...Unit 2 Assignment 1: Calculate the Window of Vulnerability A security breach has been identified in which the SMB server was accessed by an authorized user due to a security hole. The hole was detected by the server software manufacturer the day before. A new patch will be available in three days. However the LAN administrator needs at least a week to download the software, test it, and then install the patch. Based on this information, the window of vulnerability at the very least is eight days. A network worm called Spida was detected through the MS-SQL server software package. A default installation of MS-SQL was installed into Windows desktops in which each server did not have a password on the system account. This gave access to anyone on the network to run random commands. Spida configures a ‘guest’ account to allow file sharing and be able to uploads itself to the target. It then creates copies of itself using the password-less account, therefore creating infection. This worm was not found until the day after installation and it will take three days restore the network. The window of vulnerability of this situation is four days. A user opened an email that contained a virus and notified her manager. The manager then notified the IT department, and they immediately began to work at the problem. It took the IT team one day to resolve the issue and completely remove the virus and the restore the network. The window of vulnerability was one day. Lastly, an employee...
Words: 319 - Pages: 2
...The Window of Vulnerability The window of vulnerability is a time frame within which defensive measures are reduced, compromised or lacking. When trying to calculate the window of vulnerability you need to look at least 4 different things before being able to figure out the entire vulnerability. Those four things are discovery-time, exploit time, disclosure time and patch time. Discovery time is when someone discovers that a product has security or survivability implications, the flaw then becomes vulnerable. Hopefully it was found before an attacker found the vulnerability and exploited it. Exploit time is the time between the discovery and the patch time. It is when most, if not all, attacks will occur on a network. When attackers find vulnerabilities they can break through the security relatively quickly, and if they are not stopped they can damage a network extremely. Disclosure time is the vulnerability is disclosed when the discoverer reveals details of the problem to a wider audience. Disclosure time and exploit time can be occurring at the same time, it just depends on when the vulnerability was discovered and by whom. Patch time takes the longest because of all the code that needs to be fixed in order to close the vulnerability. Patches can take a few days to fix the problems or can take longer than 3 weeks, it all depends on how bad the vulnerability is and how badly the attackers want to get into the network. Even with patches and other fixes to networks there...
Words: 275 - Pages: 2
...Joy Davis (15538292) Prof. Redd IT 255 Intro to ISS October 20, 2013 Unit 2 Assignment 1: Calculating the Window of Vulnerability WOV or Window of Vulnerability is the time it takes the attack to start all the way to when the attack is found and removed or fixed. As problems arise in IT infrastructure of an organization, providing a fix to the problem can disrupt daily operations and the time it takes between discovering the problem and patching it will leave a window open for an intruder to attack. Once that happens, it is officially a breach of security and any confidential information can be accessed and tampered with. In this particular case, the security breach has been identified and an unauthorized user accessed the SMB server due to an open window of time. The day before the attack, the server software manager detected a hole in security. On the day the hole was detected, it started the timeline of calculating the window of vulnerability. Day 0 is when the vulnerability was discovered. The software company will be releasing a patch however it will take three days to be available, thus adding to the timeline. We are now at day 4 when the LAN administrator communicates that we will need an additional week to download, test and install the patch when it arrives. The final timeframe from the point of discovery to the point that the patch is installed is roughly 11 days. Going further, the patch may need to be deployed companywide to all machines that access the network...
Words: 315 - Pages: 2
...Vulnerability labels a condition or a set of conditions that create a weakness in systems or networks that can potentially be manipulated. Think of vulnerability as the susceptibility of a system or network to be attacked and possibly damaged or disrupted. Vulnerabilities take many forms: ▪ Easily guessable logon passwords ▪ Poorly configured access controls ▪ Exploitable programming flaws ▪ Incorrect security implementations ▪ Non-exploitable disruptive design flaws, such as denial of service (DoS) ▪ Undocumented maintenance or debugging backdoors in software or systems All of these problems and many others can exist simultaneously across numerous systems and devices. Threats, risks, and vulnerabilities negatively impact the confidentiality, integrity, and availability (CIA) triad. Confidentiality is breached when an attacker discloses private information, integrity is broken when an attacker modifies privileged data, and availability is ruined when an attacker successfully denies service to a mission-critical resource. The length of time these vulnerabilities are present creates a window of vulnerability (WoV), the period within which defensive measures are reduced, compromised, or lacking. The WoV covers a timeline from the moment a vulnerability is discovered and identified by the vendor. It also includes the time taken to create, publish, and finally apply a fix to the vulnerability. Problems arise as fixes can be disruptive to business...
Words: 276 - Pages: 2
...Window Of Vulnerability (WoV) Window of Vulnerability (WoV) is calculated from the time the attack started to when the attack is found removed or fixed. In this case the attack was found but just referred to as the previous day and the detection was found by the server software. We will say that the attack was on a Monday morning. The software company will be releasing a patch for the attack in three days. We should receive the patch on Thursday then. When we get the patch we will need to install and test the patch, this will take generally according to the size of the computer and the # of end users any part of one week to complete the testing before putting it into production. Once the testing is done on all workgroups & end users devices the patch will need to be installed which is considered into production. The update will be company-wide to all machines that access the network. We will need to send out notification office wide via memo and/or email message to all employees. We should request that all end user’s leave the PC’s or devices on so that we can remotely install the updates or for all of the end users that contain windows 7 which most companies do have the upgrade from XP since it will soon be unsupported, you can use Microsoft Deployment Toolkit (MDT) to automate the update to reduce the Desktop support time & cost to do each and every machine. From the day we found the security hole to the the time we fix the security hole, according to industry...
Words: 296 - Pages: 2
...1. What vulnerabilities exist for this workgroup LAN based on advisories? List 5 * Microsoft Security Advisory (MSVR13-009) Cisco Security Service File Verification Bypass Could Allow Elevation of Privilege Published or Last Updated: Tuesday, June 18, 2013 * Microsoft Security Advisory (MSVR13-008) Cisco Security Service IPC Message Heap Corruption Could Allow Elevation of Privilege Published or Last Updated: Tuesday, June 18, 2013 * Microsoft Security Advisory (MSVR13-007) Heap Corruption in Nitro Reader Could Allow Arbitrary Code Execution Published or Last Updated: Tuesday, May 21, 2013 * Microsoft Security Advisory (MSVR13-006) Memory Corruption in Nitro Reader Could Allow Arbitrary Code Execution Published or Last Updated: Tuesday, May 21, 2013 * Microsoft Security Advisory (MSVR13-005) Vulnerability in SumatraPDF Reader Could Allow Remote Code Execution Published or Last Updated: Tuesday, April 16, 2013 1. Does any vulnerability involve privilege elevation? Is this considered high-priority issue? There are two most current vulnerability could allow elevation of privilege through Cisco security service File verification bypass and IPC message Heap corruption. This is considered a high level priority due to unauthorized access to higher domains which control high profile information that can compromise a company’s integrity financially and reputation which carries the risk of overall total loss of business. 2. Identify and document...
Words: 388 - Pages: 2
...When calculating the Window of Vulnerability (WoV), time is probable the most crucial aspect. Whenever you are dealing with the WoV there are four time periods that help any IT support personnel: Discovery Time, Disclosure Time, Exploit Time and Patch Time. The Exploit Time is the earliest that a malicious event of vulnerability takes place. Discovery Time is the earliest time that a vulnerability is found and/ or known to cause a security risk; while the disclosure time is the period that makes security information available to the general public. The difference between these two time periods is what is called the Black Risk. The black risk is defined that during the discovery time the vulnerability is kept within a small group of people. These people could be the IT staff, the hackers that cause this to occur. On the other hand the disclosure time is when this close nit of people bring the vulnerability to light and inform the public. Also with in the disclosure time, when making the information public it must be of free access, must be from a creditable and acceptable source. The Patch time is the last period that is when a fix or patch is released to correct the vulnerability. During the time between the disclosure and patch time is referred to as the Gray Risk. At this time the vulnerability is known to the public but, is waiting to hear and receive that a correct is available to correct the issue. Prior to a fix or patch a workaround could be available so that the day...
Words: 317 - Pages: 2
...this information, the window of vulnerability at the very least is eight days. A network worm called xrystal was detected through the MS-SQL server software package. A default installation of MS-SQL was installed into Windows desktops in which each server did not have a password on the system account. This situation gave access to anyone on the network to run random commands and requests. Xrystal configures a “guest” account to allow file sharing and be able to upload itself to any desired target. It then creates copies of itself using the password-less account, therefore creating an infection. This worm was not found until the day after installation and it will take three days to restore the network. The window of vulnerability of this state is four days. A user opened an email that contained a virus and notified her manager. The manager then notified the IT department, and they immediately began to work on the difficulty. It took the IT team one day to resolve the issue and completely remove the virus and the restore the network. The window of vulnerability was one day. Lastly, an employee who used their VPN at home was surfing the internet on her laptop. She unknowingly downloaded a virus through her browser but did not notice the virus until a couple of days later. After finding out, she took her laptop into the IT department for service and possible extraction of the virus. The IT department was able to remove the virus, so the window of vulnerability there was only three...
Words: 323 - Pages: 2
...To calculate the window of vulnerability (WOV) we will first need to know the amount of time It will take to get a working solution. In this case, we need a patch to solve the issue. We already know that it will take Microsoft 3 days to get a patch out to us. So, we can start with three days. After that, we need time to test the patch, and publish it out to the active directory update servers. This will usually take a few days according to the book. After it is all tested on the equipment, we need to push out the update to all of the client computers and servers. This will usually take a day or so. Also, depending on if the IT staff works on the weekends to solve the problem that will add another two days to fix the problem. So, to add it up, It takes three days to get the patch, Up to five days to test the patch, and another day or two to publish the patch out to all of the client computers. All in total, this will take around a week to solve this issue. My personal opinion is any IT personal that takes a WEEK to solve a major security breach should be fire. Personally, I would put immediate measures in place to solve the issue such as blocking the mac address, immediately writing scripts and programs to detect intrusions in the hole, and block out the attacker. Taking more than a day or two for testing is major overkill for fixing a major hole. But, that is my...
Words: 273 - Pages: 2
...Calculate the Window of Vulnerability The four parts would be the Discovery-Time, Exploit-Time, Disclosure-Time, and Patch-Time. All four of these must be looked at and evaluated. Discovery Time –is the earliest date that a vulnerability is discovered and recognized to pose a security risk. The discovery date is not publicly known until the public disclosure of the respective vulnerability. Exploit Time -is the earliest date an exploit for a vulnerability is available. We qualify any hacker-tool, virus, data, or sequence of commands that take advantage of a vulnerability as an exploit. Disclosure Time –is the first date a vulnerability is described on a channel where the disclosed information on the vulnerability is (a) freely available to the public, (b) published by trusted and independent channel and (c) has undergone analysis by experts such that risk rating information is included. Patch Time - is the earliest date the vendor or the originator of the software releases a fix, workaround, or a patch that provides protection against the exploitation of the vulnerability. Fixes and patches offered by third parties are not considered as a patch. A patch can be as simple as the instruction from the vendor for certain configuration changes. Note that the availability of other security mechanisms such as signatures for intrusion prevention systems or anti-virus tools are not considered as a patch in this analysis. Unfortunately, the availability of patches usually lags...
Words: 603 - Pages: 3
...Unit 2 Assignment 1 Greg Diamond Without having to spell out in great detail of what should take place should a Security Breech take place on an SMB server, I will instead focus on the assignment and the information they are asking for. Should a breech happen in an SMB server as indicated by data collected by the server software manager the previous day. It is inherent that, those individuals or groups (PVG), put in place to work those tools that were set up for them when the situation came about, ie: patch management tools, remediation tools, etc... Careful analyses as a result of the breech, needs to be reported (as was the case in the assignment) to software manufacture, who indicated that it would take 3 days to have a patch available for deployment. The LAN administrator however, needs at least one week to download and test the patch in a test environment to determine the effectiveness of the patch. Once completed, he will deploy the patch to associated SMB Server as well as others they may be in use. With that stated, it should take 10 days to test and install the patch based on 3 days for the software manufacturer to create the patch, 7 days to test the patch and then deploy to server. There should be metrics set up in the Security documents of an Organization that will clearly define a more accurate assessment of when a patch will come on line to counter a...
Words: 252 - Pages: 2
..."How strange is the lot of us mortals! Each of us is here for a brief sojourn; for what purpose he knows not, though he sometimes thinks he senses it. But without deeper reflection one knows from daily life that one exists for other people -- first of all for those upon whose smiles and well-being our own happiness is wholly dependent, and then for the many, unknown to us, to whose destinies we are bound by the ties of sympathy. A hundred times every day I remind myself that my inner and outer life are based on the labors of other men, living and dead, and that I must exert myself in order to give in the same measure as I have received and am still receiving... "I have never looked upon ease and happiness as ends in themselves -- this critical basis I call the ideal of a pigsty. The ideals that have lighted my way, and time after time have given me new courage to face life cheerfully, have been Kindness, Beauty, and Truth. Without the sense of kinship with men of like mind, without the occupation with the objective world, the eternally unattainable in the field of art and scientific endeavors, life would have seemed empty to me. The trite objects of human efforts -- possessions, outward success, luxury -- have always seemed to me contemptible. "My passionate sense of social justice and social responsibility has always contrasted oddly with my pronounced lack of need for direct contact with other human beings and human communities. I am truly a 'lone traveler' and have...
Words: 695 - Pages: 3
...A vulnerability is “a flaw in an information technology product that could allow violations of security policy”. (L., 2000) A vulnerability or weakness in a system or network can come about in many different ways such as poor coding, poorly configured access controls, weak security implementations or a basic design flaw. In the scenario there was no date given but it did state the server software manufacturer detected a hole the previous day and a patch will be ready in three days. The LAN administrator will need at least a week to download and test the patch, in which he’ll test the effectiveness of the patch. Once the LAN Admin is satisfied with the patch he will deploy the patch to the SMB Server and any other machines that may be in use on the network. In this case the Window of vulnerability is roughly 11 days from detection to patch implementation. Depending on the severity of the breach and size of the company they may or may not release a public statement in which it would only jeopardize bad publicity. During the time of vulnerability the word about the security breach can spread rather fast and many attacks may follow. Once the patch has been installed the company may then again go public stating the breach has corrected and there are no vulnerabilities. Bibliography L., W. A. (2000, December). Windows of vulnerability: A case study analysis. Retrieved from http://www.cs.umd.edu:...
Words: 252 - Pages: 2
...Report on Microsoft Windows Graphics Rendering Engine Vulnerability: Outline: There is vulnerability in Windows graphics rendering engine that can allow unauthorized users to remotely execute a code on the affected system. This remote code execution vulnerability exists in the Graphics Rendering Engine because of the way that it handles Windows Metafile (.WMF) images. This vulnerability currently affects the following versions of Windows: • Microsoft Windows 2000 Service Pack 4. • Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2. • Microsoft Windows XP Professional x64 Edition. • Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1. • Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems. • Microsoft Windows Server 2003 x64 Edition. • Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) – Review the FAQ section of this bulletin for details about these operating systems. Symptoms: • Unknown account with full administrator rights is created on the computer. • There are unauthorized changes made to data. Mechanism of Attack: • If a user is logged on with administrative user rights, an attacker who can successfully exploit this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts...
Words: 501 - Pages: 3
...would suggest which operating systems are in use. 3. 3. What step in the hacking attack process uses Zenmap GUI? A) The Zenmap GUI is used during scanning 4. What step in the hacking attack process identifies known vulnerabilities and exploits? A) Vulnerabilities and exploits are identified by enumeration, which is the most aggressive of the scanning stage. 5. During the scanning step of the hacking attack process, you identified known software vulnerabilities in a Windows XP Professional Workstation. List the name and number of the critical Microsoft® vulnerabilities identified. What is vulnerability “MS08-067”? MS04-022: Microsoft Windows Task Scheduler Remote Overflow (841873) MS04-012: Cumulative Update for Microsoft RPC/DCOM (828741) MS03-043: Buffer Overrun in Messenger Service (828035) MS06-035: Vulnerability in Server Service Could Allow Remote Code Execution (917159) MS06-040: Vulnerability in Server Service Could Allow Remote Code Execution (921883) MS03-039: Microsoft RPC Interface Buffer Overrun (824146) MS04-011: Security Update for Microsoft Windows (835732) MS04-007: ASN.1 Vulnerability Could Allow Code Execution (828028) MS09-001: Microsoft Windows SMB Vulnerabilities...
Words: 579 - Pages: 3
