Vulners NASL Plugin Feeds for OpenVAS 9
As I already wrote earlier, you can easily add third party nasl plugins to #OpenVAS. So, my friends from Vulners.com realised generation of #NASL plugins for #OpenVAS using own security content. I’ve tested it for scanning #CentOS 7 host. And it works =)
Let’s see the whole process.
#vulnerscom #OpenVAS #NASL #CESA #CentOS #VulnerabilityManagement #VulnerabilityDatabases
Read more: https://avleonov.com/2017/10/04/vulners-nasl-plugin-feeds-for-openvas-9/
As I already wrote earlier, you can easily add third party nasl plugins to #OpenVAS. So, my friends from Vulners.com realised generation of #NASL plugins for #OpenVAS using own security content. I’ve tested it for scanning #CentOS 7 host. And it works =)
Let’s see the whole process.
#vulnerscom #OpenVAS #NASL #CESA #CentOS #VulnerabilityManagement #VulnerabilityDatabases
Read more: https://avleonov.com/2017/10/04/vulners-nasl-plugin-feeds-for-openvas-9/
CWEs in NVD CVE feed: analysis and complaints
As you probably know, one of the ways to describe the nature of some software #vulnerability is to provide corresponding #CWE (Common Weakness Enumeration) ids. Let’s see the #CWE links in #NVD #CVE base.
I have already wrote earlier how to deal with #NVD feed using #python in “Downloading and analyzing #NVD #CVE feed“. You can easily get CWEs ids iterating over `cve_dict['CVE_Items']`.
#python #NVD #CWE #cvedetails #CVE #VulnerabilityDatabases
Read more: https://avleonov.com/2017/10/21/cwes-in-nvd-cve-feed-analysis-and-complaints/
As you probably know, one of the ways to describe the nature of some software #vulnerability is to provide corresponding #CWE (Common Weakness Enumeration) ids. Let’s see the #CWE links in #NVD #CVE base.
I have already wrote earlier how to deal with #NVD feed using #python in “Downloading and analyzing #NVD #CVE feed“. You can easily get CWEs ids iterating over `cve_dict['CVE_Items']`.
#python #NVD #CWE #cvedetails #CVE #VulnerabilityDatabases
Read more: https://avleonov.com/2017/10/21/cwes-in-nvd-cve-feed-analysis-and-complaints/
ISACA Moscow Vulnerability Management Meetup 2017
Last Thursday, I attended a very interesting event entirely dedicated to #VulnerabilityManagement – open #ISACA Moscow meetup. Me and my former colleague from #MailRuGroup #DmitryChernobaj presented there our joint report “Enterprise Vulnerability Management: fancy marketing brochures and the real-life troubles”.
The number of registered participants totalled 120. As I can tell looking at the photo below, there were about 80 people in the hall after the second presentation. For a highly focussed local information security event, it’s a lot. According to the organizers, it was the largest #ISACA Moscow meetup. Thanks to everyone who came!
I would like to mention a well-structured agenda. There were 4 presentations arranged in order: from the most theoretical / methodical to the most practical. And our presentation was the last one.
#TenableSecurityCenter #SANS #OlegBoyko #MailRuGroup #ITIL #ISACA #EkaterinaPukhareva #DmitryChernobaj #COBIT #AlexBodryk #VulnerabilityManagement #Events
Read more: https://avleonov.com/2017/10/23/isaca-moscow-vulnerability-management-meetup-2017/
Last Thursday, I attended a very interesting event entirely dedicated to #VulnerabilityManagement – open #ISACA Moscow meetup. Me and my former colleague from #MailRuGroup #DmitryChernobaj presented there our joint report “Enterprise Vulnerability Management: fancy marketing brochures and the real-life troubles”.
The number of registered participants totalled 120. As I can tell looking at the photo below, there were about 80 people in the hall after the second presentation. For a highly focussed local information security event, it’s a lot. According to the organizers, it was the largest #ISACA Moscow meetup. Thanks to everyone who came!
I would like to mention a well-structured agenda. There were 4 presentations arranged in order: from the most theoretical / methodical to the most practical. And our presentation was the last one.
#TenableSecurityCenter #SANS #OlegBoyko #MailRuGroup #ITIL #ISACA #EkaterinaPukhareva #DmitryChernobaj #COBIT #AlexBodryk #VulnerabilityManagement #Events
Read more: https://avleonov.com/2017/10/23/isaca-moscow-vulnerability-management-meetup-2017/
Starting/stopping Amazon EC2 instances using CLI and Python SDK
It’s a very good practice to #scan your perimeter from the outside of your network, simulating an attacker. However, you will need to deploy the scanners somewhere to do this. Hosting on #AmazonEC2 can be a good and cost-effective option, especially if you start instances with #vulnerability scanners only when it’s necessary and keep them stopped at other time.
So, in this post I will give some examples of how to manage #Amazon instances automatically using the #AWS CLI or Python SDK (boto3): start/stop the instance and get the public ip address.
#python #AWS #AmazonEC2 #Amazon #Concept
Read more: https://avleonov.com/2017/11/01/startingstopping-amazon-ec2-instances-using-cli-and-python-sdk/
It’s a very good practice to #scan your perimeter from the outside of your network, simulating an attacker. However, you will need to deploy the scanners somewhere to do this. Hosting on #AmazonEC2 can be a good and cost-effective option, especially if you start instances with #vulnerability scanners only when it’s necessary and keep them stopped at other time.
So, in this post I will give some examples of how to manage #Amazon instances automatically using the #AWS CLI or Python SDK (boto3): start/stop the instance and get the public ip address.
#python #AWS #AmazonEC2 #Amazon #Concept
Read more: https://avleonov.com/2017/11/01/startingstopping-amazon-ec2-instances-using-cli-and-python-sdk/
Exploitability attributes of Nessus plugins: good, bad and Vulners
Exploitability is one of the most important criteria for prioritizing vulnerabilities. Let’s see how good is the exploit-related data of #Tenable #Nessus #NASL plugins and whether we can do it better.
What are the attributes related to exploits? To understand this, I parsed all nasl plugins and got the following results.
#vulnerscom #Tenable #SAINT #PacketStorm #Nessus #NASL #Metasploit #malware #exploits #Exploithub #ExploitDB #DSquare #D2Elliot #Core #Canvas #VulnerabilityManagement #VulnerabilityDatabases
Read more: https://avleonov.com/2017/11/02/exploitability-attributes-of-nessus-plugins-good-bad-and-vulners/
Exploitability is one of the most important criteria for prioritizing vulnerabilities. Let’s see how good is the exploit-related data of #Tenable #Nessus #NASL plugins and whether we can do it better.
What are the attributes related to exploits? To understand this, I parsed all nasl plugins and got the following results.
#vulnerscom #Tenable #SAINT #PacketStorm #Nessus #NASL #Metasploit #malware #exploits #Exploithub #ExploitDB #DSquare #D2Elliot #Core #Canvas #VulnerabilityManagement #VulnerabilityDatabases
Read more: https://avleonov.com/2017/11/02/exploitability-attributes-of-nessus-plugins-good-bad-and-vulners/
Study Vulnerability Assessment in Tenable University for free
Not so long ago, #Tenable presented renewed online training platform – #Tenable University. It is publicly available even for non-customers, for example, for #Nessus Home users. However, not all courses are available in this case.
I decided to check it out, registering as non-customer.
#Tenableio #TenableSecurityCenter #Nessus #VulnerabilityManagement
Read more: https://avleonov.com/2017/11/09/study-vulnerability-assessment-in-tenable-university-for-free/
Not so long ago, #Tenable presented renewed online training platform – #Tenable University. It is publicly available even for non-customers, for example, for #Nessus Home users. However, not all courses are available in this case.
I decided to check it out, registering as non-customer.
#Tenableio #TenableSecurityCenter #Nessus #VulnerabilityManagement
Read more: https://avleonov.com/2017/11/09/study-vulnerability-assessment-in-tenable-university-for-free/
Alexander V. Leonov
Study Vulnerability Assessment in Tenable University for free
Not so long ago, Tenable presented renewed online training platform - Tenable University. It is publicly available even for non-customers, for example, for Nessus Home users. However, not all courses are available in this case. I decided to check it out,…
Vulnerability Management vendors and massive Malware attacks (following the Bad Rabbit)
After the latest Bad Rabbit #ransomware attack all Top VM vendors #Qualys, #Tenable, #Rapid7 wrote blog posts on this topic on the same day. Two days later #Tripwire also published own review. Why do they care? They do not make antiviruses, #endpoint protection or firewalls – the common tools against this kind of threats. So, what’s the point?
Well, they do it is obviously to promote their products and services. But how exactly?
#Tripwire #Tenable #Rapid7 #ransomware #Qualys #mimicatz #IOC #EternalBlue #ComplianceCheck #BadRabbit #AltxSoft #VulnerabilityManagement #ComplianceManagement
Read more: https://avleonov.com/2017/11/10/vulnerability-management-vendors-and-massive-malware-attacks-following-the-badrabbit/
After the latest Bad Rabbit #ransomware attack all Top VM vendors #Qualys, #Tenable, #Rapid7 wrote blog posts on this topic on the same day. Two days later #Tripwire also published own review. Why do they care? They do not make antiviruses, #endpoint protection or firewalls – the common tools against this kind of threats. So, what’s the point?
Well, they do it is obviously to promote their products and services. But how exactly?
#Tripwire #Tenable #Rapid7 #ransomware #Qualys #mimicatz #IOC #EternalBlue #ComplianceCheck #BadRabbit #AltxSoft #VulnerabilityManagement #ComplianceManagement
Read more: https://avleonov.com/2017/11/10/vulnerability-management-vendors-and-massive-malware-attacks-following-the-badrabbit/
Harassment scandals, Sheldon Cooper, Black Mirror and blockchain
Lots of good jokes in a popular #TV show The Big Bang Theory are related to Sheldon Cooper’s bureaucracy in interpersonal relationships: all these “roommate agreement”, “relationship agreement”, etc.
However, because of these endless harassment scandals in media, now it seems like a best practice. 😉
I’m not particularly interested in who is right or wrong in any particular scandal. But the scheme itself seems corrupted.
In the current reality, when, as we can see, **any joint action** can be post factum **presented as violent and committed under pressure** , even after 10-20 years, and can lead to very sad consequences, any oral arrangements are rapidly depreciating.
#privacy #contract #blockchain #Concept
Read more: https://avleonov.com/2017/11/16/harassment-scandals-sheldon-cooper-black-mirror-and-blockchain/
Lots of good jokes in a popular #TV show The Big Bang Theory are related to Sheldon Cooper’s bureaucracy in interpersonal relationships: all these “roommate agreement”, “relationship agreement”, etc.
However, because of these endless harassment scandals in media, now it seems like a best practice. 😉
I’m not particularly interested in who is right or wrong in any particular scandal. But the scheme itself seems corrupted.
In the current reality, when, as we can see, **any joint action** can be post factum **presented as violent and committed under pressure** , even after 10-20 years, and can lead to very sad consequences, any oral arrangements are rapidly depreciating.
#privacy #contract #blockchain #Concept
Read more: https://avleonov.com/2017/11/16/harassment-scandals-sheldon-cooper-black-mirror-and-blockchain/
ZeroNights 2017: back to the cyber 80s
Last Friday, 17th of November, I attended the ZeroNights 2017 conference in Moscow. And it was pretty awesome. Thanks to the organizers! Here I would like to share some of my impressions.
First of all, I want to say that two main Moscow events for information security practitioners, #PHDays and ZeroNights, provide an excellent opportunity to meet all of the colleagues at once and to synchronize current views on important information security issues, including, of course, #VulnerabilityManagement, the most relevant for me. My opinion is that this year’s behind-the-scene conversations were especially good. And this is the most valuable characteristic for the event.
Every ZeroNights event has it’s own style. This time it was some geeky cyber retro from 1980s, like in popular cult movie Kung Fury. The place was also changed from familiar Cosmos Hotel to ZIL Culture Centre. It is the largest Palace of Culture from the Soviet Moscow times. The combination of US 80s cultural artifacts, RETROWAVE music with Soviet-style interiors (including, for example, statue of Lenin) made a pretty weird combination, but I liked it =)
I was unintentionally taking photos using some strange mode in camera and recorded a very short video fragment (3-5 seconds) for each photo. I decided to combine this fragments in a small video. This does not make much sense, but, perhaps, someone will find this “time-lapse” interesting 😉
Among the great presentations and workshops, there were also a small exhibition. This year there was two #VulnerabilityManagement vendors: #BeyondSecurity and #Qualys.
#Yandex #WAS #w3af #SecuriTeam #SDLC #SAST #Qualys #mimikatz #Kaspersky #DAST #CloudAgents #BurpSuite #BeyondSecurity #AVDS #VulnerabilityManagement #Events #ZeroNights
Read more: https://avleonov.com/2017/11/19/zeronights-2017-back-to-the-cyber-80s/
Last Friday, 17th of November, I attended the ZeroNights 2017 conference in Moscow. And it was pretty awesome. Thanks to the organizers! Here I would like to share some of my impressions.
First of all, I want to say that two main Moscow events for information security practitioners, #PHDays and ZeroNights, provide an excellent opportunity to meet all of the colleagues at once and to synchronize current views on important information security issues, including, of course, #VulnerabilityManagement, the most relevant for me. My opinion is that this year’s behind-the-scene conversations were especially good. And this is the most valuable characteristic for the event.
Every ZeroNights event has it’s own style. This time it was some geeky cyber retro from 1980s, like in popular cult movie Kung Fury. The place was also changed from familiar Cosmos Hotel to ZIL Culture Centre. It is the largest Palace of Culture from the Soviet Moscow times. The combination of US 80s cultural artifacts, RETROWAVE music with Soviet-style interiors (including, for example, statue of Lenin) made a pretty weird combination, but I liked it =)
I was unintentionally taking photos using some strange mode in camera and recorded a very short video fragment (3-5 seconds) for each photo. I decided to combine this fragments in a small video. This does not make much sense, but, perhaps, someone will find this “time-lapse” interesting 😉
Among the great presentations and workshops, there were also a small exhibition. This year there was two #VulnerabilityManagement vendors: #BeyondSecurity and #Qualys.
#Yandex #WAS #w3af #SecuriTeam #SDLC #SAST #Qualys #mimikatz #Kaspersky #DAST #CloudAgents #BurpSuite #BeyondSecurity #AVDS #VulnerabilityManagement #Events #ZeroNights
Read more: https://avleonov.com/2017/11/19/zeronights-2017-back-to-the-cyber-80s/
Alexander V. Leonov
ZeroNights 2017: back to the cyber 80s
Last Friday, 17th of November, I attended the ZeroNights 2017 conference in Moscow. And it was pretty awesome. Thanks to the organizers! Here I would like to share some of my impressions.
SOC Forum 2017: How I Learned to Stop Worrying and Love Massive Malware Attacks
Today I spoke at #SOCForum 2017 in Moscow. It was a great large-scale event about Security Operation Centers. 2,700 people registered. Lots of people in suits 😉 . And lots of my good fellows.
The event was held in Radisson Royal Congress Park. There were three large halls for presentations and a huge space for exhibition/networking.
I would like to mention а stand of #PositiveTechnologies. They have shown today their new PT Security Intelligence Portal with #dashboards for executives and joint service with #SolarSecurity for providing #GosSOPKA functionality. Some stands were dedicated to Russian government Information Security initiatives: #GosSOPKA, #BDUFSTEC #vulnerability database and #FinCERT of the Central Bank of Russia.
During my presentation, I was talking how massive #malware (ransomware) attacks can be useful for an organization. Quite a provocative topic, right? 😉 I meant it in the sense that all the hype around #malware attack can help Information Security team to do the the following things:
* Establish useful policies, like mandatory #Windows host reboot after patch installation
* Ban some convenient, but dangerous functionality, like smb file sharing between workstations
* Implement useful processes, like system hardening (e.g. against mimikatz) or continuous processing of #CERT (FinCERT) bulletins
#YuriyBosov #WannaCry #SolarSecurity #SOCForum #ransomware #PositiveTechnologies #notPetya #MonaArkhipova #mimikatz #GosSOPKA #FinCERT #CERT #BDUFSTEC #BadRabbit #Acribia #Video #Events
Read more: https://avleonov.com/2017/11/22/soc-forum-2017-how-i-learned-to-stop-worrying-and-love-massive-malware-attacks/
Today I spoke at #SOCForum 2017 in Moscow. It was a great large-scale event about Security Operation Centers. 2,700 people registered. Lots of people in suits 😉 . And lots of my good fellows.
The event was held in Radisson Royal Congress Park. There were three large halls for presentations and a huge space for exhibition/networking.
I would like to mention а stand of #PositiveTechnologies. They have shown today their new PT Security Intelligence Portal with #dashboards for executives and joint service with #SolarSecurity for providing #GosSOPKA functionality. Some stands were dedicated to Russian government Information Security initiatives: #GosSOPKA, #BDUFSTEC #vulnerability database and #FinCERT of the Central Bank of Russia.
During my presentation, I was talking how massive #malware (ransomware) attacks can be useful for an organization. Quite a provocative topic, right? 😉 I meant it in the sense that all the hype around #malware attack can help Information Security team to do the the following things:
* Establish useful policies, like mandatory #Windows host reboot after patch installation
* Ban some convenient, but dangerous functionality, like smb file sharing between workstations
* Implement useful processes, like system hardening (e.g. against mimikatz) or continuous processing of #CERT (FinCERT) bulletins
#YuriyBosov #WannaCry #SolarSecurity #SOCForum #ransomware #PositiveTechnologies #notPetya #MonaArkhipova #mimikatz #GosSOPKA #FinCERT #CERT #BDUFSTEC #BadRabbit #Acribia #Video #Events
Read more: https://avleonov.com/2017/11/22/soc-forum-2017-how-i-learned-to-stop-worrying-and-love-massive-malware-attacks/