Detecting Credit Cards, SSNs and other Sensitive Data on UNIX/Linux Systems
Nessus, Nessus Enterprise and Nessus Enterprise Cloud users can now remotely scan UNIX and Linux systems for the presence of sensitive information such as credit/debit card numbers, SSNs, company confidential information, and more.
What Can I Discover?
New configuration auditing capabilities have been added for Nessus users to remotely check UNIX and Linux systems for the presence of sensitive information. This capability has been available on Windows systems for some time; you can refer to the blog post titled "Detecting Credit Cards, SSNs and other Sensitive Data at rest with Nessus" for additional information. The Windows sensitive file content checks have been re-created for UNIX/Linux systems, which include the ability to detect:
- Credit/Debit card numbers (VISA, Mastercard, American Express, and a generic check)
- PII such as Social Security Numbers (including US and international), EDI health claim numbers, drivers license numbers, and Employee Identification Number (EIN)
- Adult content
- Company confidential information (Payroll, NDA, source code, wire transfer information, generic confidential information, financial statements)
PCI Compliance
Credit/debit card information stored in clear-text on remote systems is valuable information to attackers and indicates failure in accordance with the Payment Card Industry Data Security Standard. Primary Account Numbers (or PANs) must be securely deleted or protected according to the requirement set forth in the PCI DSS.
The PCI DSS states that the first step in the compliance process is to validate cardholder data flows and storage areas to accurately determine the systems that are in scope for PCI compliance. Cardholder data may not be stored in a readable format, so being able to identify storage locations of cardholder data is key.
Configuration & Features
Nessus now supports the following:
- Cross-platform support including Red Hat/CentOS, SunOS, AIX, HP-UX, Mac OS X, BSD
- LUHN support - LUHN is the formula used to determine if a credit card number if valid or not. Credit cards numbers not verified by the LUHN algorithm are typically not of interest, so Nessus can now ignore non-valid credit card numbers.
- Current checks support file types of PDF, DOC, XLS, and more. This list is customizable by the Nessus user.
In order to run a scan for sensitive data against UNIX and Linux targets, you will need the following:
- Root-level privileges on the remote host and SSH access to the targets (for instructions on setting up credentialed scanning, please refer to the document Nessus Credential Checks for Unix and Windows).
- Activation of Plugin ID #72095 (Unix File Contents Compliance Checks).
- One (or more) of the new audit files in the new UNIX/Linux Sensitive Content Audit category", which can be downloaded from the Tenable Support Portal.
- New Feature: Optionally, you are able to turn on/off the setting to check for a valid LUHN test. Setting the LUHN value in the audit file to “YES” tells Nessus to only report credit card numbers that are LUHN verified. LUHN checking is also now available in the Windows Sensitive Content Auditing checks.
The results for the new UNIX sensitive content auditing checks, specifically looking for cardholder data, are as follows (click for a larger image and to see both a passed and failed result):
Click for larger image
Click for larger image
Checking for PII (Personal Identifiable Information)
Many organizations face challenges when they are required they store and protect PII such as Social Security Numbers. Several US states have put laws in place to help safeguard this information. Despite these regulations, breaches involving Social Security Numbers are still occurring, including a large one last month where 50,000 full and partial SSNs were stolen as a result of a breach at Arkansas State University. Continuously monitoring your systems for the presence of PII, such as Social Security Numbers, is important and Nessus can be used to discover such cases, as shown below:
Click for larger image
For more information about this feature, please refer to the Tenable Discussions Forum entry that contains more technical details about the checks themselves. Tenable customers can go to the Tenable Support Portal and download the new audit file, which can be implemented in all Nessus and SecurityCenter products.
Related Articles
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
- Vulnerability Management