Printable View
We are scanning desktops for vulnerabilities but are having trouble keeping track of the changes. For instance, if we scan one month, patch, then scan the next month we want to see what has changed since the previous month. However, IP address, Host names may have changed. MAC may be the same but maybe not.
Just wondering what variable you track of for scans to determine which machine you're looking at to make sure the data is accurate as possible. Any advice?
Thanks
Well, are you talking about Windows systems, or *nix? Is this an Active Directory domain? Is this a commercial business network where you have control over the network, or an ISP?
There is no single silver bullet answer to your question, but some of these things I've asked can be leveraged to help you achieve what you're asking about.
Um, unless you are changing hardware (specifically the NIC) between scans, shouldn't the MAC address be the same?
What tool (or tools) are you using to do these scans? Nessus, Metasploit Framework, etc? Other than IP and/or hostname, what kind of additional identifying information about a host is captured?
These are windows machines. We use a variety of tools; languard, nessus mostly. Our users are admins on their machines so they make many unauthorized changes and sometimes take out our remote patching account (SMS). We're just trying to deal with our reality here so we end up scaning more than most probably would.
ouch, removing the SMS accounts...
My current client uses a login script that looks for and recreates the domain admin account each time the system is booted/logged in to (one of those...being a 'login script' I'd assume the latter). However, if the user is savvy enough to disable the support account, this would probably not be much of an obstacle either.
I'd look into something that can scan and track by SID, since it's all windows. That shouldn't change unless they rebuild the OS...and even then, it won't always, if they know how to recreate/copy the old SID into place...I've heard of that, not sure how easy/feasible it is to do.
Why not add a bit to your security policy that dissallows users from disabling the SMS service?
We do have it in our policy but it still doesn't have the teeth it needs.
Thanks for all the info everyone. We keep plodding along 'cause we love our job. :rolleyes:
Since it clearly violates "best practice" why do you allow users to be admins of their own box?
Tell someone to not shoot at their feet is one thing.. it is better to NOT give them the gun in the first place..
As TS said.. why give users the Admin gun.. they will not only shoot themselve in the foo but YOU run the risk of THEM Blowing your whole network..
What is the possability one or more of them have set full sharing of the C: drive on their machine or have install a program that could invite any **** on the network..
This is why Your the Bloody SYSTEM ADMIN..
why do you allow users to be admins of their own box?
I have to work within the system here. If I was an executive, maybe I could pound my fist and demand it. I've told everyone within earshot and all I get is lip service. It's a cultural change and not a technolocy change; the hardest kind!
Unfortunately, securlynn is in a situation all too common in our industry. She has no real control over policy, or not a lot. Suggestions, statements of best practice, etc. But at the end of the day, if a manager says 'do it this way', you can argue, and disagree, and not do it...but you'll probably be disciplined and could even lose your job.Quote:
Originally posted here by securlynn
why do you allow users to be admins of their own box?
I have to work within the system here. If I was an executive, maybe I could pound my fist and demand it. I've told everyone within earshot and all I get is lip service. It's a cultural change and not a technolocy change; the hardest kind!
It's easy to sit in a perch of academia and say "That violates the principles of least priviledge and best practice. You are condemned as a moron until your environment complies with our ideals." Hehe, I'm not accusing you guys of this, just having a little fun. But the point is there is only so much one can do, sometimes. That's when you get to be very good at CYA. Document everything, make recommendations (via email, and save your .PST files if your an outlook user), and acknowledge the denials for your requests...and SAVE THEM.
It's saved my @ss more than once.
OK... Let's try to be"proactive" here.... ;)
Unless there is a program that _can't_ be run without admin rights remove the admin rights slowly.... If they don't know they don't have admin then they'll never know they don't have admin.... That's one solution.
Another one, (one I use on my sweeties laptop), is to set her up logged into my home domain... Thus all her stuff, email, desktop etc. are there in the context of the domain user but she is only a normal user on her laptop. If she needs admin rights for something she logs in using the local account with the same name and password... But then she is denied access to all her stuff because the context is wrong. This allows her to be admin to install something but forces her to go back to the limited user to get to all her stuff.... She has no problem with it.
Wow...combining security practices and interpersonal relations. You're a brave man, Tiger. ;) My wife asks me 'how much does it pay?' That's the extent of her interest. :P
LOL... I'm a pretty talented chap you know.... ;)
It only works if your sweetie understands that there is a possibility that you know more about that grey boxy thing that hums away on her desk while she reads her email from her friends than she does and that you only have her best interest in mind..... She wouldn't want to lose all those jokes and cutsie inspirational crap now would she...... :D
BWUAHAHAHAHAHAHAHA!
No, really, how do you do it? Don't tease, be truthful! :DQuote:
It only works if your sweetie understands that there is a possibility that you know more about that grey boxy thing that hums away on her desk while she reads her email...