Is that System Managed?
IT auditors, penetration testers, and incident responders often ask if a system they are analyzing is managed. A managed system is one that is being looked after, updated and maintained by an IT staff of some sort. An unmanaged system is one that is on the network, but perhaps has been forgotten, isn’t authorized or has some other reason for it not to be there or updated by anyone else.
Security findings for managed systems and unmanaged systems are reported differently. For an unmanaged system, the recommendation is to make the system managed and bring it into a secured state. For security issues with managed systems, the recommendation is to alter the current management processes to make them more secure.
Unfortunately, there is no “under management” test that can easily be automated. This blog entry will describe some of the different types of data that can be gathered from logs, Nessus scanning and Passive Vulnerability Scanner sniffing that can help identify systems with and without management.
How old are those vulnerabilities?
We have all seen “bad” patching at both large and small networks, but if you run across a system with vulnerabilities from 2009 or other years past, it’s likely not being managed.
Tenable’s SecurityCenter can chart and report on vulnerabilities based on their CVE-ID or Microsoft patch ID. These IDs include the year they were issued, which means dashboards and reports can be created that shows systems with issues from 2008, 2009, etc.
SecurityCenter can also be configured to look for “newly found” vulnerabilities that are for vulnerabilities from many years ago. This can give you real-time warnings when “new” systems contain older vulnerabilities.
Is there evidence of a patch or configuration management software?
Nessus and the Passive Vulnerabiltiy Scanner (PVS) have many checks that can identify if a system is participating in a domain or if it is running a variety of management agents. Nessus configuration audits can also be used to look for:
- Specific management agent processes and their configurations
- Registry and file settings associated with asset management
- Registry settings and files to test for known bad configurations such as factory settings and pre-“gold disk” values
The PVS has many useful real-time checks that identify Microsoft GPOs being pushed as well as the actual GPO servers. Below is a screen shot of GPO pushes detected by the PVS and logged to the LCE:
What do the logs say?
Tenable’s Log Correlation Engine (LCE) gathers logs from many different systems. These logs indicate changes such as patches being installed, registry changes made and files being modified. Below is a screen shot of changes detected over a 24-hour period through log and system analysis by the LCE:
If a system has no logs being gathered for it, it might be managed, but if you see logs from a system, you know that the system is likely under management since adding an agent or getting logs off of a system requires configuration by someone in IT.
Other Shortcuts
I received several tips with pros and cons from Nessus auditors that are listed here:
DNS name – on some networks, a node will only get an official DNS name if the asset is known and managed by the IT group. Often, the DNS name will have code that indicates the function or purpose of the system. On some networks, every IP address resolves to something, so you can’t always use this.
DNS Queries – A system that queries outdated DNS servers is likely a system that isn’t configured correctly and isn’t being managed. Passively, the PVS can log which DNS servers a system is using. When most systems on a network are querying the few correct DNS servers, it is easy to identify the systems that aren’t.
IP Range – Organizations that have modern switching services leverage DHCP IP address assignment to ensure that the VLANs and netmasks are given out to authorized systems. Guest devices that aren’t managed are given leases with addresses in ranges that are different than other servers.
Out of Date SSL Certificates – Systems that leverage SSL certificates for security often depend on Certificate Authority (CA) certificates that have an expiration date. An expiring certificate that does not get updated can indicate a system that isn’t under management. Nessus identifies these types of certificates and the PVS can sniff them as well.
Share your ideas
If you have a technique or method to identify managed vs. unmanaged devices, please feel free to share this with other Tenable customers on our Discussions Portal.
Tenable has also posted a dashboard for SecurityCenter users that tracks unmanaged hosts based on Nessus scans.
Related Articles
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
- Vulnerability Management
- Vulnerability Scanning