From e4ed316ad26e881ea6dccb24ed50b1b115958fce Mon Sep 17 00:00:00 2001 From: jowj Date: Mon, 24 Jun 2019 15:54:05 -0500 Subject: [PATCH] Rebuilding site after adding tvm post. --- _posts/2019-06-24-new_company_tvm.md | 46 ++++++++ _site/index.html | 5 +- _site/index.md | 1 + _site/personal/2019/04/15/friendsgiving.html | 4 +- .../personal/2019/04/15/lt_thanksgiving.html | 4 +- _site/personal/2019/04/15/rad_boys_only.html | 4 +- _site/personal/2019/04/18/vcards.html | 4 +- _site/personal/index.html | 2 +- _site/projects/2019/04/15/agares.html | 4 +- .../04/15/hosting_static_sites_on_s3.html | 4 +- _site/projects/2019/04/15/mojojojo_bot.html | 4 +- _site/projects/2019/04/15/workingcopy.html | 4 +- _site/projects/2019/06/23/pynit.html | 4 +- _site/projects/index.html | 2 +- .../security/2019/06/24/new_company_tvm.html | 111 ++++++++++++++++++ _site/security/index.html | 62 ++++++++++ index.md | 1 + security.md | 13 ++ 18 files changed, 257 insertions(+), 22 deletions(-) create mode 100644 _posts/2019-06-24-new_company_tvm.md create mode 100644 _site/security/2019/06/24/new_company_tvm.html create mode 100644 _site/security/index.html create mode 100644 security.md diff --git a/_posts/2019-06-24-new_company_tvm.md b/_posts/2019-06-24-new_company_tvm.md new file mode 100644 index 0000000..0fe1f7f --- /dev/null +++ b/_posts/2019-06-24-new_company_tvm.md @@ -0,0 +1,46 @@ +--- +title: tvm at a new company +categories: security +--- + +# no new problems +i recently started a new job and am faced with the usual: "please set up our scanners and Make Us Secure", "What Do These Alerts Mean", etc etc. i keep thinking about the scanning / threat and vulnerability management (TVM) aspect, so i want to write about that. here are a list of questions that i've been asking myself, along with some possible answers. + +## using an existing scanning install or starting over +it may be reasonable to nuke an install if: + +- data existing in the install is massively out of date / bad / for some reason is fucked up data +- data existing in the install doesn't tell you anything useful; 'these ips are alive' isn't useful. + +times when you definitely should not nuke an install: +- if the install is tied to existing agents; losing those agent connections would be a mistake + +those are really the only hard constraints i can think of. everything else seems pretty grey + +## are naming schemes important enough to spend time on +hard yes. some of the names in use at my new place are frankly /hilarious/. and bad. "aaah, a scan template called 'corp users', what do you suppo - oh, its for scanning production? of course." + +i picked a rough naming scheme template for all objects, and then tweaked it on a per-object-type basis, i.e.: + +ProductName - Environment - Geolocation - Data + +"search - prod - aus" is pretty straight forward, and then the 'data' field can be where you really express differences between the object classes. if it ends up looking a bit different between object classes, that's ok. the most important thing for naming schemes is consistency to the rules you set. everything else, while still important, is secondary. + +## a note on scan schedules +think about what a particular scan is trying to accomplish. if the goal of a scan is to get data from /corporate servers/ then a typical overnight maintenance window makes sense. + +if the goal is to get data from /the entire corporate netblock/ then scanning over night is probably really stupid, unless the entire company works during that time. after all, most companies are deploying large laptop fleets that all get taken home at the end of the day! instead, you can tackle this by doing one of these: +- scan midday, during the work hours, at several different times to catch differently shifted people +- install agents on all laptop / movable devices + +ok, apparently the title should be "two notes on sacns". if your goal is to scan sensitive production servers make sure you reach out to the ops team that manages those servers. they should know, you should have a paper trail proving you at least made best efforts to communicate, etc. + + +## what other things should I check on + +- is the OS backing the scanning app still getting updates? a lot of people fire and forget scan setups so make sure you're not running shit off some idiots ubuntu 12 install. +- how much of the infrastructure are we actually scanning? do have blind spots? + - if there isn't an ipam then this will be reaaaaal hard to figure out, but its very important. +- is your license sufficient or will you have to get more approved before you can actually achieve good coverage? +- are there any non-expiring exceptions? + - if so, i recommend nuking them and rebuilding them with at the most a 1 year expiration date; force the company to re-eval once a year if they really want these risks. diff --git a/_site/index.html b/_site/index.html index 531deae..d8bbfc7 100644 --- a/_site/index.html +++ b/_site/index.html @@ -4,7 +4,7 @@ - + @@ -42,6 +42,7 @@

šŸ¤– projects
šŸ§Ÿ personal
+šŸ’© security thots
ā€šŸ§™ resume

diff --git a/_site/index.md b/_site/index.md index e8e225c..e0d3ca3 100644 --- a/_site/index.md +++ b/_site/index.md @@ -2,4 +2,5 @@ hi you have reached the landing page of me, the person whose name is above this šŸ¤– [projects](/projects/) šŸ§Ÿ [personal](/personal/) +šŸ’© [security thots](/security/) ā€šŸ§™ [resume](/josiah-resume.pdf) diff --git a/_site/personal/2019/04/15/friendsgiving.html b/_site/personal/2019/04/15/friendsgiving.html index 10253e8..454d5ae 100644 --- a/_site/personal/2019/04/15/friendsgiving.html +++ b/_site/personal/2019/04/15/friendsgiving.html @@ -4,7 +4,7 @@ - + diff --git a/_site/personal/2019/04/15/lt_thanksgiving.html b/_site/personal/2019/04/15/lt_thanksgiving.html index 9e1ae29..5155d3f 100644 --- a/_site/personal/2019/04/15/lt_thanksgiving.html +++ b/_site/personal/2019/04/15/lt_thanksgiving.html @@ -4,7 +4,7 @@ - + diff --git a/_site/personal/2019/04/15/rad_boys_only.html b/_site/personal/2019/04/15/rad_boys_only.html index 1537e71..fed4711 100644 --- a/_site/personal/2019/04/15/rad_boys_only.html +++ b/_site/personal/2019/04/15/rad_boys_only.html @@ -4,7 +4,7 @@ - + diff --git a/_site/personal/2019/04/18/vcards.html b/_site/personal/2019/04/18/vcards.html index 9fe58c9..98d5aad 100644 --- a/_site/personal/2019/04/18/vcards.html +++ b/_site/personal/2019/04/18/vcards.html @@ -4,7 +4,7 @@ - + diff --git a/_site/personal/index.html b/_site/personal/index.html index 37a51c2..41323af 100644 --- a/_site/personal/index.html +++ b/_site/personal/index.html @@ -4,7 +4,7 @@ - + diff --git a/_site/projects/2019/04/15/hosting_static_sites_on_s3.html b/_site/projects/2019/04/15/hosting_static_sites_on_s3.html index 4d9b8e8..77fbb9f 100644 --- a/_site/projects/2019/04/15/hosting_static_sites_on_s3.html +++ b/_site/projects/2019/04/15/hosting_static_sites_on_s3.html @@ -4,7 +4,7 @@ - + diff --git a/_site/projects/2019/04/15/mojojojo_bot.html b/_site/projects/2019/04/15/mojojojo_bot.html index 4203f56..29005ec 100644 --- a/_site/projects/2019/04/15/mojojojo_bot.html +++ b/_site/projects/2019/04/15/mojojojo_bot.html @@ -4,7 +4,7 @@ - + diff --git a/_site/projects/2019/04/15/workingcopy.html b/_site/projects/2019/04/15/workingcopy.html index 6160673..4f7a5e7 100644 --- a/_site/projects/2019/04/15/workingcopy.html +++ b/_site/projects/2019/04/15/workingcopy.html @@ -4,7 +4,7 @@ - + diff --git a/_site/projects/2019/06/23/pynit.html b/_site/projects/2019/06/23/pynit.html index 998503f..1ba60cb 100644 --- a/_site/projects/2019/06/23/pynit.html +++ b/_site/projects/2019/06/23/pynit.html @@ -4,7 +4,7 @@ - + diff --git a/_site/projects/index.html b/_site/projects/index.html index a6510f3..745aed0 100644 --- a/_site/projects/index.html +++ b/_site/projects/index.html @@ -4,7 +4,7 @@ - + + + +tvm at a new company | josiah ledbetter + + + + + + + + + + + + + + + + +
+
+ +
+

josiah ledbetter

+
+
+ + +
+
+
+

no new problems

+

i recently started a new job and am faced with the usual: ā€œplease set up our scanners and Make Us Secureā€, ā€œWhat Do These Alerts Meanā€, etc etc. i keep thinking about the scanning / threat and vulnerability management (TVM) aspect, so i want to write about that. here are a list of questions that iā€™ve been asking myself, along with some possible answers.

+ +

using an existing scanning install or starting over

+

it may be reasonable to nuke an install if:

+ +
    +
  • data existing in the install is massively out of date / bad / for some reason is fucked up data
    • +
  • data existing in the install doesnā€™t tell you anything useful; ā€˜these ips are aliveā€™ isnā€™t useful.
    • +
+ +

times when you definitely should not nuke an install:

+
    +
  • if the install is tied to existing agents; losing those agent connections would be a mistake
    • +
+ +

those are really the only hard constraints i can think of. everything else seems pretty grey

+ +

are naming schemes important enough to spend time on

+

hard yes. some of the names in use at my new place are frankly /hilarious/. and bad. ā€œaaah, a scan template called ā€˜corp usersā€™, what do you suppo - oh, its for scanning production? of course.ā€

+ +

i picked a rough naming scheme template for all objects, and then tweaked it on a per-object-type basis, i.e.:

+ +

ProductName - Environment - Geolocation - Data

+ +

ā€œsearch - prod - ausā€ is pretty straight forward, and then the ā€˜dataā€™ field can be where you really express differences between the object classes. if it ends up looking a bit different between object classes, thatā€™s ok. the most important thing for naming schemes is consistency to the rules you set. everything else, while still important, is secondary.

+ +

a note on scan schedules

+

think about what a particular scan is trying to accomplish. if the goal of a scan is to get data from /corporate servers/ then a typical overnight maintenance window makes sense.

+ +

if the goal is to get data from /the entire corporate netblock/ then scanning over night is probably really stupid, unless the entire company works during that time. after all, most companies are deploying large laptop fleets that all get taken home at the end of the day! instead, you can tackle this by doing one of these:

+
    +
  • scan midday, during the work hours, at several different times to catch differently shifted people
    • +
  • install agents on all laptop / movable devices
    • +
+ +

ok, apparently the title should be ā€œtwo notes on sacnsā€. if your goal is to scan sensitive production servers make sure you reach out to the ops team that manages those servers. they should know, you should have a paper trail proving you at least made best efforts to communicate, etc.

+ +

what other things should I check on

+ +
    +
  • is the OS backing the scanning app still getting updates? a lot of people fire and forget scan setups so make sure youā€™re not running shit off some idiots ubuntu 12 install.
    • +
  • how much of the infrastructure are we actually scanning? do have blind spots? +
      +
    • if there isnā€™t an ipam then this will be reaaaaal hard to figure out, but its very important.
      • +
    +
    • +
  • is your license sufficient or will you have to get more approved before you can actually achieve good coverage?
    • +
  • are there any non-expiring exceptions? +
      +
    • if so, i recommend nuking them and rebuilding them with at the most a 1 year expiration date; force the company to re-eval once a year if they really want these risks.
      • +
    +
    • +
+ +
+ +
+ +
+ +
+
+ + + + diff --git a/_site/security/index.html b/_site/security/index.html new file mode 100644 index 0000000..2f7f297 --- /dev/null +++ b/_site/security/index.html @@ -0,0 +1,62 @@ + + + + + + + + + + + + +security thots | josiah ledbetter + + + + + + + + + + + + +
+
+ +
+

josiah ledbetter

+
+
+ + +
+
+
+

Posts in category "security thots" are:

+ + + +
+ +
+ +
+ +
+
+ + + + diff --git a/index.md b/index.md index e8e225c..e0d3ca3 100644 --- a/index.md +++ b/index.md @@ -2,4 +2,5 @@ hi you have reached the landing page of me, the person whose name is above this šŸ¤– [projects](/projects/) šŸ§Ÿ [personal](/personal/) +šŸ’© [security thots](/security/) ā€šŸ§™ [resume](/josiah-resume.pdf) diff --git a/security.md b/security.md new file mode 100644 index 0000000..044a6f0 --- /dev/null +++ b/security.md @@ -0,0 +1,13 @@ +--- +permalink: /security/ +title: security thots +--- +

Posts in category "security thots" are:

+ +