Project Objective: Configure Nessus Essential to perform credentialed vulnerability scans against a Windows 10 host.
Tools: Virtual Box, Kali Linux, Windows 10, Nessus
What is Vulnerability Management
A vulnerability is a flaw or weakness in a system, network that cybercriminals can exploit to execute malicious activities. There can be several causes for vulnerabilities in a system, for example, default/weak configuration, outdated/deprecated software, improper configuration of resources, etc.
Vulnerability management is the process of identifying, classifying, and remediating flaws on a computer network or software. It is a crucial aspect of IT & cyber security.
Credentialed scanning is a vulnerability assessment where users insert credentials of the target computer for a more accurate and precise check. Performing credentialed scanning allows security professionals to have a complete view of the system’s security standpoint compared to a traditional non-credentialed scan.
Setting up Virtual Machines
To conduct this project I used virtual machines running on the virtual box hypervisor. I had the attack VM run Debian-based Kali Linux and the target VM run Windows 10.
I also pre-installed the popular vulnerability scanner Nessus and ran it on Kali.
Ensure Host Connectivity
Ran a ping scan on both machines to ensure they could be reached from each other
Vulnerability Scan
Before I commenced the scan, I applied a few settings on my Windows machine to successfully perform a credentialed scan. These settings can be seen here. I had also installed an old version of Mozilla Firefox on the Windows machine for this project.
To begin the scan, I launched the browser on the Kali machine and navigated to /http:localhost:8834/ to access the Nessus interface and put in the IP address of the Windows 10 machine in the ‘Targets’ field.
Result
Below we have the result of the Windows 10 Credentialed Scan with findings of different severity.
When I selected the Vulnerabilities tab, I was given the list of vulnerability findings with the first few identified vulnerabilities associated with the old version of Mozilla Firefox previously installed on the machine
In the Remediation tab, instructions were provided on how to remediate the identified vulnerabilities and close the gaps on the Windows system. Nessus instructed me to run Windows update and install the latest security patch and upgrade to the latest version of Mozilla Firefox.
Remediaition
The following were the steps taken to fix the flaws identified on the Windows 10 machine.
- Users can either install the latest version of a software or uninstall the outdated software if no new versions/patches are available. In this case, I uninstalled Mozilla Firefox because I really don’t need it.
- I ran Windows Update and installed all the available updates.
Conclusion
Vulnerability management helps organizations identify and fix security flaws and weaknesses on their network. It aids in reducing the attack surface in an organization’s network environment and ensuring compliance. Credentialed scanning involves the scanner authenticating the device to provide a deeper look and more accurate information regarding weak configurations, missing patches and other important vulnerabilities.