Lamar Bailey, nCircle's director of security research and development, walks you through how deal yourself a winning hand with your security products. A YouTube video of Lamar's presentation is available through the link below: http://youtu.be/ogTBB7w1XyM

1. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
Stacking the Security Deck in your
Favor
Deal yourself a winning hand

2. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Operating Systems
• Databases
• Office Applications
• Networking Gear
• Browsers
Your hand

3. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
The Vulnerability Deck is Increasing
0
1000
2000
3000
4000
5000
6000
7000
2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

4. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
Aces

5. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Custom Apps
• Legacy
• 0-Day
Wild Cards

6. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Rule:
RegistryQuery GetKey[HKLM] THEN CHECK Exists
• Explanation:
Request the HKLM registry key and check to see if it
exists.
Custom ASPL - Basics

7. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Rule:
SEND String[GET / HTTP/1.0x0dx0ax0dx0a] THEN
CHECK Contains/HTTP/1.[01] 200/ WITH
Offset[0], Length[12]
• Explanation:
Send data (in this case an HTTP 1.0 request) to a host
and check that the response matches a typical HTTP
response pattern in the first 12 bytes of the response
data.
Custom ASPL - Basics

8. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Rule:
EXECUTE {
rule.CIFSGetFile('C$:WindowsWIN.INI')
if not rule.success: rule.STOP(False)
transcript = rule.buffer
transcriptIsFull = True
}
• Details:
Get the contents of C:WindowsWIN.INI and store them to
the rule instance data.
Custom ASPL – Now with Python

9. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Rule:
EXECUTE {
import aspl_sshcore
aspl_sshcore.startSSH(rule)
rule.SEND('cat /etc/resolv.conf')
rule.waitForData()
if '8.8.8.8' not in rule.buffer and '8.8.4.4' not in rule.buffer:
rule.STOP(True)
rule.STOP(False)
}
• Details:
Here we’re connecting via SSH to a host to check the /etc/resolv.conf file to determine if
we’re using Google’s DNS servers or not. If we aren’t, we fire the rule to inform us of that
fact.
Custom Rules – Now with Python

10. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
Stack the Odds in Your Favor
Heuristic Scoring
Using:
• Time
• Risk Factors
• Skill
Scores form 0 - 55,000+

11. © 2013 nCircle. All Rights Reserved.nCircle Company Confidential
• Vulnerability Date Modifiers
• Risk Modifiers
• Vulnerability Class Modifiers
Adjusting Scores