Security, Vulnerability Scanning Program, General Information
Introduction
This document details the security vulnerability program, common sources, tools, and policies used by Security for vulnerability management at the University of Illinois. Please note that while the Cyber Security Operations Center (CSOC) performs security vulnerability scans in many instances, individual system, infrastructure, and service stewards are responsible for discovering and managing their exposures, vulnerabilities, and associated risks.
Program Goals
System Vulnerability Scanning
- Goal: Continuously probe university systems and networks for vulnerabilities and exposures such that the university has the most accurate and timely information.
- Goal: Provide service owners with access to accurate and timely vulnerability information.
- Goal: Perform timely scans of critical infrastructure including data centers.
- Service: Consult with stakeholders, service managers, and interested parties regarding: understanding results, understanding tools available, security scanning practices, planning/prioritizing remediation, validating results.
- Limitation: Scanning is currently scoped only to the wired network under the purview of UofI.
Application / Web application Vulnerability Scanning
- Goal: Continuously probe university web applications for vulnerabilities and exposures such that the university has the most accurate and timely information.
- Goal: Provide service owners with access to accurate and timely vulnerability information.
- Goal: Perform timely scans of web application infrastructure.
- Service: Consult with stakeholders, service managers, and interested parties regarding: understanding results, understanding tools available, security scanning practices, planning/prioritizing remediation, validating results.
- Limitation: Application owners must know secure coding practices and steps for remediating applications.
Internal / External Vulnerability Reports
- Goal: Provide a source for Internal / External agencies to report vulnerabilities.
- Goal: Review, approve, and implement appropriate external reporting and scanning services.
- Service: Validate reports and forward appropriate information to service owners and stewards.
- Service: Respond to critical vulnerabilities with appropriate action sanctioned by university leadership.
- Service: Report overall state of vulnerability detection capabilities and known campus vulnerabilities to campus leadership.
- Limitation: Internal scanning may only be conducted on services / systems owned by the unit and must use approved security tools.
- Limitation: External reports vary in quality and validation requirements may exceed staffing resources.
Risk
Network, system, and application scanning all have inherent risk. This practice is approved by both campus and Technology Services Leadership to understand campus vulnerability and risk. Where possible, internal and external scans are limited to avoid systems and service interruptions. Scanning tools and services are continuously reviewed.
Vulnerability Scanning Practice and Tools
The below tools or services are commonly utilized as sources of vulnerability data on campus.
|
TOOL
|
DESCRIPTION
|
HOW TO GET/USE
|
|---|---|---|
| Qualys Cloud Platform | Cloud SaaS tool used to detect and track host and network level vulnerabilities. Scanning engines are hosted on-prem and in the Qualys Cloud | IT Pros responsible for campus networks can logon to Qualys to review vulnerability data. |
| Nmap | Scriptable port scanner | Free tool; Can be downloaded, installed and used by responsible IT pros on any Linux or Windows computer |
| CrowdStrike EASM | Passive web application scanner run by CrowdStrike which continually scans for Illinois external assets | Privacy and Security will monitor vulnerability reports and communicate confirmed vulnerabilities to unit |
| Qualys Web App Scanner | Cloud SaaS tool used to detect and track web application vulnerabilities. Scanning engines are hosted on-prem and in the Qualys Cloud | Privacy and Security will monitor vulnerability reports and communicate confirmed vulnerabilities to unit |
| Burp Pro | Manual/automated web application vulnerability testing tool | Security/SDG QA use only. Free version available but has limited but useful functionality. |
| OWASP Zed Attack Proxy (ZAP) | Web application vulnerability testing tool. Can be used with the Desktop Graphical User Interface or Docker. |
Free tool; Can be downloaded, installed and used by responsible IT pros. Documentation, including their Getting Started Guide, is available . |
- Recommended Scanning Profiles have been developed for the Qualys platform. These profiles provide preconfigured scan settings that have been tested on campus systems and networks.
- Access to the Qualys platform is provided by an integration with CDB.
- Scan reports are considered confidential and should not be shared with non-stakeholders unless authorized by the campus Chief Privacy and Security Officer.
- Reports will be made available to system and service managers, their managers and directors (on request) and the Vulnerability Assessment Team.
- Qualys scans will be stored in the Security Office's logging environment for correlation with network based attacks.
Scanning Engine Source List
Technology Services maintains multiple vulnerability assessment technologies each targeting specific layer in the service delivery stack, though some degree of overlap exists in each.
Authorized scanning resources are listed below for general reference. This is a non-inclusive list as the vulnerability program needs it may use additional resources not listed here. External agencies both approved and not approved continuously scan our network for vulnerabilities. If you have questions about scanning activity from the any source, feel free to contact securitysupport@illinois.edu
|
ENGINE TYPE(S)
|
FQDN
|
IP/NET
|
NOTES
|
|---|---|---|---|
| Nmap, application scanning tools, etc. | scanner.opia.illinois.edu | 192.17.82.165 | Multipurpose security scanner, other tools used as needed |
| Qualys local network scan engines for adhoc scanning |
qvsa-adhoc1.virtual.illinois.edu qvsa-adhoc2.virtual.illinois.edu |
192.17.95.144-192.17.95.145 | Scanning appliance |
| Qualys local network scan engines for automated scanning | qvsa[00-07].virtual.illinois.edu |
192.17.171.30-192.17.171.33 192.17.171.24- 192.17.171.27 |
Scanning appliances |
| Qualys cloud scanning engines | --- | 64.39.96.0/20 139.87.112.0/23 |
External scanning appliances within the Qualys Cloud Platform |
| CrowdStrike EASM | --- | 52.8.221.60 13.52.148.107 52.52.20.134 |
Passive web application scanner run by CrowdStrike which continually scans for Illinois external assets |
| Shodan | census[1-12].shodan.io | † | †There are many shodan scanners, but they all should resolve to shodan.io addresses. Use the shodan web console to enumerate info found by Shodan. |
IT Security Standards and Controls Information
Scans using the recommended profile meet the controls regarding unauthenticated vulnerability scanning: - IT03.10.1 - IT04.10.1 - IT10.10.1
Separate authenticated or agent-based scans are required for High Risk systems.
Detailed information about security controls can be found at: https://cybersecurity.uillinois.edu/controls
Recurring Scan Practices
Regular vulnerability scans are conducted to maintain accurate and timely vulnerability information for campus assets. These scans are conducted with the Qualys Cloud Platform.
- Administrators and stewards are responsible for reviewing critical scan results and are expected to remedy or mitigate exposures in a timely fashion.
- Systems may be re-scanned after vulnerabilities are addressed.
- Systems that display an unusually large number of vulnerabilities, or are subject to an unusually large number of security incidents may be scanned at a higher frequency, (possibly daily or weekly) until these systems fall into the range of acceptable risk, as determined by campus.
-
Every wired device on the network is to be scanned at least monthly.
-
Current scanning covers 3,200 CDB asset groups and around 70,000 hosts.
-
-
Scanning is scheduled based on asset groups in CDB and notification is sent based on primary contacts.
-
For information on the CDB integration see https://answers.uillinois.edu/internal/page.php?id=108152
-
-
The scan profile has been determined to be the minimum required to get basic vulnerability information.
-
The scans currently utilize the Recommended Standard Scan Options profile.
-
Devices disrupted by this type of scan are considered vulnerable by default as this indicates susceptibility to DoS or other style attacks.
-
-
Exceptions to scanning can be requested by completing this form: https://go.illinois.edu/scanningexception
-
Devices not excluded or scanned manually with this profile will be considered compliant with IT04.10.1 IT03.10.1 and IT10.10.1 vulnerability controls.
-
If an IT Pro needs to cancel a currently running scan or the next scheduled scan, and has permissions to that network, the following Microsoft Form can be submitted.
Definitions
Network Port: A numeric identifier assigned to different TCP or UDP channels on a network interface. Although port numbers range from 0 to 65535, many well-known services have reserved port numbers between 0 and 1024 (e.g., HTTP uses port 80, Telnet uses port 23, and FTP uses ports 20 and 21.) To establish a session with a host, a network request must be sent to the appropriate port number on the host (i.e. to establish an HTTP session with a web server, your workstation software will send a request to port 80 of the web server).
Port Mapping: The process of sending packets to selected service port numbers (HTTP-80, Telnet-23, etc.) of a computing system with the purpose of collecting information such as available network services from that system. This non-invasive process is helpful for troubleshooting system problems or tightening system security. Network port scanning is an information gathering process, and when performed by unknown individuals it can be a prelude to attack.
Scanning: The process of gathering information on computing systems, which may be used for system maintenance, security assessment and investigation, and for attack. This process includes port mapping, vulnerability scanning; and at times (with the cooperation from system owners), authentication and internal information gathering. If used properly, scanning of this type is an excellent tool for protecting University information resources. Malicious scans can be a prelude to the disclosure of sensitive data, loss of service, and damage to the University's reputation in the global community.
Vulnerability Scanning: The process of identifying known vulnerabilities of computing systems on the network. This process goes a step beyond identifying the available network services of a system as performed by a network port scan. The vulnerability scan attempts to identify specific weaknesses in the operating system or application software, which can be used to compromise or crash the system. The vulnerability scan is also an information gathering process, and when performed by unknown individuals it is considered a prelude to attack.
Application Scanning: The process of identifying known vulnerabilities in software applications using automated scanning tools. These tools use methods such as querying and spidering to identify all pages and functions in a web site or application. It then tests the limits of each function or input identified with tests developed against common vulnerabilities and common OWASP Top 10 flaws such as cross-site scripting, sequel injection, injection through i-frames, cross-site request forgery, authentication bypass, and other commonly occurring issues.
Contacts
For any questions please email securitysupport@illinois.edu.