Lab 4 - CIS Control 01 - Vulnerability Scanning and Asset Discovery Tool (Active Scanning)

docx

School

Fleming College *

*We aren’t endorsed by this school

Course

497

Subject

Computer Science

Date

Jun 23, 2024

Type

docx

Pages

Uploaded by AmbassadorApe4315

COMP 497 – Concepts in Information Security Lab 4 – CIS Control 01 - Vulnerability Scanning Resources: Greenbone Enterprise TRIAL (OpenVAS) - https://www.greenbone.net/en/testnow/#toggle-id-3 Greenbone Security Manager Glossary - https://docs.greenbone.net/GSM-Manual/gos-20.08/en/glossary.html#glossary Introduction Vulnerability Scanning and Asset Discovery are two methods required to enforce CIS Control 01 safeguards. In Part 1 of this Lab we will use the Greenbone Enterprise TRIAL vulnerability scanner (formerly called OpenVAS) which is an Open-Source vulnerability scanner that can be run as a VM. In Part 2, we will use Angry IP Scanner, an Open-Source active network scanning tool to detect connected devices (assets). Part 1: Vulnerability Scanning 1) Open weblink https://www.greenbone.net/en/testnow/#toggle-id-3 Under “Choose the Appropriate Option” Pick the VM option (VMware or VirtualBox) you prefer and then follow the details under Instruction, Note and Download. Please note that you do not need to request for any kind of subscription key.

COMP 497 – Concepts in Information Security 2) At this point, you should have installed the VM and completed General System Setup including creating a username and password for a web administration account. Connect to the Web Interface for the tool using a browser of your choice and login using the administration account. 3) By default you should be under “Dashboards” which gives you a view of the executed Tasks (scans) and other information. At this point, you should see zero tasks. We can create a new task and specify our network range for scanning by navigating to Scans > Tasks. In the top left of the page, click on and ‘Advanced Task Wizard’. 4) Set an appropriate ‘Task Name’, set ‘Scan Config’ as ‘Full and Fast’, check ‘Start Immediately’ and then click on ‘Create’. The task should begin. Similarly create advanced tasks for different ‘Scan Configs’. Note : For help understanding certain terms, use the Glossary available at https://docs.greenbone.net/GSM-Manual/gos-20.08/en/glossary.html#glossary Check point 1 : To show completion up to this point, go to Scans > Reports and provide a single screenshot of the whole page (2 points).  Insert Screenshot below: Now answer the questions below (1 point each): 1) Briefly explain the purpose of each Scan Config. 2) Go to Scans > Vulnerabilities and provide a screenshot of the whole page. Pick the highest severity vulnerability and provide a brief description of it. 3) How would you remedy/mitigate the vulnerability identified above? Part 2: Asset Discovery Tool 1) Download Angry IP Scanner from https://angryip.org/ 2) Click on Tools > Fetchers and add ‘MAC Address’, ‘MAC Vendor’, ‘Packet Loss’, ‘Filtered Ports’ and ‘Packet Loss’ to the “Selected fetchers’. Click OK. 3) Run a scan on your network range. 4) Go to Tools > Selections > Alive Hosts. All Live hosts must be highlighted.

COMP 497 – Concepts in Information Security Check point 2 : To show completion up to this point, go to Scan > Export Selection.. and then save your file as .txt with an appropriate name. Upload this file with your submission (2 points) Now answer the questions below (1 point each): 1) How can such a scan be relevant to security? 2) What is the relevance of MAC Addresses in this scan? 3) Make the case for why it would be prudent to keep corporate networks separate from guest networks used by visitors. Grading Requirements 1) Answer all questions completely. 2) Failure to meet checkpoints will mean no points for that Part. 3) The chosen product/protocol should be appropriately described in a manner that demonstrates understanding of its function. 4) The selection of the vulnerability should be appropriate, and its workings understood and articulated in the report. 5) The format of the report should be professional, polished and of appropriate format. 6) Please ensure your work is grammatically accurate. Grammatically poor work will invite deductions. 7) Report Format 8) Check D2L for due dates

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Related Documents

2-3 Final Project Milestone One Programming Report.docx

SMS.docx

D212_JBT_Task2.pdf

CIS 4510 Discussion 7.docx

Chapter 7_.docx

CYB 200 Module Four Activity Template_KOCH.docx

ABA 624 WEEK 1 SAFMEDS.docx

Requirements.docx

ABA 624 WEEK 2 SAFMEDS.docx

The K-mean Clustering Analysis .docx

BUSINESS 13 - Machine Learning Practice Quiz.docx

Lab-3 forensics.docx

Recommended textbooks for you

Fundamentals of Information Systems

Computer Science

ISBN:9781337097536

Author:Ralph Stair, George Reynolds

Publisher:Cengage Learning

Microsoft Windows 10 Comprehensive 2019

Computer Science

ISBN:9780357392607

Author:FREUND

Publisher:Cengage

A+ Guide To It Technical Support

Computer Science

ISBN:9780357108291

Author:ANDREWS, Jean.

Publisher:Cengage,

Management Of Information Security

Computer Science

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:Cengage Learning,

Principles of Information Systems (MindTap Course...

Computer Science

ISBN:9781285867168

Author:Ralph Stair, George Reynolds

Publisher:Cengage Learning

Principles of Information Security (MindTap Cours...

Computer Science

ISBN:9781337102063

Author:Michael E. Whitman, Herbert J. Mattord

Publisher:Cengage Learning

SEE MORE TEXTBOOKS

Recommended textbooks for you

Fundamentals of Information Systems
Computer Science
ISBN:9781337097536
Author:Ralph Stair, George Reynolds
Publisher:Cengage Learning
Microsoft Windows 10 Comprehensive 2019
Computer Science
ISBN:9780357392607
Author:FREUND
Publisher:Cengage
A+ Guide To It Technical Support
Computer Science
ISBN:9780357108291
Author:ANDREWS, Jean.
Publisher:Cengage,
Management Of Information Security
Computer Science
ISBN:9781337405713
Author:WHITMAN, Michael.
Publisher:Cengage Learning,
Principles of Information Systems (MindTap Course...
Computer Science
ISBN:9781285867168
Author:Ralph Stair, George Reynolds
Publisher:Cengage Learning
Principles of Information Security (MindTap Cours...
Computer Science
ISBN:9781337102063
Author:Michael E. Whitman, Herbert J. Mattord
Publisher:Cengage Learning