5 Best Practices for Credentialed Scanning

save
Share and earn Cybytes
Facebook Twitter Google+ LinkedIn Email

Performing vulnerability scans with or without credentials has been a hotly debated issue: On one hand, uncredentialed scans provide security teams with a hacker’s view of the organization, with a small subset of vulnerabilities to fix. And on the other, credentialed scans provide a complete view of all known vulnerabilities – which may or may not be immediately important, but can end up overwhelming teams.

Moreover, uncredentialed scans can overwhelm the network infrastructure due to the unpredictable nature of the scan (credentialed scans, if done well, could hardly bother network infrastructure). Uncredentialed scans are less accurate due to a higher number of false positives (credentialed scans are more accurate due to the nature of the scan). Last but not least, uncredentialed scans, as the name suggests, don’t require credentials, while credentialed scans do.

The last part, in some cases, invokes deep concerns within IT teams. And it’s partly driven by the idea of trusting a piece of software or person(s) with credentials (typically root/admin) for the organization. In this post, I’ll discuss tips to alleviate these fears and share five best practices for credentialed scanning within your organization.

Who needs to know? Security managers and engineers

What do you need to know? Vulnerability scanning without credentials provides limited visibility into critical vulnerabilities and increases false positives and false negatives. Yet, over 55% of scans are run without credentials.

Why should you care? The majority of exploit kits, malware and ransomware target client-side vulnerabilities and are delivered via social attacks such as phishing and drive-by exploitation that require credentialed scanning to fully assess true Cyber Exposure.

What can you do? Follow the best practices outlined in this blog post.

Why should you scan with credentials?

Credentialed scans, if done well with appropriate privileges, provide the most accurate view of cyber risk within your organization. They bypass the usual downsides associated with uncredentialed scans, such as high false positives and high network bandwidth usage. In some cases, they even finish faster due to reduced back-and-forth between the scanner and target.

If your organization’s goal is to understand your true risk, then credentialed scans will provide the most accurate insight. It’s always better to make vulnerability prioritization decisions based on all available information, rather than restricting it to a small subset of vulnerabilities discovered by uncredentialed scans.

Credentialed scanning best practices

Here are five best practices to perform credentialed scans within your organization:

Best practice #1: Use a dedicated scanning account

Set up a dedicated scanner account for credentialed scans rather than using existing accounts. The dedicated account should be fine-tuned to execute only those actions authorized by the IT team. Some organizations take this practice a step further and temporarily disable the scanning account once the weekly or monthly scans are finished.

Best practice #2: Use public key authentication or complex passwords

When possible, especially with SSH-based scans, use public key authentication over password-based authentication. The risk with password-based authentication is that a malicious insider or attacker could set up a rogue SSH server within the organization and collect the password from the scan during the next scan run. You should also supply the “known_hosts” file containing the fingerprints of the hosts to connect to the scanner, so as to avoid connecting to a rogue host. If you must go with password-based authentication, use complex passwords at a minimum.

Best practice #3: Leverage credentials managers

If your organization leverages credential managers such as Thycotic or CyberArk, you can use existing Tenable integrations with these products to quickly transition to credentialed scans without having to set up the credentials in Tenable products all over again.

At a high level, this requires setting up scan policies to authenticate to a credential manager, which on successful authentication provides credentials to perform credentialed scans. See below for specific instructions:

  1. Thycotic
  2. CyberArk

Best practice #4: Use “least privilege” scanning

For *nix-based systems, you can now review which commands are run by the scanner and the privileges they were run with. This information can be used to restrict the scanning account to only the least set of privileges required for the scan. Tenable recently released a feature for SSH-based scans that would allow you to do just that. The process involves setting up an account with sudo privileges and then modifying ‘/etc/sudoers’ file to include the authorized list of commands based on results from plugin IDs 102094 and 102095.

The plugins provide insight into two critical aspects of a credentialed scan:

  • Which plugins ran with elevated privileges, and which specific commands did they run?
  • Which plugins tried to run with elevated privileges and failed due to lack of privileges?

The plugin output is in machine readable YAML format, so it’s possible to parse the output and take automated actions to update relevant files.

Best practice #5: Assess authentication failures

Finally, what good are credentials if they don’t work? At Tenable, we’ve observed scanners fail to log into systems due to a variety of reasons, such as:

  • Credentials are revoked
  • Scanning accounts are deleted
  • Credentials are updated or expired

When these changes occur, the scanning solution isn’t always in the loop.

To help address this issue, we released a new plugin to summarize authentication failures across all *nix, Windows, databases and a variety of other systems supported by Nessus. Please review the output of the plugin and set up automated processes to trigger action events if scans return with a positive hit for Plugin ID 104410.

Wrap-up

Credentialed scans help provide the most accurate snapshot of your organization. They’ll help find vulnerabilities that would never be discovered by uncredentialed scans (e.g., client-side vulnerabilities). You should therefore perform credentialed scans whenever possible. The information provided by a credentialed scan will help fill the gaps in your security architecture and provide insight into how to improve your information security program.

Share this post and earn Cybytes
Facebook Twitter Google+ LinkedIn Email
Follow
1566 Followers
About Tenable
Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into Tenable.io™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at tenable.com.
Promoted Content
Five Steps to Building a Successful Vulnerability Management Program
Is your vulnerability management program struggling? Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel