSAF 2.0) and the EU’s Cyber Resilience Act (CRA), will significantly increase the number of known vulnerabilities.”

The CSAF makes it easier for manufacturers to report vulnerabilities, while the Cyber Resilience Act also brings responsibility to the hoover manufacturer, i.e. to all parts of the economy. If you don’t want to lose track of this, you need vulnerability management like Greenbone’s, explains Wagner. “Upcoming regulations bring the issue of vulnerabilities into all parts of the economy, as now every manufacturer is responsible for the security of the devices and their software, including, for example, manufacturers for hoover robots or other smart household appliances – For the entire life of the product!”

Vulnerability management is risk management

Vulnerability management today is pure risk management for the professional user, as it is already practiced in insurance companies – decisions are made about which vulnerabilities need to be closed and which can or must wait (triage).

This is exactly where our vulnerability management products come in – as a hardware or as a virtual appliance. Greenbone develops an open source vulnerability management and allows users to detect vulnerabilities in their own network infrastructure within a few steps. Our products generate reports with concrete instructions for action that you can implement immediately.

We work strictly according GDPR Compliance and offer an open source solution. This means best data protection compliance and is thus guaranteed free of backdoors.


Contact Free Trial Buy Here Back to Overview

/by
Jan-Oliver Wagner

Cyber attacks are like earth quakes

Earth quakes and cyber attacks have much in common. First: The forces are outside of our control and we can not prevent them to happen.

Second: We are not helplessly at the mercy. We can install early warning, minimize destructive effect and recover quickly. But only if we act BEFORE it happens.

Sure, earth quakes are about human live and cyber attacks are so far usually not. Yet I think this comparison is important in order to make it easier to understand the significance of cyber attacks the the options for action.

Of course there are also differences and the most striking one to me is the average frequency of occurence. This vivid direct comparison shows the parallels:

We have no technology to prevent them to happen, but… Earth quake Cyber Attack
We have prognosis models where they happen most likely Tectonic models Vulnerability intelligence

We have sensors that provide early warnings shortly before it happens

(sometimes they fail though with false positive and false negatives)

 Seismographs Vulnerability scanning and threat intelligence
We have a scale to compare events about potential damage

Richter magnitude scale: Ranges from 1.0 to 9.9

  • Sometimes the effect is just shaking indoor objects and sometimes it is collapse of buildings

Severity Score: Ranges from 0.1 to 10.0

  • Sometimes you have some extra network load and sometimes a remote administrative exploit.
…you can do something to minimize negative impact:
Make you infrastructure stable against this type of force

Obligatory architecture designs

  • Overview and controlling of compliance

Obligatory security policies

  • detection and limitation of attack surface:
  • Vulnerability testing and remediation
  • Vulnerability management and compliance
Have trained teams ready to help recover quickly when it happens
  • Central command center and
  • distributed on-site medical and repair teams
  • Processes and and regular trainings thereof
  • Security operation center and distributed system administrator
  • Dev-ops or suppliers for operational support
  • Processes and and regular trainings thereof
Make all people aware on how to save their lives best when it happens
  • Understandable training materials and
  • regular awareness trainings
  • Understandable training materials and
  • regular awareness trainings


Contact Free Trial Buy Here Back to Overview

/by
Jan-Oliver Wagner

The key to quality for your vulnerability status

The job to protect from cyberattacks by minimizing your attack surface demands three essential pillars:

Vulnerability Intelligence
Know everything about vulnerabilities and risks immediately.

Asset Intelligence
Scan all the TCP/IP protocols, dive deep into assets and use other sources of asset details.

Vulnerability Scanning
Create, deploy, and execute vulnerability tests fast and by priority.

Vulnerability management flowchart with the following steps: Vulnerability Intelligence, Asset Intelligence, Vulnerability Scanning, Vulnerability Status, Reporting and Remediation.

Vulnerability Intelligence

Vulnerability Intelligence helps doing two jobs: First you must make a priority decision about what attack vectors you should address and which ones you accept. This decision is not easy and may have a far-reaching impact. Even worse, it has to be made under time pressure and with limited resources. In other words, this decision is (sometimes) a triage. The better the information about the vulnerability the better will be the decision. And the more evidence you get, the less personal educated guess you have to add. Once you decided which attack vectors to address, technical details about the vulnerability intelligence will help as a guide for an efficient remediation. Knowing how easy or complicated a remediation is supports you already during the priority decision.

Asset Intelligence

Asset Intelligence is about knowing as much as possible about the assets that you have to protect from cyber-attacks. It may sound strange but the first part of this is to know which assets you have. Networks can be pretty dynamic because your people are very dynamic about extending and connecting services and devices. Scanning for existence of and scanning into assets is equally important. Both builds your inventory which you will later compare with the incoming vulnerability intelligence on new attack vectors. There are expected details like product versions and there are unexpected details determined only when a security advisory is published. For the first case you build a database allowing quick offline scans upon new advisories. For the latter case you need the ability to use arbitrary TCP/IP protocols to collect the information that are required to determine the presence of a vulnerability. A special case are fictive assets represented by inventories or a Software Bill of Materials, representing for example devices that are subject to the EU Cyber Resilience Act.

Vulnerability Scanning

The art of Vulnerability Scanning begins with the creation of tests, usually derived from Vulnerability Intelligence, and verified thoroughly. The growing number of security advisories makes this also a business of priority decision about which advisories to address first. Learning about the asset inventories of our customer helps us to make this job even better for them. After rapid deployment of the tests the art of vulnerability scanning finishes with a fast, powerful, and easy to deploy set of scanners. In simple words those scanners compare the vulnerability intelligence with asset intelligence to list up the current attack surface. Scanning can be as simple a comparing a version number or as complex as a multi-stage exploit via TCP/IP. In the end of the day the result is a vulnerability status with high relevance and high quality of detection, and so will be your vulnerability remediation and vulnerability reporting.


Contact Free Trial Buy Here Back to Overview

 

/by
Markus Feilner

Master’s thesis: Automated vulnerability detection and response in the network perimeter

The long-standing cooperation between Greenbone AG and the University of Osnabrück has once again resulted in a successful master’s thesis.

Graphic representation of the Greenbone Enterprise Appliance 450 with reference to new master's thesis in cooperation with the University of Osnabrück

Under the title “Development of an Automated Network Perimeter Threat Prevention System (DETERRERS)”, Nikolas Wintering wrote his master’s thesis in the Mathematics, Physics, and Computer Science working group of the Department of Mathematics/Computer Science at the University of Osnabrück, developing a system for automated threat prevention at the network perimeter of a university campus network.

Particularly at risk: universities

Universities are vibrant centers of information exchange and collaboration; with their numerous hosts and a multitude of services, they offer a large attack surface for cyber threats. It is therefore enormously important for educational institutions to identify vulnerable points and automatically isolate them from the internet.

Automated vulnerability management

By automating the interactions between administrators, vulnerability scanners, and perimeter firewalls, administrators are thus supported in their work, and the university IT network is protected. Part of the system developed in the master’s thesis is also the automation of the risk assessment of the vulnerability scan results and the generation of host-based firewall configurations.

“Through the use of DETERRERS and the associated adaptation of the release processes, the security in the university network could be massively improved with very little additional effort for administrators. With the automated mitigation, it is also possible to react to new threats at short notice and thus quickly close a potential new attack surface without long manual runtimes.”
Eric Lanfer, M. Sc. (Osnabrück Computing Center, Networks Group)

Practical application and a free demonstrator

Based on a practical application in a campus network, Wintering evaluates how the risk assessment works, how the attack surface is reduced, and what effects the system has on the work of administrators. In the process, a demonstrator was also created, whose source code and functionality can be viewed and tested by interested parties on GitHub. In the long term, a continuation as an open-source project is planned.

“This is a very successful work with clear added value for practice. Making efficient security mechanisms usable in everyday life is often a big challenge, and this master’s thesis makes very convincing contributions to this.”
Prof. Dr. rer. nat. Nils Aschenbruck (University of Osnabrück, Institute of Computer Science, Distributed Systems Group)

Greenbone: experts for universities and more

Greenbone has been supplying numerous customers in the university environment with vulnerability management products for many years. Thanks to this extensive experience, we have always been able to identify and collect industry-specific requirements and incorporate them into the further development of our products.

The University of Osnabrück uses the Greenbone Enterprise Appliance 450, and we very much welcome the fact that this solution has now become part of a master’s thesis. We congratulate Nikolas Wintering on this successful scientific evaluation.


Contact Free Trial Buy Here Back to Overview

/by
Britta Zurborn

PITS 2023 Public IT Security

20 – 21 September 2023 | Berlin.

This year we are participating in Germany’s specialist congress for IT and cyber security for the state and administration.

Dr. Jan-Oliver Wagner, Greenbone, will speak together with

Dr. Dirk Häger, Head of Operational Cybersecurity Department, Federal Office for Information Security
Carsten Meywirth, Head of Cybercrime Department, Federal Criminal Police Office
Nikolas Becker, Head of Policy & Science, German Informatics Society and
Catarina dos Santos-Wintz, Member of the German Bundestag (CDU/CSU) and member of the Committee for Digital Affairs

on: 21.09.2023
at: 9:20 am

in the main program about the topic: Putting a finger in the wound – managing or closing vulnerabilities?

Visit us in our lounge at stand 43 and exchange views with our experts on vulnerability management and cyber security.

More: https://www.public-it-security.de/anmeldung/


Contact Free Trial Buy Here Back to Overview

/by