Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 8. Vulnerability Assessment768.2. Defining Assessment and TestingVulnerability assessments may be broken down into one of two types: Outside looking in and insidelooking around.When performing an outside looking in vulnerability assessment, you are attempting to compromiseyour systems from the outside. Being external to your company provides you with the cracker'sviewpoint. You see what a cracker sees — publicly-routable IP addresses, systems on your DMZ,external interfaces of your firewall, and more. DMZ stands for "demilitarized zone", which correspondsto a computer or small subnetwork that sits between a trusted internal network, such as a corporateprivate LAN, and an untrusted external network, such as the public Internet. Typically, the DMZcontains devices accessible to Internet traffic, such as Web (HTTP ) servers, FTP servers, SMTP (e-mail) servers and DNS servers.When you perform an inside looking around vulnerability assessment, you are somewhat at anadvantage since you are internal and your status is elevated to trusted. This is the viewpoint you andyour co-workers have once logged on to your systems. You see print servers, file servers, databases,and other resources.There are striking distinctions between these two types of vulnerability assessments. Being internalto your company gives you elevated privileges — more so than any outsider. Still today in mostorganizations, security is configured in such a manner as to keep intruders out. Very little is done tosecure the internals of the organization (such as departmental firewalls, user-level access controls,authentication procedures for internal resources, and more). Typically, there are many more resourceswhen looking around inside as most systems are internal to a company. Once you set yourself outsideof the company, you immediately are given an untrusted status. The systems and resources availableto you externally are usually very limited.Consider the difference between vulnerability assessments and penetration tests. Think of avulnerability assessment as the first step to a penetration test. The information gleaned from theassessment is used for testing. Whereas, the assessment is checking for holes and potentialvulnerabilities, the penetration testing actually attempts to exploit the findings.Assessing network infrastructure is a dynamic process. Security, both information and physical, isdynamic. Performing an assessment shows an overview, which can turn up false positives and falsenegatives.Security administrators are only as good as the tools they use and the knowledge they retain. Takeany of the assessment tools currently available, run them against your system, and it is almost aguarantee that there are some false positives. Whether by program fault or user error, the result is thesame. The tool may find vulnerabilities which in reality do not exist (false positive); or, even worse, thetool may not find vulnerabilities that actually do exist (false negative).Now that the difference between a vulnerability assessment and a penetration test is defined, take thefindings of the assessment and review them carefully before conducting a penetration test as part ofyour new best practices approach.WarningAttempting to exploit vulnerabilities on production resources can have adverse effects tothe productivity and efficiency of your systems and network.The following list examines some of the benefits to performing vulnerability assessments.