This control, Continuous Vulnerability Assessment and Remediation is an important mechanism to detect known vulnerabilities, if possible patch them or use additional host or network controls to prevent exploitation until a patch or update is released. Preferably, the assessment tools should categorized the discovered vulnerabilities using industry recognized standards such as CVE to correlate and classify the data obtained with other network devices such as a SIM, to detect attempts or successful exploitation of the vulnerability.

There are a large number of vulnerability management tools available on the market (free and commercial) which can be used to evaluate system configuration on a continuous basis. A first step would be to run a daily discovery scan against network devices and run a full audit of the systems with credentials on a weekly basis, taking into consideration the impact on the network (i.e. when the network devices are the least busy). This would ensure that new found vulnerabilities are taken care of in a timely manner soon after they have been discovered. Whenever possible, it is important the patch be tested in an environment that mimics the production system before being pushed enterprise wide. If the patch fails the tests, other mitigating controls should be tested and put in place to prevent exploitation.

In order to put in place an effective continuous vulnerability assessment plan, the enterprise scanner should be able to compare the results against a baseline and alert the security team when significant changes are detected. This can be done via a ticketing system, with email, etc.

All system identified in CC1 should be scanned for known vulnerabilities and should alert the security team upon the discovery of new devices. To ensure CC10 is effective, the security team must conduct a periodic review that the daily and weekly assessments are working as configured and have completed successfully.

There are many more audit tools out there than those posted below, let us know what have been the most effective in your environment.

Commercial Audit Tools

Retina: http://www.eeye.com
GFI LanGuard: http://www.gfi.com
nCircle: http://www.ncircle.com
Nessus: http://www.tenable.com
Qualys: http://www.qualys.com

Freeware Audit Tools

IPScanner: http://www.radmin.com/products/ipscanner/index.php
PSI: http://secunia.com/vulnerability_scanning/personal/
Nmap: http://insecure.org
OpenVAS: http://www.openvas.org

[1] http://www.sans.org/critical-security-controls/control.php?id=10

-----------

Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu