Roger's Information Security Blog

Critical Control 4: Continuous Vulnerability Assessment and Remediation lists as a “quick win” Any vulnerability identified should be remediated in a timely manner, with critical vulnerabilities fixed within 48 hours.

Unless you’re paired up with Nick Nolte, 48 hours isn’t a very long time.   It seems to conflict a with later requirement: Critical patches must be evaluated in a test environment before being pushed into production on enterprise systems.    That is one quick eval cycle.

So what is critical?

In my vulnerability scan report vulnerabilities are listed 1 through 5.   Every month there are new level 5 vulnerabilities.

PCI says that things with a CVSS score greater than 7.2 (if I remember correctly) need to be patched.   Is that what critical is?

Does critical mean “was mentioned on the evening news”?

FISMA 800-53 rev 3 RA-5 leaves it up to the organization to define.

I think I should just update my vulnerability management doc to say that critical updates are defined as those accompanied by four horsemen.   Those must be patched within 48 hours.   If the server can be found in the smoking crater.   All other patches shall be deployed within 30 days unless otherwise instructed.

Can you claim “King of the Lab” even when the problem you solve is self-inflected?

The phrase King of the Lab originated on the U.S television series “Bones” where the scientist who found the key evidence that week was king of the lab.

We’ve noted an odd issue at work where the event logs on multiple systems  would report:

Windows Installer reconfigured the product. Product Name: <ProductName>. Product Version: <VersionNumber>. Product Language: <languageID>. Reconfiguration success or error status: 0.

for every installed application.   This set of logs would show up repeatedly.  We were kind of hoping it would go away when systems were migrated from Windows XP to Windows 7 but it is still occuring

Our Bing-fu must be weak because I stumbled across a KB article tonight that explains it.

http://support.microsoft.com/kb/974524
Event log message indicates that the Windows Installer reconfigured all installed applications

This is caused by using group policy with WMI filters that use Win32_Product.  It can also be caused by applications that use that WMI class as well.   GuardianEdge documentation instructed me to use that WMI class in a filter to deploy GuardianEdge settings so they would only apply to clients with the specific product version.

The “Ask the Directory Services Team” blog at Microsoft recently had a post which linked that KB and reported that use of Win32_Product will (could?) result in slow boot times.  The reason this WMI Class is an issue is that it uses a DLL to actively query each installed application.   This trigger the reinstall.   Additionally if any of the installed apps are installed remotely this can really slow things down.

The Microsoft blog lists some workarounds.    I’m not sure any of them are perfect for me.   Until I implement a fix this case isn’t closed.   But it is enough for me to do a happy dance while yelling “king of the lab”.

Now where is my trophy?

Content Information security has a nice writeup of tests they performed on a few cloud security providers.

What happens when you delete a virtual server in the course of its lifecycle?   At some point you’ll leave a provider, turn down a server, or just get moved to another server.

On the computers you have control over, hopefully you’re already running some sort of disk wiping.  What about the computers you don’t control?

As any forensicator will tell you, deleted files aren’t necessarily gone.   The table of contents telling you where the file is may be gone but the data is there until it is overwritten.    It turns out that due to some process problems, old servers weren’t overwritten and they were able to access data with a simple dd command on their newly provisioned virtual server.

When the data goes to the cloud you  give up a measure of control.   When you’re at least aware of what can go wrong, you can ask the right questions.

Do check out the article http://www.contextis.com/research/blog/dirtydisks/
Hat tip to Office of Inadequate Security

While playing around with John the Ripper the phrase “password are dead” came to mind.  In the realm of Information Security how many items have been declared dead?

Passwords are dead.
“IDS is dead.” – Gartner
“Gartner is dead” – IDS
The firewall/perimeter is dead.
Antivirus is dead.
SSL is dead.
SIEM is dead.
Corporate IT security is dead.

It starts to look like if you put in any product, idea or compliance regime into google, add on “is dead” and you’ll find results.

Sometimes it is marketing (EIQ and SIEM).  Sometimes predictions.   Occasionally its exasperation at the continuing fail of a product type.  In each case, so one comes out looking like Kreskin.  But the pixels don’t write themselves and those stances generate traffic.

http://cyberarms.wordpress.com/2012/04/16/remotely-recovering-windows-passwords-in-pl/