Detecting Credit Cards, SSNs and other Sensitive Data on UNIX/Linux Systems
Nessus, Nessus Enterprise and Nessus Enterprise Cloud users can now remotely scan UNIX and Linux systems for the presence of sensitive information such as credit/debit card numbers, SSNs, company confidential information, and more.
What Can I Discover?
New configuration auditing capabilities have been added for Nessus users to remotely check UNIX and Linux systems for the presence of sensitive information. This capability has been available on Windows systems for some time; you can refer to the blog post titled "Detecting Credit Cards, SSNs and other Sensitive Data at rest with Nessus" for additional information. The Windows sensitive file content checks have been re-created for UNIX/Linux systems, which include the ability to detect:
- Credit/Debit card numbers (VISA, Mastercard, American Express, and a generic check)
- PII such as Social Security Numbers (including US and international), EDI health claim numbers, drivers license numbers, and Employee Identification Number (EIN)
- Adult content
- Company confidential information (Payroll, NDA, source code, wire transfer information, generic confidential information, financial statements)
PCI Compliance
Credit/debit card information stored in clear-text on remote systems is valuable information to attackers and indicates failure in accordance with the Payment Card Industry Data Security Standard. Primary Account Numbers (or PANs) must be securely deleted or protected according to the requirement set forth in the PCI DSS.
The PCI DSS states that the first step in the compliance process is to validate cardholder data flows and storage areas to accurately determine the systems that are in scope for PCI compliance. Cardholder data may not be stored in a readable format, so being able to identify storage locations of cardholder data is key.
Configuration & Features
Nessus now supports the following:
- Cross-platform support including Red Hat/CentOS, SunOS, AIX, HP-UX, Mac OS X, BSD
- LUHN support - LUHN is the formula used to determine if a credit card number if valid or not. Credit cards numbers not verified by the LUHN algorithm are typically not of interest, so Nessus can now ignore non-valid credit card numbers.
- Current checks support file types of PDF, DOC, XLS, and more. This list is customizable by the Nessus user.
In order to run a scan for sensitive data against UNIX and Linux targets, you will need the following:
- Root-level privileges on the remote host and SSH access to the targets (for instructions on setting up credentialed scanning, please refer to the document Nessus Credential Checks for Unix and Windows).
- Activation of Plugin ID #72095 (Unix File Contents Compliance Checks).
- One (or more) of the new audit files in the new UNIX/Linux Sensitive Content Audit category", which can be downloaded from the Tenable Support Portal.
- New Feature: Optionally, you are able to turn on/off the setting to check for a valid LUHN test. Setting the LUHN value in the audit file to “YES” tells Nessus to only report credit card numbers that are LUHN verified. LUHN checking is also now available in the Windows Sensitive Content Auditing checks.
The results for the new UNIX sensitive content auditing checks, specifically looking for cardholder data, are as follows (click for a larger image and to see both a passed and failed result):
Click for larger image
Click for larger image
Checking for PII (Personal Identifiable Information)
Many organizations face challenges when they are required they store and protect PII such as Social Security Numbers. Several US states have put laws in place to help safeguard this information. Despite these regulations, breaches involving Social Security Numbers are still occurring, including a large one last month where 50,000 full and partial SSNs were stolen as a result of a breach at Arkansas State University. Continuously monitoring your systems for the presence of PII, such as Social Security Numbers, is important and Nessus can be used to discover such cases, as shown below:
Click for larger image
For more information about this feature, please refer to the Tenable Discussions Forum entry that contains more technical details about the checks themselves. Tenable customers can go to the Tenable Support Portal and download the new audit file, which can be implemented in all Nessus and SecurityCenter products.
Related Articles
Cybersecurity Snapshot: CISA Pinpoints Vulnerabilities in Critical Infrastructure Orgs that Ransomware Groups Could Exploit
March 17, 2023Learn about CISA’s new program to help critical infrastructure organizations stamp out vulnerabilities associated with ransomware attacks. Plus, a U.S. government advisory with the latest on LockBit 3.0. Also, find out why the U.K.’s cyber agency is warning users about ChatGPT. And much more!
Microsoft’s March 2023 Patch Tuesday Addresses 76 CVEs (CVE-2023-23397)
March 14, 2023Microsoft’s March 2023 Patch Tuesday Addresses 76 CVEs (CVE-2023-23397) Microsoft addresses 76 CVEs including two zero-days exploited in the wild, one of which was publicly disclosed. 9Critica...
Cybersecurity Snapshot: Find MITRE ATT&CK Complex? Need Help Mapping to It? There’s an App for That!
March 10, 2023Learn about a new tool that streamlines MITRE ATT&CK mapping. Plus, known vulnerabilities remain a major cyber risk – just ask LastPass. Also, discover why SaaS data protection remains difficult. Plus, a look at the U.S. National Cybersecurity Strategy. And much more!
3CX Desktop App for Windows and macOS Reportedly Compromised in Supply Chain Attack
March 30, 2023A softphone desktop application from 3CX, makers of a popular VoIP PBX solution used by over 600,000 organizations, has reportedly been trojanized as part of a supply chain attack
Five Core Principles for Hybrid Cloud Security
March 29, 2023How to build a hybrid-cloud security strategy that is effective, scalable and affordable.
Exposure Management: 7 Benefits of a Platform Approach
March 28, 2023When it comes to preventive cybersecurity, there have been longstanding debates over whether it's more effective to operate an array of best-of-breed point solutions or to take a more consolidated platform approach. Here are seven reasons an exposure management platform can help reduce cyber risk.
- Vulnerability Management
