2 of 8

EXECUTIVE SUMMARY

During our penetration test, I found ways to exploit some existing vulnerabilities on the servers in our network. It is important that we find ways to mitigate those vulnerabilities and reduce risks. I suggest that we create a log of suspicious activities against our network and that we prevent known attacks from occurring.

To accomplish this, I updated our firewall with the latest software. I then configured the pfSense firewall with both an Intrusion Detection System and an Intrusion Prevention System (IDS/IPS). We are using a program called “Snort” as our IDS. It is updated with the latest ruleset as well as some customized rules to alert us to any suspicious activity coming in from the outside (Untrusted). This log is available in real-time for constant monitoring. Using the existing tools in the pfSense firewall, I created a stateful configuration that accomplishes 4 main goals:

The trusted network (CEO Machine and Production Server) will always have access to the internet, email, etc. Our staff will also have access to the Domain Name Server and Webserver located in the DMZ.
The Untrusted network will never have access to our internal network (Trusted).
Our Webpage and Domain Name are available to the public, but only in the capacity that they are intended.
The firewall will block all File Transfers (FTP) from the DMZ to the outside.

3 of 8

VULNERABILITY�(REVIEW FROM OUR PENETRATION TEST)

A vulnerability is a misconfiguration; coding error; or hardware, network, or software problem that leaves the system open for attacks. There are many known vulnerabilities. Some are dangerous if exploited and others are benign. Patches, upgrades, and firmware/software updates are an important way to mitigate risks and avoid many vulnerabilities. There are times, however, that these are caused by human error in server configuration, firewall rules, software installation, or mismanagement of the system itself.

4 of 8

VULNERABILITY FROM THE OUTSIDE�(DISCOVERED DURING THE PREVIOUS PENETRATION TEST)

Webserver - Publicly Available Information and Vulnerabilities

Port 21 – File Transfer Protocol (FTP)

Anonymous FTP login allowed

Port 22 – Secure Shell (SSH)
Port 80 – Hypertext Transfer Protocol (HTTP)

Website built with Apache v 2.2.8 Ubuntu
Server name – Cybersecurity Bootcamp Server

Port 139/445 – Network Basic In/Out System (NetBIOS)
Port 1524 – Bindshell

BACKDOOR Vulnerability to open a “root shell”

Port 3306 – MySQL

Certificate expired April 16, 2010

Operating system – Linux 2.6.15-2.6.26
Network – 2 hops in the network

5 of 8

INTRUSION PREVENTION SYSTEM (IPS)�FIREWALL CONFIGURATION

After replicating the previous Metasploit scan, the unneeded ports are closed and the Webserver is secure. We are no longer finding vulnerabilities on the Webserver.

6 of 8

INTRUSION DETECTION SYSTEM (IDS)�SNORT

As you can see, Snort is working as it should; logging suspicious activity from the Untrusted network to the Webserver and DNS Server in the DMZ

These are the Metasploit scans initiated in the previous slide

7 of 8

VULNERABILITY FROM THE INSIDE (UPDATED)

Any organization has the challenge of providing the required access for employees and clients while also protecting the company. We want to make sure that our data is kept confidential, that it remains intact without unauthorized modifications, and that it accessible for those who need it. There will always be threats from attackers using phishing, smishing, spam, and malware trying to get access beyond the firewall. As a result of the penetration test, we have updated the password policies for the company and we are creating a playbook of how to handle a breach of network security if it were to occur. As more employees come on board, we need to configure some Access Control Lists (ACLs). We will customize these lists based on each employee’s need to access certain parts of our network. In addition, we are writing an Acceptable Use Policy (AUP) for the company. We will ask each employee to sign this agreement. It is my suggestion that we continue to educate and remind all employees of the need for vigilance when it comes to the security of our data. We want to mitigate risk from both the outside world and from the inside.

8 of 8

SECURITY REMINDERS FOR ALL

New Password Policy

At least 8 characters
1 letter/1 number/1 symbol/ 1 capital
Passwords should be changed at a regular interval

Beware of Social Engineering

Never open attachments from unknown senders
Do not click links in texts from unknown senders
Be aware of what information you give out on the phone and over email
Report suspicious emails and text messages to the IT department
Use a spam filter and anti-malware

IT Department Reminders

Use secure protocols, encrypt data, and make backups