RE: Top 15 Reasons Why Admins Use Security Scan ners

[Ron DuFresne <dufresne () winternet com>]

On Thu, 29 Apr 2004, Stuart Fox (DSL AK) wrote:

> > > > Question: Should admins be using security
> > > scanners?
> > >
> > > Someone should be.  Admins should be to confirm that their
> > environment
> > > is in the state that they believe it to be.
> >
> > I guess we'll have to agree to disagree.  In my experience,
> > the guy who set a system up shouldn't be the one to inspect
> > it, or verify it.
>
> Well in some environments that's not an option.  In others, you might
> delegate setting up a system to junior techs and you need to confirm that
> they've been following correct procedures.  It might also indicate that your
> procedures are useless.

Agreed, and who says that there has to be only one check?  Reverification
should be made prior to commisioning the system to production.


Additionally, either security is a part of everyones job or it is not.

> > Also, I'm sort of thinking that if someone doesn't know how
> > to set up and maintain a system, what good is it for that
> > same person to run a scanner on it?
>
> Well, it might indicate to them that there are issues with the way they do
> things.  Sure, if they're not paying attention or are not switched on, they
> might not get anything from running a scanner.  However, if they are
> learning, they'll say "Hey, I could improve my process here and make things
> better".  The answer to your question is, it depends, and the good will
> range from nothing to a  lot.
>
> > > Again, have new types of vulnerabilities been discovered, are there
> > > new best practices.  The reason Code Red hit so hard was because
> > > people didn't know about removing script mappings - it
> > wasn't a common
> > > best practice.  It became one pretty quickly after Code Red.
> >
> > Actually, the best practice of removing unnecessary
> > functionality has long been in place, well before Code Red
> > reared it's head.
> > The same is true with the best practice of
> > removing unnecessary script mappings...this was documented by
> > Microsoft and available for free from their site well before
> > Code Red came out.
>
> Removing unnecessary functionality has indeed been in place for a long time.
> Code Red indicated that whether Microsoft documented it or not, the best
> practice wasn't common.  In fact, before Code Red, it wasn't exactly obvious
> that this was a recommended best practice, and the documentation wasn't
> really clear.  It's very clear now.

Wasn't clear from MS's documentation, but was very clear in standard best
practises in the IT security realm, since the days of the morris worm.
Though best practises were and still are often sidestepped for simplicity
and 'functionality'.

> > With regards to the rest of your comments, I think you're
> > missing the point.  I'm not saying that a security scanner
> > shouldn't be run...I just don't think that admins should be
> > the ones to run the scanner.
>
> That's not how it read.  Admins is a pretty blanket statement.  In an ideal
> world, security admins should run the scan while others do their work.
> However, in a lot of environments, there isn't a dedicated security admin -
> it's just a normal admin who has to manage security along with the other 10
> million things he has to do.  Is that bad? - yep, it sucks.  However, an
> admin running the scanner is better than noone running the scanner.

I work in an env whence the security folks know little more then the
andswers they gave to acquire their CISSP, and spend most of their time
trying to determine whose been downloading pron and using IM.  Anything
else and they come to the unix admins for info.  Sure they run a couple of
scanners on systems and the false alarms are rampant when they do, becuase
they tend to treat the scanners reports as gospel and their toy as
infallible.  God forbid they get up and ask the admin of the unix box why
their tricket is reporting a unix system as running a remote access tool
for windows systems.  Thank the gawds that be they are putting most of
their efforts into reducing pron in the workplace and issueing virus
alerts a week after the fact.

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html