Tenable Network Security Podcast - Episode 173

Tenable Network Security Podcast

VMWare vCenter Patching - Two plugins were released this week affecting VMware vCenter. If you are running this product, you have to patch this. vCenter is the foundation to your foundation. Successful attacks not only grant the attacker access to the hypervisor, they grant access to all your hypervisors. An attacker with access to the hypervisor has "virtual physical access". For example, downloading the snapshots from your VMware servers is similar to physically sitting in front of your computer. Designing an architecture that allows you to easily patch the virtual infrastructure is not all that easy, and while certainly technically feasible, the challenges come with a price tag of having multiple, redundant, virtual environments. How can we build a cost-effective and low security risk virtual infrastructure?

Detecting Vulnerable Browsers - I don't believe you can have too many checks and balances when it comes to keeping browsers up-to-date with patches. For example, I use Google Chrome on OS X, and set it up to update automatically. For most people, they are not like me and don't keep up with all the latest vulnerabilities. So, its very easy to go on and never realize something needs to be updated. Now, multiple this problems times thousands of desktops, virtual machines, and devices that run a web browser. Turns out my browser was in a funky state, and I had to re-install the updater. Having something like PVS would help, always telling me which of my machines and devices need updating, even if I think they are updated, the User-Agent typically doesn't lie (unless you are telling it to). How do you keep your browsers up-to-date? Are there other circumstances which may cause patches to not apply correctly?

Vulnerability Trending Using Scanning, Sniffing and Logging - I really like this dashboard. If I was responsible for network security, I would use it. Being able to pull from those three different sources to get vulnerability data is really powerful. Few things are able to hide, and I really like that as vulnerabilities can be deceptive and its the ones you miss that get exploited. This is what a penetration test does, finds those vulnerabilities in the dark dusty corners that you missed.