In this lesson,
we will learn about monitoring and detection.
Monitoring and detection involves continuously observing
network activities to identify
and respond to security incidents, anomalies,
and vulnerabilities.
Monitoring and detection devices include test-access points
or TAPs, collectors, and vulnerability scanners.
Let's explore each of these tools in more detail.
Then we'll have a demonstration of an advanced configuration
of a network scanner, OpenVAS.
First, we have test-access points, or TAPs.
A TAP is a valuable tool for network administrators
because it provides full visibility into network traffic,
allowing them to monitor, analyze,
and troubleshoot without interfering with the flow of data.
TAPs work by making a copy of the data traveling
between two points in the network,
such as between an Internet service provider's modem
and a border router.
The data copy that is captured by the TAP is then sent
to a monitoring device in real time.
This setup is ideal for continuous traffic analysis,
security monitoring, or implementing tools
like a network-based intrusion-detection system
to detect suspicious activity.
A TAP is traditionally a hardware device.
Physically, a TAP has three ports,
two for connecting different parts of the network,
such as a modem and a router,
and one port for connecting to the monitoring
or capture device.
As data passes through the TAP, a copy is created
and sent to the monitoring device,
allowing network administrators
to monitor all traffic in real time
without disrupting network operations.
There are two types of TAPs, passive and active.
Passive TAPs are simple and reliable
and don't require power.
They simply split the signal they are monitoring
and send a copy to the monitoring device.
They don't add latency or alter the traffic,
but if the connection fails,
passive TAPs can't capture any data.
Additionally, since passive TAPs aren't processing any data,
malformed or damaged packets will also be sent
to the monitoring device.
Next, active TAPs physically interrupt the signal
they are monitoring, regenerate it,
and then send it to both the next communication node
and the monitoring device.
Active TAPs use their own power supply
to ensure signal strength remains stable
even during link issues or power failures,
provided they have a backup power supply.
Active TAPs can continue data during network failures,
though they add a slight bit of latency
and rely on electrical power.
So if an active TAP doesn't have a backup power supply,
it can become a single point of failure in the network.
For permanent installation,
such as deploying network-based intrusion detection systems,
many administrators prefer using a TAP
because it allows a real-time traffic monitoring
across all devices.
However, for temporary troubleshooting,
a mirrored or SPAN port might be more convenient.
In cloud environments, monitoring usually requires
a virtual private cloud solution,
as physical TAPs won't work in virtualized settings.
Second, we have collectors.
Collectors are devices or software
that gather network traffic or log data for analysis.
Collectors work by pulling in data from various sources
such as servers, endpoints, and firewalls,
and then forwarding it to monitoring tools for detection
of any suspicious activity.
For example, Wireshark is
a popular network protocol analyzer
that acts as a collector by capturing
and analyzing packets in real time.
Another example of a collector is Splunk.
Splunk collects log data from various systems
and devices, providing real-time insights
and allowing security teams to detect anomalies or threats.
Tools like SolarWinds Network Performance Monitor
also use collectors to monitor network traffic,
alerting administrators if anything unusual occurs,
like spikes in bandwidth usage.
Collectors form the backbone of an effective monitoring
and detection strategy, ensuring data is captured
and analyzed for possible risks.
Third, we have vulnerability scanners.
Vulnerability scanners identify potential weaknesses
in systems before they can be exploited.
One popular network vulnerability scanner is
Greenbone's OpenVAS,
an open-source scanner that scans networks
and systems for security flaws and provides detailed reports
to help administrators prioritize what needs fixing.
Interestingly, OpenVAS was originally a fork
of Tenable Nessus before Nessus transitioned
from an open-source to a commercial model.
Nessus, known for its ease of use
and extensive plugin library, is now one
of the most popular commercial vulnerability scanners.
Nessus identifies vulnerabilities
across various systems and applications,
from outdated software to misconfigurations,
and offers actionable recommendations to mitigate risks.
Next, Qualys is a cloud-based vulnerability scanner
that integrates with many security tools,
offering not only vulnerability scanning
but also compliance checking and continuous monitoring.
Qualys is known for its scalability,
making it a popular choice for larger organizations
that need to secure extensive, complex cloud-based networks.
Now let's have a look at OpenVAS
and explore some of its advanced configuration capability.
I am using a Kali Linux virtual machine,
and I have started the Greenbone OpenVAS network scanner.
Process of scanning machines with OpenVAS
is fairly intuitive, with a built-in wizard
to guide you through the steps.
However, creating custom scan configurations
can be highly valuable, as it allows you to tailor scans
for greater efficiency
and minimize disruption on your production network.
Here on OpenVAS in the configuration menu,
I am going to select scan configs.
Here we see a list of pre-installed scan configurations,
including a full and fast scan and others.
Let's modify a full and fast configuration.
To do this, we'll click the clone button
over here on the right hand side.
As you can see, we have now created a full and fast clone.
Next, we can click the pencil icon
to configure our new clone.
Inside the cloned full and fast configuration,
we see a list of network vulnerability test families.
Specifically, there are 58 families.
Network Vulnerability Tests, or NVT families,
in OpenVAS are organized groups
of vulnerability tests that focus on specific types
of security risks or system areas.
Each family contains a multiple individual test
designed to detect vulnerabilities
within a particular category,
such as web servers, denial of service,
general vulnerabilities, or databases.
These families allow administrators
to target specific aspects of their network
or infrastructure based on their security needs.
For example, if we are an organization
that primarily operates web services,
modifying our custom scan configuration
to focus on the web server's family
would make our scan more efficient
while retaining searches for vulnerabilities,
like SQL injection and Cross-site Scripting.
By categorizing network vulnerability tests into families,
OpenVAS makes it easier to customize scans
and address specific security concerns efficiently,
enabling tailored and relevant vulnerability assessments
across various network assets.
We can even look into each family of NVTs
and view specific tests that are run by OpenVAS.
Let's take a look at the web server's family,
which runs 964 individual NVTs.
An NVT is an individual test designed to check
for a specific vulnerability on a system or network.
Each NVT focuses on a particular risk,
such as information-disclosure vulnerabilities
or command-injection vulnerabilities.
Other vulnerability examples include
outdated software versions, misconfigurations,
or a known security flaw.
We can even open up a specific NVT
and look at it in more detail.
Let's take a look here
at the command-injection network vulnerability test.
Here we can see details like the vulnerability's name,
a summary, and the CVSS score,
which is a risk level, letting us know
how critical this vulnerability is.
By reviewing individual NVTs,
administrators can understand the nature
of the vulnerabilities present in their network
and how to prioritize them.
Within a family, we can even unselect specific NVTs
to customize our search.
Let's unselect this command-injection vulnerability.
Now we can see that it will run 963
of the 964 possible web server family's
network vulnerability tests.
So with a custom scan configuration,
we can select specific families of NVTs to scan for,
and we can even select specific tests
to run within an NVT family.
Tailoring our scans to focus on specific vulnerabilities
that are most relevant to our environment
reduces unnecessary checks and optimizes scan time.
By selecting certain families of NVTs
or even specific tests within those families,
we can prioritize the search for vulnerabilities
that pose the greatest risk to our network.
This is the end of our demonstration,
so remember,
monitoring and detection are essential for identifying
and responding to security incidents, anomalies,
and vulnerabilities within a network.
This process involves the use
of tools like test access points, or TAPs,
collectors, and vulnerability scanners.
TAPs provide visibility into network traffic,
allowing administrators to monitor
and analyze data in real time.
Next, collectors gather and forward traffic
and log data to monitoring tools,
which helps detect suspicious activity.
Finally, vulnerability scanners identify
potential security weaknesses before they can be exploited,
providing detailed reports
and recommendations for remediation.