Audit Tools That Won t Break the Bank 2011 Date or subtitle Presented by: Mark Scholl, Partner 1 Background These tools do not require a strong technical background! Do not scan or install tools without authorization!!! May be a violation of your acceptable use policy Can disrupt applications and services running on your network Intrusion detection system Tools run on Microsoft systems 2 Copyright 2011- Wipfli LLP 1
Presentation Objectives Discuss and demonstrate tools that can: Verify V security settings Enumerate system information Identify vulnerabilities due to weak security settings and missing security updates Remediate R t vulnerabilities Monitor your information systems 3 Tools Microsoft Security Baseline Analyzer AutoRuns PSInfo SNScan DumpSec GFI Languard 4 Copyright 2011- Wipfli LLP 2
Microsoft Baseline Security Analyzer (MBSA) http://www.microsoft.com/technet/security Scans Microsoft hosts only Does not apply updates or fix security holes only identifies them Also identifies updates for SQL, Exchange,.NET, and Office Scans remote Microsoft computers Requires XML updates to account for new security updates 5 Microsoft Baseline Security Analyzer (MBSA) Critical Security Update and Service Pack Status Windows 2003, 2008, XP, Vista, and Windows 7 Internet Information Server (IIS) SQL Server Exchange Server Office 2003, XP, 2007, 2010 (local scan only) 6 Copyright 2011- Wipfli LLP 3
Microsoft Baseline Security Analyzer (MBSA) Missing security updates Account A t vulnerabilities Weak security settings File system vulnerabilities 7 Microsoft Baseline Security Analyzer (MBSA) Demonstration 8 Copyright 2011- Wipfli LLP 4
Autoruns for Windows Part of the Windows Sysinternals suite of tools http://technet.microsoft.com/en-us/sysinternals Shows what programs are configured to autostart during system boot and login You can download the program or run live from the website Great for identifying registry entries that automatically start malicious code Warning: You can modify registry settings using this tool 9 Autoruns 10 Copyright 2011- Wipfli LLP 5
PSInfo Part of the Windows Sysinternals PSTools suite http://technet.microsoft.com/en-us/sysinternals com/en Provides a report with basic documentation of the system Microsoft systems only Can be run against the local machine or against remote systems Must be run from the command line >psinfo /? For help 11 PSInfo 12 Copyright 2011- Wipfli LLP 6
SNScan Part of the free downloads available at the McAfee Foundstone website http://www.mcafee.com/us/downloads/freetools/index.aspx Scans for devices using default SNMP settings Simple Network Management Protocol is often installed by default on many network devices many times this protocol can simply be disabled 13 SNScan 14 Copyright 2011- Wipfli LLP 7
DumpSec http://www.somarsoft.com Audit A Tool for Reporting on: User accounts Password requirements Group membership File share permissions 15 DumpSec 16 Copyright 2011- Wipfli LLP 8
GFI Languard http://www.gfi.com 1-year license starts at $320-30-Day free trial Performs credential vulnerability scanning Inventories your computers hardware, applications, and system information Can remediate vulnerabilities by installing patches Microsoft, Adobe, Java, etc. Generates audit reports 17 GFI Languard 18 Copyright 2011- Wipfli LLP 9
Other Audit Tools Spiceworks Nmap/Znmap GFI EventsManager Nessus Backtrack 5 Other Tools??? 19 Contact Information Mark Scholl, Partner mscholl@wipfli.com 815.626.1277 Certified Ethical Hacker (CEH) Certified Information Systems Auditor (CISA) Certified Information Systems Security Professional (CISSP) Microsoft Certified Systems Engineer (MCSE) Copyright 2011- Wipfli LLP 10
www.wipfli.com 21 Copyright 2011- Wipfli LLP 11