Using Kali Linux to scan a network, we observe the current state of a network. Gap analysis road maps benchmarks to arrive at the desired state.

1. Gap Analysis &
Security Evaluation
Jason Murray, D.CS
Cornwall-Lebanon SD
www.slideshare.net/jasonmurray72

2. Goals
• Awareness
• Information Gathering
• Phases of Exploitation
– Think like a hacker
• Security Gap Analysis Framework
• Demonstrate a few Kali Linux tools

3. How vulnerable are you?

5. How easy is it to gather information?

6. FireForce

8. sqlmap –u [URL]

9. What happens if we become a target?

10. 5 Phases of Exploitation
1. Reconnaissance
2. Scanning
3. Gaining Access
4. Maintaining Access
5. Covering Tracks

11. Reconnaissance
• Target
– Internal DNS
– Private Website
– Dumpster Diving
– Shoulder Surfing
– Eavesdropping

12. Reconnaissance – Whiteboarding
• Phone
• Network
• Websites
• Email
• Google
• WhoIs
• AnyWho
• DNS
• Social Network
• IP Blocks
• Net Blocks
• Web Server
Content
• Source Code
• Directories
• Databases
• Search Engines
• URL Analysis
• Google Earth
• People Sites
• Financial
Analysis
• Job Sites
• Alert Websites
• Archive Sites
• Web Monitoring
• Google Dorking

13. Target - Demo

16. Scanning
• Layer 4 – TCP (flags) & UDP
• Layer 3 – IP (v4 or v6) & ICMP
– Host
– Ports & Services
– Vulnerabilities
– Diagrams

17. Scanning - Tools
• DNS Enumeration
• nikTo
• hping3
• NMAP
– ZenMap

18. Advanced
• Gaining Access
• Maintaining Access
• Covering Tracks

19. Avoid Getting Targeted

21. Security Gap Analysis

22. Team
• Considerations
– IT staff
– Security
– End Users
• Teachers
• Students
• Community
– Management
– Tech savvy & non-savvy

23. Step 1: Policy, Procedure, & Guideline
• Standards
– COBIT
– ISO 27001

24. Step 1: Policy, Procedure, & Guideline
• Pen Testing Standards
– Open Web Application Security Project
– Penetration Testing Execution Standard
– Open Source Security Testing Methodology Manual
– Penetration Testing Framework

25. Step 1: Policy, Procedure, & Guideline
• Who has access/privileges?
– For how long?
– Vendors vpn?
– Retirees/terminations?
– Logging?
• Updates?
– Every node?
• Passwords
– Saved in browser?
– Frequency of changes?

26. Step 2: Audit
• Permission
• Scope
– Physical and/or electronic
• Social engineering
– Timetable
– Resources (outsourced/in house)
• Review Framework
– Following policies (awareness)
• Openings
– Ports
– Human Factor
– Physical equipment

27. Step 2: Audit
• Device Security
– Encryption
– Password
– Device storage
– Device on a non-secure network

28. Step 2: Audit
• Physical Security
– Access to infrastructure
– Environmental safeguards
• Temperature
• Humidity
– Protection safeguards
• Fire
• Water

29. Step 2: Audit
• Personnel Security
– Staff backgrounds
– Security awareness programs that discourage
insider attacks
– Protection against terminated staff
– Repercussions of malicious violation of
information security

30. Step 2: Audit
• OpenVAS

31. Step 3: Technical Review
• Up to date
– Software/patches
– Policies
• Awareness
– Justification for openings
• Consistency
– OS, antivirus, update procedures
• Vulnerability/risk management
• Encryption

32. Step 4: Findings & Prioritization
Summary
• Review the findings
• Organize & arrange tasks to fix gaps
– Electronic
– Policy, procedures, guidelines
– Physical
• Update Risk Management Strategy

33. Questions

34. Resources
• CIO
• Faulkner Information Services
• Forbes
• Pen Test Frameworks
• Tech Target
• University of Minnesota
• YouSigma

35. Kali Resources
• Free Education For All (120 lessons)
• JackkTutorials
• Royal Hacks
• Royal Hacks (advanced)
• Kali Linux Tutorials