Lecture 30

So, we were talking about SCAP, so we talked about 3 enumerative standards that is CVE for vulnerability enumeration, CCE for configuration enumeration and CPE for platform enumeration and then we looked at CVSS, which is for vulnerability severity scoring for that's a metric. Now we are looking at the language part of these standards, so XCCDF is the standard for benchmark configurations and we will not go too much into the detail of how the language is structured, it has basically it's a set of rules and each rule tells you something about a specific configuration and so in order to write the rules, they have to also talk about some variables like some registry key variable or some configuration setting such as the number of times a password can be tried before locking out and things like that and then the rules are put into groups that's a structural issue, so how to structure a set of rules into a group and then they have this notion of profiles which contains a number of groups and variables and rules. The idea of profile is interesting because let's say you have US military for example, would come up with a benchmark for let's say windows 11, now within the US army you may have computers which are used in critical mission, then there are also computers which are public facing, there are computers which are being used by regular users, so not all of them have to be equally secure or their benchmark for their security configuration should not need not be the same. Some have very strict security configuration, some have relaxed security configuration, so what they do is that they put the rules that correspond to let's say the most classified computing computers where windows 11 is being used, they will put them in under one profile and then the for public facing computers and in the same organization, they will put under a different profile, so when you are actually measuring your configuration with respect to this benchmark, you mention the profile of the device or the end point that you want to be benchmarked against, so I'll show you how that all works. So here is first of all there is DOD, the department of defense has this tool called STIG viewer, so let's go and look at the website of STIG, so DOD cyber exchange, so this is the where you can find the xccdf files for all kinds of software as recommended by the department of defense, now another organization may have their own benchmarking, so now if you go here, you will see that they have this thing called STIG viewing tool called STIG viewer, so STIG viewing tool you can have that for linux or windows version and STIG viewer tool you can download and this is the tool that I was just showing you is this tool, in this tool you can actually you know import or export a particular STIG file and then you can actually, so you can open multiple different STIG files or single STIG file and whatever, so open STIG, so I can go and go to the wherever I have this and then I will let's say, so u underscore ms, so I am looking for, so let's say Microsoft age, the STIG file is not there, so let's say I want to create, so I am opening an excel configuration file as recommended by for excel 200, 20,000, 16 version of excel and here I see that these things are under various groups and within groups, there are various rules right, so for example, let's look at some of the rules, so for example, the first one says, so you have a group ID, the group it belongs to a rule ID and then this is this ID of the STIG, STIG stands for security technology implementation guide, this is for unclassified you know this, that's why we are able to actually access it, so disabling of username and password syntax from being used in URLs must be enforced right, so basically this is for Microsoft excel, so it's saying that username and password syntax used in URLs must be enforced, so you can actually what it is saying is that you know many URLs actually in there in the URL string, you would give an username password combination like this right, now that is very insecure practice, so if you have excel file where you have URLs, then you cannot have this you know username password in the URL, so here the next rule says open save action for excel 4 macro sheets and add in files must be blocked, so this is about the macros, then you have let's look at another one, blocking as default file block opening behavior must be enforced, so if a user can open view or edit excel files that has to be that's the policy setting, so if you enable this policy setting you can have blocked files are not opened, blocked files open in protected view or cannot be edited and blocked files open in protected view and can be edited, so you have to choose what you are going to allow right, so these benchmarks basically set for you the for anybody's machine, which has excel 2016 certain settings that then cannot be changed by those users and or at least if they change that will be a policy violation right, and in order to actually enable this settings in each of the machines you have to use at some automation, so you use this benchmark file and use something like waist cap and then you can actually set this settings for that machine and the idea here is that this and this also says how to check whether the setting is there and then if not then how to fix it right, so that also is there, so many sometimes there will be scripts, so this is the human readable this stick viewer allows you to actually look at this file in human readable form, so if I actually go into this file for example, so if I now go and look at this file actually xml file you won't be able to read it properly right, because this is xml, so what this stick viewer tool gives you is a human readable formatting of the same right, so you can look at, so you can understand what the rules are, second thing that you can do is you can actually customize, so you can actually there are stick editors, you can actually use a stick editor to change some of the settings right, so you say okay I use stick viewer to read each of these rules and I note down which ones I agree with and which ones I need to change in my organizational setup and then I can go back and actually change this file in order to add or change some of the settings. Also I can actually, so this is kind of an object oriented language, so you can actually also derive from that and then from an existing rule and then you can actually add additional constraints on the rules and so on, so there are a lot of things you can do, so usually organizations they actually can take this benchmarks from CIS for example, or DOD and then they do their own changes as necessary for their organization and then within the same organization, in the same file you can have multiple profiles right, so for example, if I let me, so I use OSCAP and then I say info and then I say the file, so you see that it will tell you what are the different profiles, so here you have each profile has an ID, so there is a MAC 1 classified profile, there is a sensitive profile, there is a public profile, there is a administrative classified profile and that administrative sensitive profile right. So these profiles basically indicate the different set of settings for different end points based on where those end points are, what their purposes are and so on. So, whenever I am going to automate the setting, checking that the settings are correct according to the benchmark or when I am trying to fix the settings, when I find that there are some you know missing settings, then I have to mention the profile according to which I need to check or according to which I need to set configuration. So, now how do I do the checking right, so I go back to the one where I have, so here I have the benchmark for Windows 11, this is for a specific version, so I am going to do this, I will first check what profiles are there, so I am going to check what profiles are there, so I see that, so I am basically saying OSCAP info, then the benchmark file and then it will tell me what profiles exist right, so mission critical classified, then you have mission critical sensitive, then you have administrative classified, administrative sensitive, mission support classified, mission support public and so on. So, now if I try to check whether my, this computer which I use normally for teaching classes or sending emails and so on and I am not doing on any critical classified activity on this computer, I may not want to benchmark this settings of this machine on critical classified or sensitive etc., so I am going to do a mission support public right, so I am going to check the benchmark against mission support public, so I have the command here, so I am saying OSCAP xccdf evaluate according to this profile, this is the public profile and then put the results into this, result can be in the xml format and also you can get a report basically human readable form of the result in html format and here is the benchmark right, so I can run the benchmark. Now, it is running against each rule that is referred to in the, referred to in the profile that I mentioned right, so this whole benchmark file has multiple different profiles, profiles may have common rules right, so many rules will be written first and then they will be linked to the profiles right, so not necessarily each profile will have a disjoint set of rules, they might have common rules and when I am checking, so I am seeing that I am passing some but I am also failing some, so you know this like, so for example my machine to get into my machine I do not do a LDAP check right, so I just have a local check right, so I am failing this, so there would be lot of this things and this will take some time maybe half an hour or so to get this going but I have run it once before, so I can show you the result right, so I will show you, so here is the, here is how the html report. So, once you have run it, you will get an html report which will tell you which benchmark you ran and what is the profile against which you have run and then you will, it will tell you the, that how many rules I have failed in that profile, so I have failed in 24 rules, I have passed 122 rules and then I have 54 others for which I am not, they were inconclusive and then among the ones which have been failed, which ones are what of what criticality, so certain settings are highly critical, so there are 2 such critical settings that we have failed and then 19 are medium and 3 are of low severity, so you have a score of 61 out of 100. Now, your organization might have a threshold that you know all computers must make 95 percent or 98 percent of the benchmark passing right, otherwise you have to decommission that machine and fix all these things and then do this, so here you can also get a very detailed report on what is it that I have failed and you can actually go and check in further details and sometimes you may have a remediation script, so it will, this one does not have the remediation scripts but you can also write, like here it tells you the remediation description right, so enable full disk encryption on all information systems using bit locker, so I have disabled bit locker on my laptop, so it is giving me a failure but it will also tell me that what I need to do and then it could have also a PowerShell script that would have actually appeared here that would have done this right, so that is something that you can get from this. So, that is basically how you are going to use this thing, now if you want to, this is for configuration right, so if you want to check for vulnerabilities, so let us kill this, so if you want to check vulnerabilities, so you can actually do this, I do not know if it will work, so this benchmark also contains many OVAL, OVAL is the vulnerability tests benchmark okay, so I need an OVAL file, I do not have the OVAL file here but the process is very similar, waist cap, then you have to use OVAL, EVAL and then you have to give an OVAL definition file, an OVAL definition file will basically describe how to test for certain vulnerabilities right, so instead of certain configurations, it will tell you about certain vulnerabilities okay, so that is basically what it is to use this XCCDF, so basically XCCDF is used for encapsulation of security policy recommendations right, so you have you know and what is a policy of for an end point, for an end point the policy would be settings of various things that you can configure right, so anything that you can configure, either the policy would say that you have to set that particular configuration in a certain way or it will say we do not care right, so if you do not care, then there will be no rule for that particular policy configuration setting right, so you can actually have annotation of ad hoc checking mandates, so this is for basically for audit and driving of automated assessments that we just saw using the waist cap tool but there are other tools which use stick files to compare the settings, policy settings compared to what you already have in your end point. So national checklist program contains security guides written in XCCDF, so this is something that we believe that a organizations like NCIO, PCN, CERTIN and others need to do is to create checklist, they can start from CIS benchmark or from the DOD benchmark but they can then customize it in case there are at least for government organizations, it would be good if for example, NIC for example, runs these benchmarks against their servers and machines and various applications plus applications that are written by organizations here, they have to write their own checklist right, they cannot depend on like you know for example, if you are thinking in terms of an application like you know NIC written application that you use for various government activities, they have to write their own checklist right. And then something like stick viewer can convert this checklist into human readable output and can be processed by tools for automated assessment like OSCAP and there are other tools like OSCAP is a free tool but there are other tools, commercial tools as well for checking compatibility against XCCDF and configurable design simplifies tailoring existing content to meet local mission needs. So, this is important and this is why this has been done in a language, so XCCDF, so you can actually learn XCCDF pretty easily, it is not that difficult, then you can actually configure it, so that it is relevant to your organization for example, in IIT Kanpur, we might come up with all windows machines, anybody who is using connected to the internet has to run this benchmark and report to CC, what is the, how many configuration they are missing or failing, so CC can decide whether to you know disconnect that machine from the internet or not right, so things like that can be done. So, the next standard, so XCCDF is for the configuration benchmarking exchange format, OVAL is the language for, it is a open vulnerability assessment language, so if you want to know that your system has certain vulnerabilities, how do you know that your system has certain vulnerabilities, first thing is that you have to check, you can have vulnerabilities from two conditions right, so one is that you can have vulnerabilities, when a vulnerability is reported and the CPE and CCE associated with that CVE matches with your platform and your configuration correct, so not every vulnerability applies to your system right, so your system has to be matching the CPE and CCE corresponding to that CVE. So, I have to check whether whenever I have a vulnerability discovered, I need to check whether that vulnerability affects my system and in order to know whether the vulnerability affects my system, sometimes I do not know all the components in my system right, I am a regular user, I downloaded many software, I bought, purchased many software, they have various components, Java libraries, this and that and so on. So, I may not be able to quickly figure out that the vulnerability has been also affecting my system, so therefore, nowadays whenever CVE is discovered or published, often times a test in oval language is associated with that CVE right, so if you search in the NVD database, you will find in many CVEs, there is a also an oval definition of the test, which will tell you, if you run on your system using OSCAP, then that will tell you whether you are affected or not right, so that is what the oval language is about right. So, you basically create certain tests and these tests will be dependent on certain definition and certain objects, variables and state. So, let us look at this diagram, I do not know if you can read this, so this is what the idea of oval is that, let us say you have now, missing a configuration setting is also a vulnerability right, so you may want to know, what is the configuration policy that you must abide by right. So, if your department of defense or in this case, they are saying NSA or NIST right, so this configuration policy and then you have the security advisories, this is coming from CERT or CERT you know CC or US CERT etcetera. So, this CERT is basically saying that, there is a new vulnerability that is come up and here is a definition in oval language on how to test for that. So, here the either you take directly the definition given by them or you write the definition based on the policy etcetera, that this is what I am going to test to check, whether that particular problem exist. In parallel, this software the OSCAP will also collect associated variable values. So, there are certain values of variables for example, what is the current version of windows you are running, what is the current version of let us say chrome you are running or what is the current version of some software you are running or things like, what is your you know particular library version like for example, what is your java script version, what is your PHP version and so on. So, all this information is collected from the computer. So, you have the definitions which tells you what to test and here is you know the information you need to do that test and then you do the analysis. So, you do the analysis and this analysis will tell you whether let us say the definition says that a certain variable should have certain value and you see that this one has a lower value right. So, from that you will say that this machine is affected by that vulnerability because the definition says that to be you know free of that vulnerability, I have to have a version number greater than this, but my version number is so and so, which is not greater. So, therefore, I will get a failure and I will get a vulnerable output. So, this way a document will be generated an html document will be generated which you can view and see what are the vulnerabilities you have. The oval file may also contain the information about how to fix it right. So, like whether you have to download a new version, but that will come from here right it will not automatically be there. So, if that information is here then this final result document will give you a guidance about how to go about fixing the problems right. So, that is what the oval is about. So, this is what the oval kind of looks like. So, here is you know a test. So, you have an id for the test and then it is it basically has some meta information like check all then what object we are talking about now this is an example. So, in this case we are talking about a tutorial object and what state we are talking about. So, this is the state is also an synthetic state variable right. So, this variable and object are you know not important for us now a test referencing an object and what value the object must have right. So, for example, here you have a test where you have a this tutorial object one and this object basically says that the key value this is a registry key value should have certain value right. So, this is just to give you an example about how the registry object looks like. So, a registry object will have this hive and key and then and the actual name of the key. So, that is how the registry key is referenced in a test. So, now, you have an state this state is named ST 1 and let us say its value is hello world. So, this is just to give you an example and then you have a definition which has various other fields for example, a test criteria what are you are testing right. So, here criteria is saying that the value of the registry key should be equal to hello world this is the criteria in this test right. So, this is how this language looks like not very important for us right now to know exactly how this language is I have a I probably have videos where I explain how to about the whole language of xccdf as well as oval I can probably make it make the links available if you are interested, but for this class it is not important I am just trying to give you the idea about security content automation right. So, security content automation has this benchmark for configuration xccdf and the fact that xccdf benchmarks are many of them are publicly available for well-known software and operating system etcetera and the fact that you can customize it and the fact that there are tools like west cap which can be used to test your end points against those benchmarks for certain profiles will be good enough you know information that you need to need to remember from this class because this is something that should be much more widely practiced in India than it is right. So, you will not see many organizations using xccdf benchmarks or oval you know tests and so on which is a shame because it is there is a lot of content that are already available that one can reuse and get at least benchmark not if even if that benchmark is not necessarily made a requirement, but it can be tested just to even know where you are with respect to that. Then the last one this is actually later addition to this cap benchmarking which is the OCIL language right. So, it is a interactive language for questionnaires for asking questions to security personnel right. So, security personally often we need remember like security is about process people and technology right. So, lot of things are you know happen you have to ask these questions to the or to the personnel about their security practices when you are actually figuring out the security posture of that organization. So, OCIL is language that was designed for that and it is for it is for non-technical policy issues right remember when I said cyber security policy always have some technical policy parts such as the ones we were talking about in terms of configuration like how you know system should be configured whether endpoints should have this property or that property and so on there should also be policies which are unrelated to real endpoints or network etcetera they are mostly related to the behavior for example, like you know whether you use social media while on your work computer or whether you are you download software on your work computer games do you download and then you may violate policy right. So, the policy is clear about what the what you can or cannot do and then you can ask these questions to the people involved. So, that is this thing. So, where we can get more about SCAP and more resources from SCAP one is of course, the National Vulnerability Database and and its search engine it has APIs. So, APIs will allow you to have your own tools in which you can actually get information directly from the NVD database you have the National Checklist Program Repository. So, the one that we saw is the DOD checklist checklist repository. So, it includes various benchmarks for the configurations for various applications and operating systems it has you have the CPE dictionary that we looked at in the previous class in the MITRE website. You also have OVAL repository over 7000 definitions of XML files you have the CCE the official list of the CCE entries and you have various documentation use cases and other information and there are other mailing lists and and so on. You also have XCCDF OVAL and OCIL you know this for universal understanding of recommended practices CCE for identifying control affected by policy CPE to identify platforms affected by policy vulnerability measurement and identification. So, you have CVS for naming the vulnerabilities OVAL for detecting the presence of vulnerabilities and installation of specific patches CVSS gives you the prioritization because you actually prioritize based on CVSS. However, in the recent time people are say moving away from CVSS and going to going for something called EPSS which is the exploitability severity score right. So, how exploitable a particular. So, you may have a vulnerability of severity 10, but it might be very difficult to exploit. So, especially in your organization. So, therefore, people are moving to EPSS, but that is not part of SCAP CPE gives you tells you which platform is affected by which vulnerability and then you can also have the inventory naming and automation. So, this is for asset management you can use OVAL and CPE for naming the applications and then detect the application you know problems that are associated with application. So, who are the users of SCAP? So, policy authors people inside the organization who create the organizational policy now one thing is to write a policy in a PDF in a word file and circulate it in as a text file to everybody writes and usually this policy documents are pretty long and you need many, many awareness and training sessions of your employees to get them familiar with the policy because policy document is a very boring sub very boring document to read. So, you will not find many people reading the policy document and therefore, there will be lot of violation of policy right. So, therefore, it is up to you the CSO's office to continue to give training sessions and make it mandatory to attend those training sessions and so on. So, people get familiar with the policy, but bigger important issue is that once you have the familiarity with the policy, but still technical technological policy like the configuration setting etcetera cannot be manually done like you have thousands of machines some are mission critical some are less mission critical. So, you have to automate the process of configuration configuring those machines according to the policy and policy might also include things like you have to be compliant with 27001 or we have to be compliant with PCI DSS and so on. So, this benchmark files usually contain all those details like what is it that you know what configuration setting will make you PCI DSS compliant and so on. So, create normative configuration guidance this is for automation this is the x c c d f and identifying appropriate inventory elements or inappropriate inventory elements on which this policy has to be implemented. So, benefits from a body of modular extensible base content. So, you can actually create your own extension of x c c d f etcetera ensure universal consistent understanding of requirements. So, requirements remain become unambiguous everybody in the organization will run waste cap with x c c d f file. So, nobody has to interpret the English language command on what configuration should be and measurements returned with common format supports analysis. So, once everybody runs or you can actually there are ways to run this thing directly from a console to all the machines in the organization right. So, you do not necessarily have to go to every machine and run this manually right. So, when you do that you can get back all the results together and you can combine the results and get a holistic picture of your organizational security conditions. So, incident sorry incident respond incident responders. So, receive vulnerability information and track whether fixes are done configuration change tracking to make sure that the policy according to policy the configuration change has been applied and track susceptible inventory like any kind of asset that has been susceptible to vulnerability. You can track and see what to do like whether to decommission them or whether to temporarily shut them down and things like that or temporarily disconnected connect them from the network and so on. So, using benchmark and using oval you can basically identify automatically across your organization all assets which are affected by certain vulnerabilities and you can also see how many of them are being fixed and so on. So, solid correlation between alerts evidence and responses can be obtained because when you get alerts you actually know exactly which machine it is talking about and then you can actually you know that there is some problem with respect to that particular configuration or particular vulnerability. Guidance and prioritizing responses by magnitude of threat. So, this is this is they are talking about CVSS. So, using CVSS core you can tell which vulnerability you must fix overall content is oftenly often publicly available shortly after alerts. So, this is what I was talking about nowadays in the N V D database many CVS come with the corresponding overall content. So, you can just cut and paste put it into your overall file and rerun your overall test right. In fact, the tools like Nessus they basically do this kind of stuff precise understanding of what software version edition etcetera are present and measurements returned with common format. So, it supports analysis. So, so again the output of these measurements using oval or or x c d f they can be giving you a good picture of what is going on inside your organization. So, administrators. So, they can configure and assess in system. So, update and verify the system meet configuration. So, administrators of course, nowadays you know without in absence of these things they have to manually configure right. So, they may forget to configure certain settings and so on so forth. So, this will basically allow them to automate this plus they do not have to use their own brain to actually decide what configuration setting should be what is secure they can actually depend on the benchmark and. So, they can also check whether vulnerabilities they are using running the oval thing and then they can track the enterprise inventory and correlate with the above. So, which assets are having all these vulnerabilities. So, benefits of course, the administrators as I said do not have to use their own brain to understand what needs to be done what configuration needs to be done which is part of the benchmark it does not require detail read of instructions because you can it is basically automated recommendations can be tailored to meet enterprise mission. So, that is what you what you do you take the benchmarks and then you tailor it automation reduces time demands and increases accuracy of course, you cannot forget to check something or fix something because it is it is automated content usable by many tools. So, there are lots of tools other than waste cap that you can use and measurements written in common format of course, supports analysis gives you a good idea about where we are. So, there are other related standards or I will not say standards, but these are these are now become kind of de facto standards such as we talked about common weakness enumeration right. So, many CVs now come with common weakness enumeration. So, it is an encyclopedia of software weakness types like we were seeing yesterday in the previous class that one of the CVs was associated with CWE that that talks about the incorrect handling of the or an inadequate handling of the inputs command inputs leading to command injection there is also software attack pattern enumeration and classification CAPEC. So, this is a general attack method enumeration. So, we already saw this in the context of MITRE ATT and CK and then there is also malware attribute enumeration and classification or MAEC standardized descriptors of malware. So, these are all from MITRE. So, these are additional knowledge bases I would say which are which every security professional should be familiar with and then there is event management standards like common event expression it is a standard log language log manipulation language enumeration of events scoring system for events. So, these are event management standards and then there is assessment control standards. So, these are all additional things over and above SCAP right. So, SCAP. So, what the point of this slide is that SCAP by itself has a lot of powerful you know standards and then because of its because of the effort by NIST on SCAP a number of tools have come up number of benchmarking languages have come up and this benchmarking languages are very useful for automation of configuration setting vulnerability checking etcetera, but they are by themselves are not enough there are more things out there which are also complementary to what SCAP does and there are lot of other things which have lot of value as you know for in the in the arsenal of a security professional. And then one final thing that you have all these places where you find more about these things we just scratch the surface and also you can also get this how to develop the benchmarks. So, benchmark development you know tutorial is there. So, if you are interested in developing benchmarks of you can use this. So, that is the thing that is it. So, we are done with the SCAP. So, tomorrow I will just next class I will just summarize what is what is it that we learnt and what is it that you are expected to remember and what is it that you can forget.