BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Rogue Asset Detection

Posted March 3, 2011    Morey Haber

A few weeks ago in my blog, I mentioned a critique regarding targeted vulnerability assessment and its ability to not identify rogue devices.  Anytime you have definitive host list (by host name or from Active Directory for example), or a fixed set of IP addresses (versus ranges) you can potentially miss devices connected to your network for vulnerability assessment. Whether those devices are authorized or not becomes the primary point for rogue asset detection. The hardest part of rogue asset detection is performing an initial assessment of everything on a given network and determining what is authorized and what is not. Many times just pulling back the host name, operating system, and domain is sufficient to determine this. The example below is from Retina CS and shows how to do this for Windows devices:

This simple rule will automatically build a logical group of machines where the domain name is not “eEye”. The default domain for Windows can be everything from MSHome to Workgroup and if the host is not registered to the domain (most rogue devices for Windows are not since the user should / would not have permissions to join the domain) the asset would be listed in the group.

Just as easily, if your organization uses a standardized NetBIOS naming convention, a simple rule like this could group machines that do not follow the correct syntax and could be potentially rogues regardless of the operating system:

This would group all assets (in an IP range, not shown) that would not contain a string USPHX for devices potentially located in the United States and Phoenix.  If the standard naming convention is not followed, they would be grouped for further investigation.

Retina CS allows for a large variety of rules to be created that can capture traits from a host that do not conform to your deployment policies and group them for reference. These can be used to isolate rogue devices based on anything from the operating system, asset name, and even to ports and services available on the asset. For example, “this subnet should never have any webservers running”, would be an example of a potential rogue application. It only takes a little standardization to build a rule to capture the devices that do not comply.

Next,  once we have established a baseline for what is legitimately on the network, we need to capture unauthorized changes that could be rogue devices.  Many organizations only perform a single quarterly vulnerability assessment due to regulatory compliance or  a lack of resources. For these businesses, I would strongly encourage using a VA solution to discover (not necessarily assess) your network at least once a week to identify and document any changes that may occur. Using a discovery scan frequently (even daily), can identify any changes. Consider the rule below:

This will build a group (and even send email alerts) for newly discovered devices that are less than one day old, or for any devices that have not been detected or updated within 8 days. Therefore, if I am scanning once a week,  I can capture new devices (possible rogues) and any devices that may have been taken off the network in appropriately.

Rogue asset detection can be tricky when assessment or discovery scans do not occur on a frequent basis. In addition, if an organization does not have any standardization for naming, operating systems, or policies for change control, the problem is compounded.  This can lead to improper mappings when creating rules because policies are not being used as a point of reference to identify deviations.  In order to perform any type of rogue asset detection, you must first establish a baseline. Then you can determine if any changes that occur are acceptable and if they do occur, which systems should be investigated further. Ask your team members two questions:

- Do you know all of the devices on your network?

– Are they all authorized?

If the answer is “no” to either of these questions, you should consider using your vulnerability assessment to help with rogue asset detection.

Leave a Reply

Additional articles

webinar_chalk

Webinar March 4th: Recreating the Carbanak Breach & Techniques for Mitigating Similar Attacks

Posted March 3, 2015    Lindsay Marsh

Join BeyondTrust Research and Development team for an in-depth live webinar that will explore the attack vectors used in the Carbanak Bank Breach and share successful mitigation techniques needed to prevent this type of attack.

Tags:
, ,
VMware Hardening Guidelines-img3

How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

Posted February 27, 2015    BeyondTrust Research Team

Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

Tags:
, , , ,
dave-shackleford-headshot

Privileged Passwords: The Bane of Security Professionals Everywhere

Posted February 19, 2015    Dave Shackleford

Passwords have been with us since ancient times. Known as “watchwords”, ancient Roman military guards would pass a wooden tablet with a daily secret word engraved from one shift to the next, with each guard position marking the tablet to indicate it had been received. The military has been using passwords, counter-passwords, and even sound…

Tags:
, , ,