In this lab, I'm going to introduce you
to a couple of tools.
They come from the United States Department of Defense,
who originally had the CMMC model for cyber maturity.
And it includes 17 capability domains and five
different maturity levels.
And the tool that was most commonly used
is the Security Content Application Protocol,
which is part of the Security Technical Implementation
Guides.
So the guides are requirements.
And they actually map back to NIST 800-53.
And then the SCAP is the protocol.
It's the scanning benchmarks that
then are used to check and see if the requirements in 800-53
are completed or not.
So let's jump into the environment
and see how that works.
We have this Windows Server 2016--
or 2019, I should say.
We have the SCAP tool.
Run it as administrator.
And we can see here that the benchmarks are already
in the Windows Server 2019 state.
And we're just going to start the scan.
And we can see that the scan results are complete.
We then view results.
And a quick view over here shows an average max and min
of 46.37%.
Well, let's dig in a little bit.
I right-clicked Open Summary Viewer
in OS default web browser.
And initially it's blocked content,
so allow blocked content.
We'll look at the errors in HTML.
All right.
So we see this score, 46.37%, and for compliance, it
gives a status of red.
And you can see here why it doesn't meet
the 80% threshold for yellow.
But what's in here?
Let's scroll down and we can see the results.
There's a lot of things in here that
failed, including Windows Server 2019 PowerShell script block
logging must be enabled.
Well, let's look at that one.
Where does that come from?
You can see the fix for why it's here.
But right up here, it talks about missed 853
and it gives references to why it is what it is.
And you could even follow more of these links
to gather more information.
But we'll close that and close the results.
43% is not great.
Is there another way we can view it?
Let's look at the STIG viewer.
And we can just open a checklist that we've already created.
This checklist is based off those STIGs, the Microsoft
Windows Server 2019 STIG.
Then we see there's 204 items in here.
It's broken up into three categories.
Category one talks about how failure to comply
can lead to exploitation of which
will directly and immediately result in loss of CIA.
Category two talks about a potential
to result in loss of CIA.
And category three degrades measures
to protect against loss of CIA.
And if we look at what's included in here,
configuring the system to disable IPv6 source routing
protects against spoofing.
Is that something we want?
[INAUDIBLE] It is not going to end the world.
Cat two items, this first one, Windows Server 2019
must be configured to audit account management, security
group management successes.
And in here, it gives references for what leads to it.
And there's fix items.
So you can just follow the instructions
and fix all of them.
Well, let's import the results of our scan on the desktop.
SCAP Scan Results, Sessions-- you should just have one.
Results, SCAP, XML, and then the final data,
extraneous results found.
That's fine.
And in here we see that looks like 43%.
These are not a finding, meaning that they were not a problem.
There we go.
Fixed it, went to Overall Tools, Imported-- or Overall Totals.
Now we can check [INAUDIBLE].
So what was still open?
I see that Windows Remote Management client must not
use basic authentication.
Needs that "Allow Basic Authentication"
to disable in that menu.
And that's how you would fix these items.
Or we're going to do something else.
Open a command line as administrator.
See the Administrator command?
And we have this Group Policy, here, with the LGPO tool.
I'm going to copy the path, change
directories to that path.
Now we look there, and we have our tool,
which is not installed, which is why we need
to be in the same directory.
And we'll run LGPO.exe/g.
And then we have these two policies.
So we'll go with that--
this one first.
And then LGPO.exe/g and second one.
And you can see it did all that work, changed
some registry items, and you can go in and see
what all the changes were.
Or let's just open--
this guy again and start a new scan.
And our results are back.
We can view these results.
And you can see it went from a 46.37 to a 91.62.
You could view these in the browser or--
we'll do this a simpler way.
Let's import the new results.
And then we'll go back to Session
and pick the later session, keep driving in
until we get to the results.
And, wow, that solved all the cat ones except for one.
We can look at what this one is, permissions on Active Directory
data files must only allow system administrators access.
And the fix, mainly, maintain the permissions
on NTDS database and log files as follows.
All right.
So we can go in and change those.
It also says that's not applicable,
so we don't have that database.
A few things that were included in cat two are certificates.
Those could go-- be downloaded and installed.
If we were a part of the DOD system,
we would want to do that.
Everyone else doesn't need to.
And one of the things about this, this
is built for the DOD.
And you could implement in this all yourself if you wanted.
But really it's just a--
it's an example.
It's an example of how auditing works.
There are benchmarks.
There's standards.
There are best practices.
And they've made a tool so that it can be
standardized across the board.
Everyone has these settings and configurations.
And so every system is in compliance.
But it all depends on what the business needs,
what the organization requires.
A smaller organization will come up with their own requirements.
They might have to follow certain regulations.
And depending on their cyber maturity,
they'll make choices based on their risk-management appetite
and what works best for the organization.
Going back to this penetration tester student,
if you are going to be a penetration tester,
you need to understand where your customer is coming from,
where the organization is going.
What maturity level are they at?
What do they already know about their system
through proper vulnerability management, risk management?
And then what are you actually adding value to?
You can utilize some of the same tools
in penetration testing that are used
in vulnerability management.
A lot of it all comes down to the report and the scope.
What are you allowed to do?
What is most effective in adding value to your customer?
And what would you put in your report that actually
allows them to be more secure and meet business requirements?
I'll leave you with that.