ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    So you want to build a Security Program? Part 1 - Vulnerability Scanning

    Scheduled Pinned Locked Moved IT Discussion
    72 Posts 13 Posters 7.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DustinB3403D
      DustinB3403 @IRJ
      last edited by

      @IRJ As in, you shouldn't be scanning everything on the open internet.

      The FBI, NSA and other 3 letter government agency's will come knocking down your door.

      IRJI NDCN 2 Replies Last reply Reply Quote 0
      • IRJI
        IRJ @DustinB3403
        last edited by

        @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

        @IRJ As in, you shouldn't be scanning everything on the open internet.

        The FBI, NSA and other 3 letter government agency's will come knocking down your door.

        No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

        DustinB3403D DashrenderD 2 Replies Last reply Reply Quote 1
        • DustinB3403D
          DustinB3403 @IRJ
          last edited by

          @IRJ Sure they can, it's called premeditation.

          Planning to break in is as illegal as breaking in so long as you are committed to it.

          StrongBadS 1 Reply Last reply Reply Quote 0
          • StrongBadS
            StrongBad @DustinB3403
            last edited by

            @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

            @IRJ Sure they can, it's called premeditation.

            Planning to break in is as illegal as breaking in so long as you are committed to it.

            But there is no way to know if someone is premeditating breaking it or doing a school report on safety concerns in the neighborhood.

            1 Reply Last reply Reply Quote 0
            • NDCN
              NDC @DustinB3403
              last edited by

              @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

              @IRJ As in, you shouldn't be scanning everything on the open internet.

              The FBI, NSA and other 3 letter government agency's will come knocking down your door.

              They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

              IRJI 2 Replies Last reply Reply Quote 2
              • IRJI
                IRJ @NDC
                last edited by

                @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                @IRJ As in, you shouldn't be scanning everything on the open internet.

                The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                I see about 10 scans a minute from all over the world on our external servers on a slow day!

                1 Reply Last reply Reply Quote 1
                • IRJI
                  IRJ @NDC
                  last edited by

                  @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                  @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                  @IRJ As in, you shouldn't be scanning everything on the open internet.

                  The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                  They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                  Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                  • scottalanmillerS
                    scottalanmiller @IRJ
                    last edited by

                    @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                    @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                    @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                    @IRJ As in, you shouldn't be scanning everything on the open internet.

                    The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                    They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                    Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                    Execute you?

                    IRJI 1 Reply Last reply Reply Quote 0
                    • IRJI
                      IRJ @scottalanmiller
                      last edited by

                      @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      @IRJ As in, you shouldn't be scanning everything on the open internet.

                      The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                      They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                      Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                      Execute you?

                      Yeah I am sure China's focus is to find everyone running nmap scans on American servers so they can execute them.

                      scottalanmillerS 1 Reply Last reply Reply Quote 0
                      • scottalanmillerS
                        scottalanmiller @IRJ
                        last edited by

                        @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @IRJ As in, you shouldn't be scanning everything on the open internet.

                        The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                        They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                        Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                        Execute you?

                        Yeah I am sure China's focus is to find everyone running nmap scans on American servers so they can execute them.

                        You never know.

                        IRJI 1 Reply Last reply Reply Quote 0
                        • IRJI
                          IRJ @scottalanmiller
                          last edited by

                          @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @IRJ As in, you shouldn't be scanning everything on the open internet.

                          The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                          They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                          Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                          Execute you?

                          Yeah I am sure China's focus is to find everyone running nmap scans on American servers so they can execute them.

                          You never know.

                          They could always build another ghost city.

                          1 Reply Last reply Reply Quote 1
                          • DashrenderD
                            Dashrender @IRJ
                            last edited by

                            @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @IRJ As in, you shouldn't be scanning everything on the open internet.

                            The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                            No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                            actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                            IRJI scottalanmillerS 2 Replies Last reply Reply Quote 0
                            • IRJI
                              IRJ @Dashrender
                              last edited by

                              @Dashrender said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @IRJ As in, you shouldn't be scanning everything on the open internet.

                              The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                              No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                              actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                              It's impossible to police

                              DashrenderD 1 Reply Last reply Reply Quote 0
                              • DashrenderD
                                Dashrender @IRJ
                                last edited by

                                @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @Dashrender said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @IRJ As in, you shouldn't be scanning everything on the open internet.

                                The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                                actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                                It's impossible to police

                                Of course it is - it's just like another gun law - just one more thing to through at people after they are caught.
                                Like Capone and taxes..

                                1 Reply Last reply Reply Quote 0
                                • scottalanmillerS
                                  scottalanmiller @Dashrender
                                  last edited by

                                  @Dashrender said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                  @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                  @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                  @IRJ As in, you shouldn't be scanning everything on the open internet.

                                  The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                  No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                                  actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                                  It's illegal most places, but impossible to prove.

                                  1 Reply Last reply Reply Quote 0
                                  • momurdaM
                                    momurda
                                    last edited by

                                    I have installed using the hyperv image on my workstation. Have run a scan.
                                    The scan results don't make any sense.
                                    It is showing I am running about 10 different insecure versions of linux kernel, none of which I am running on the machine I scanned.
                                    0_1498164745454_18784078-6253-4249-812b-2d0080ce5b85-image.png
                                    Above is a snippet of a pdf report of the scan showing me a list of kernels which are not on this server as far as I know.
                                    uname -r
                                    returns
                                    0_1498164802671_93cf14bc-7db8-4554-8f84-e0b3bd49b518-image.png

                                    IRJI 1 Reply Last reply Reply Quote 0
                                    • momurdaM
                                      momurda
                                      last edited by

                                      Running
                                      rpm -qa | grep kernel
                                      showed 5 or 6 kernels still installed. whoops.
                                      package-cleanup --oldkernels --count=2 removed all but the current and next oldest one.

                                      BRRABillB 1 Reply Last reply Reply Quote 2
                                      • CloudKnightC
                                        CloudKnight
                                        last edited by

                                        It's defiantly taking my cpu for a sprint.....

                                        0_1498167159068_2017-06-22 22_30_53-.png

                                        1 Reply Last reply Reply Quote 0
                                        • BRRABillB
                                          BRRABill @momurda
                                          last edited by

                                          @momurda said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                          Running
                                          rpm -qa | grep kernel
                                          showed 5 or 6 kernels still installed. whoops.
                                          package-cleanup --oldkernels --count=2 removed all but the current and next oldest one.

                                          OpenVAS FTW.

                                          1 Reply Last reply Reply Quote 2
                                          • IRJI
                                            IRJ
                                            last edited by

                                            As mentioned in the OP, OV is very resource inefficient. Nessus is a night and day difference, but isn't cheap.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 2 / 4
                                            • First post
                                              Last post