Paul Asadoorian

As founder and CEO of Security Weekly, Paul remains one of the world’s foremost experts on all things cybersecurity. Security Weekly is a one-stop resource for podcasts, webcasts and other content, informing community members about penetration testing, vulnerability analysis, ethical hacking and embedded device testing. Previously, Paul served as a lead IT security specialist for Brown University, and as an instructor with The SANS Institute.

Blog Post

The Value Of Credentialed Vulnerability Scanning

Friday, March 5, 2010

"What Am I Doing Wrong?" I am often asked, "What am I doing wrong in regard to security?". This question is usually in reaction to some event, such as a failed audit, a network outage as a result of malware or worm or a breach that was detected in the environment. I ran into this situation while doing incident response for a large university. It was my job to monitor the network and respond to the major incidents that were occurring (it was also up to me to determine what was "major" and what was not). I worked with many different network and system administrators on campus to help them improve the security of their respective departments. However, this was an academic environment full of students and professors who wanted to work in a free and open environment, which turns out is one of the most difficult to secure! If a department had a compromise, I would do my best to help them figure out what happened and take measures to prevent it from happening again. A comprehensive assessment would next be performed to gain a better understanding of the security shortcomings and appropriate remediation measures. These types of assessments can be a daunting task for any security professional. Nessus was one of the primary tools we used to get a handle on the vulnerabilities in the environment. While it is important to scan for vulnerabilities such as missing patches or buffer overflows, assessments need to go deeper than that because attackers will use any approach they can to breach a system. A mis-configured system does not necessarily have a CVE or BID entry. The more comprehensive the audit, the better chance I had of making a recommendation that would effect change and result in better security (which really boiled down to me not having to come back in “incident response mode”).

Blog Post

Tenable Network Security Podcast - Episode 25

Tuesday, March 2, 2010

Welcome to the Tenable Network Security Podcast - Episode 25 Announcements Two new blog posts have been released titled "Implementing Perimeter Intrusion Detection" and SecurityCenter 4 Introduction". Also, Nessus 4.2.1 was released with support for Solaris and some significant performance enhancements. Come see us at RSA - Booth #956! I, Ron Gula, Renaud Deraison and many others from Tenable will be there demonstrating SecurityCenter 4.0 along with Nessus 4.2, the latest Passive Vulnerability Scanner and the Log Correlation Engine. The webinar performed on February 25, 2010 titled, "Finding and Stopping Advanced Persistent Threats" in which Tenable CEO Ron Gula and Tenable CSO Marcus Ranum discussed strategies for preventing, finding and eliminating advanced persistent threats in enterprise networks is available for download. You can provide feedback to this podcast and all of our social media outlets by visiting our discussions forum and adding messages to the "Tenable Social Media" thread. I would love to hear your feedback, questions, comments and suggestions! I put up a call for ideas on new Nessus videos, so please give us your feedback! We're hiring! - Visit the web site for more information about open positions, there are currently 7 open positions listed! You can subscribe to the Tenable Network Security Podcast on iTunes! Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, Nessus plugin statistics and more!

Blog Post

Your APT Anti-Hype

Monday, March 1, 2010

In the interest of helping you cope with the "APT" hype, I thought I'd offer a few observations and ideas about things you can do that might actually help. After all, it's too easy to point and shout "hype" - the truth is that there is a problem, and system and network administrators who are concerned with security do have to worry about long-term embedded penetrations in their network. There are two primary approaches to Intrusion Detection and they both work. But, they work against different threats, for different reasons. One is the 'classical' IDS approach: know what attack looks like, and look for the attack. That's what most of the signature-based IDS do, and they're good at it and therefore they are useful. The second is the 'analytical' approach (what Richard Bejtlich, in his excellent books, calls "network security monitoring"): know what your network and systems usually do, and begin an investigation if you see them suddenly start doing something new. As with everything, there are trade-offs. Some people would say that the first approach has a problem of "too many false positives" although, seriously, if your network is carrying such a large amount of apparently hostile traffic that your IDS is constantly ringing off the hook, I think you've already got a serious problem. The second approach has the problem that "start an investigation" may be outside the purview, skill set, or energy level of many system/network managers - especially now that the typical system/network admin is chief cook, busboy, and bottle-washer all rolled up in one.

Blog Post

Implementing "Perimeter Intrusion Detection"

Thursday, February 25, 2010

It's important to get the funds to support a security initiative - but even more important that these funds are well spent. In the article titled "$90M err-ports" from the New York Post Murray Weiss writes: A nearly $90 million security system designed to thwart terrorists trying to get onto runways at the metro area's four major airports still isn't up and running four years after it was purchased by the Port Authority -- and it may never work, officials told The Post. The safety network -- dubbed the Perimeter Intrusion Detection System, or PIDS -- was supposed to provide state-of-the-art electronic fencing complete with sensors and closed-circuit cameras that would immediately pinpoint someone trying to get on a runway to attack a plane at JFK, La Guardia, Newark and Teterboro airports. Sources: Questions about a new airport security system, $90M err-ports, Raytheon Wins $100 Million Contract for Airport Perimeter Security This story came to my attention while watching the news the other day. The term "Perimeter Intrusion Detection System" sounded familiar and triggered further investigation on my part. The New York Port Authority signed a more than $100 million contract with Raytheon to build and install perimeter fencing, sensors and cameras around the four major airports in New York (John F. Kennedy International and LaGuardia) and New Jersey (Newark Liberty International and Teterboro). The system is designed to prevent a potential terrorist from accessing a runway to attack a plane. The article states: "provide state-of-the-art electronic fencing complete with sensors and closed-circuit cameras that would immediately pinpoint someone trying to get on a runway to attack a plane"

Blog Post

Nessus Version 4.2.1 Released

Monday, February 22, 2010

As always we are excited to announce a new release of the Nessus vulnerability scanner. This is a point release (moving from 4.2.0 to 4.2.1) and introduces changes to the scanning engine only. The GUI has not been updated in this release, however GUI changes will be implemented and released independently from a point release. From a user perspective, the biggest changes in 4.2.1 are the two performance items that improve the speed of the GUI and lower the memory overhead when doing a scan. With regards to the GUI, interaction between the GUI and the database has been improved to better handle browsing reports with thousands of hosts or thousands of open ports per host. Memory consumption has been designed to take better advantage of the allotted memory used by Nessus. For example, in previous versions there was a 5 MB overhead per host being scanned. This meant that if max_hosts was set to 100, you'd "lose" 500 MB of memory. In Nessus 4.2.1 the memory overhead per host has been reduced to less than 500 KB, which allows the user to dramatically raise 'max_hosts'.

Blog Post

Tenable Network Security Podcast - Episode 24

Monday, February 22, 2010

Welcome to the Tenable Network Security Podcast - Episode 24 Announcements Two new blog posts have been released titled "Not Just for Health Care Providers Any More - HITECH for Business Partners" and Nessus Plugin Spotlight: Linksys Router Detection. Come see us at RSA - Booth #956! I, Ron Gula, Renaud Deraison and many others from Tenable will be there demonstrating SecurityCenter 4.0 along with Nessus 4.2, the latest Passive Vulnerability Scanner and the Log Correlation Engine. A webinar is scheduled for February 25, 2010 titled, "Finding and Stopping Advanced Persistent Threats" where Tenable CEO Ron Gula and Tenable CSO Marcus Ranum will discuss strategies for preventing, finding and eliminating advanced persistent threats in enterprise networks. You can provide feedback to this podcast and all of our social media outlets by visiting our discussions forum and adding messages to the "Tenable Social Media" thread. I would love to hear your feedback, questions, comments and suggestions! I put up a call for ideas on new Nessus videos, so please give us your feedback! We're hiring! - Visit the web site for more information about open positions, there are currently 7 open positions listed! You can subscribe to the Tenable Network Security Podcast on iTunes! Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, Nessus plugin statistics and more!

Blog Post

Nessus Plugin Spotlight: Linksys Router Detection

Thursday, February 18, 2010

Embedded devices are often connected to a network with no regard given to security. The market has been saturated with devices such as web cameras, wireless routers, VoIP phones and more. Manufacturers are in a race to see who can produce the cheapest and most user-friendly device. Of course, when you make something cheap and easy to use, security is often one of the last considerations. We are left with consumer devices that come with default credentials, common web application vulnerabilities, and no encryption support on management protocols (HTTP vs. HTTPS, and Telnet vs. SSH). The insecurity of embedded systems may not seem to be a big deal; what could someone possibly do if they compromised such a device? If the device is a router, the potential for traffic sniffing and DNS cache poisoning attacks are high. Other devices such as web cameras can be used to gather intelligence, used as jumping off points (such as printers as depicted in the book "Stealing the Network: How to Own a Continent") or even used as part of a botnet. There is one report of a botnet being built solely on embedded systems including wireless routers in particular. Vulnerable embedded systems are plentiful on the Internet, as uncovered by Columbia University researchers in October 2009 when they released vulnerability scanning data of 130 million IP addresses. Nearly 300,000 devices presented a management interface, with 21,000 of those devices using default passwords. I believe this poses a significant threat to our infrastructure and plan to talk in more detail about this topic at SOURCE Boston in April of this year. As I research embedded systems I regularly feed the Tenable research team information about my findings.

Blog Post

Tenable Network Security Podcast - Episode 23

Monday, February 15, 2010

Welcome to the Tenable Network Security Podcast - Episode 23 Announcements Two new blog posts have been released titled "Microsoft Patch Tuesday - February 2010 - "From Microsoft with Love" Edition" and Shmoocon 2010 Security Conference. A webinar is scheduled for February 25, 2010 titled, "Finding and Stopping Advanced Persistent Threats" where Tenable CEO Ron Gula and Tenable CSO Marcus Ranum will discuss strategies for preventing, finding and eliminating advanced persistent threats in enterprise networks. You can provide feedback to this podcast and all of our social media outlets by visiting our discussions forum and adding messages to the "Tenable Social Media" thread. I would love to hear your feedback, questions, comments, and suggestions! I put up a call for ideas on new Nessus videos, so please give us your feedback! We're hiring! - Visit the web site for more information about open positions, there are currently 12 open positions listed! You can subscribe to the Tenable Network Security Podcast on iTunes! Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, Nessus plugin statistics, and more!

Blog Post

Shmoocon 2010 Security Conference

Thursday, February 11, 2010

ShmooCon has always been one of my favorite conferences. It is very well run and provides a small, intimate environment to discuss all things related to hacking and information security. You truly feel a part of this conference in every way. For example, you are encouraged to throw small stress balls called "Shmooballs" at any speaker you disagree with. The conference founders felt that many conferences had talks that were complete nonsense yet no one would stand up to say anything in opposition. As a speaker at ShmooCon you may literally find yourself running for cover. This year there was even a "Shmooball Launcher" contest, that scored the homemade launchers in several different categories. Larry Pesce participating in the Shmooball launcher contest at ShmooCon 2010 in Washington, DC. Larry's Shmooball launcher proudly displayed the Nessus banner throughout the conference and received a lot of attention from curious conference attendees. This year's ShmooCon had some excellent presentations and workshops, including one that reportedly used Nessus to find a directory traversal vulnerability in VMware (more to follow on that one). Some of the other highlights include:

Blog Post

Microsoft Patch Tuesday - February 2010 - "From Microsoft with Love" Edition

Wednesday, February 10, 2010

Patch Tuesday Gives Birth to "Zombie Wednesday" The Tenable research team spent the night writing 14 new plugins to check for the latest round of Microsoft patches. While many will have to schedule patch installations, those who run with full automatic updates enabled are theoretically all patched by now. However, it doesn't hurt to check with a quick Nessus patch audit. Microsoft is in Love With the Word "Could" There are several terms used by Microsoft throughout their advisories that spread uncertainty about the risk of the vulnerabilities presented. The excessive use of the world "could" is one such example. In the MS10-002 bulletin Microsoft states: "An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights." I “could” also win the lottery, inherit millions of dollars and walk on water. In the case of this exploit "could" is an exceptionally bad word choice as there are several example videos showcasing the exploit in action using open-source software. The other issue with the above statement is the obligatory "users with less rights on the system will be less impacted". Someone should tell the Microsoft PR team that there are two privilege escalation exploits on the list this month, and one has been widely publicized for almost a month. On that note, let’s take a closer look at the 14 bulletins and 26 vulnerabilities that were patched this month.

Paul Asadoorian

Blog Post

Blog Post

Blog Post

Blog Post

Blog Post

Blog Post

Blog Post

Blog Post

Blog Post

Blog Post

Tenable Vulnerability Management

Tenable Vulnerability Management

Thank You

Tenable Vulnerability Management

Tenable Vulnerability Management

Thank you

Tenable Vulnerability Management

Tenable Vulnerability Management

Thank you

Try Tenable Web App Scanning

Buy Tenable Web App Scanning

Thank you

Try Tenable Lumin

Buy Tenable Lumin

Thank you

Request a demo of Tenable Security Center

Request a demo of Tenable OT Security

Request a demo of Tenable Identity Exposure

Request a demo of Tenable Cloud Security

See Tenable One in action

See Tenable Attack Surface Management in action

Get a demo of Tenable Enclave Security

Thank You

Try Tenable Nessus Professional free

NEW - Tenable Nessus Expert now available

Buy Tenable Nessus Professional

Try Tenable Nessus Expert free

Buy Tenable Nessus Expert

Learn How Tenable Helps Achieve SLCGP Cybersecurity Plan Requirements

See
Tenable One
in action

NEW - Tenable Nessus Expert
now available