[MUSICAL INTRO]
In this lab, we're going to cover some auditing
fundamentals utilizing Nmap.
We spoke before about the CMMC model.
And there's many.
But I pull this one up because asset management
is one of the 17 capabilities of CMMC version 1.
Now, there's a lot that we could do with asset management.
And I'm going to take you over to our environment.
And we're going to utilize Nmap for asset management.
Usually, you're going to have a network
map in the organization, maybe an Excel file or a database,
with all of the machines, endpoints, routers, switches,
firewalls that are connected to the network.
And that's a starting point for the company
itself, the organization itself, to understand
where all its devices are.
And then, it can look at what services are hosted or present
on each of those devices.
It's the same thing that you do during a pen test,
except you do it from a black box point of view.
An audit or an internal scan, they
should know what's already out there.
They might be looking for some shadow IT.
Maybe someone plugged in their own device
in order to get work done and work around
what was established by the organization itself.
So let's look at our IP address.
And this is the network.
192.253.100.
And then, it's CIDR 24, so the network is .0.
So let's run an Nmap scan.
And we'll place that with 0.24.
And it came back pretty quickly, which is nice.
I didn't put any flags.
So .1 has 22, 80, and 443.3.
80, 443, and MySQL.
.4 doesn't seem to have any endpoint,
or it doesn't seem to have any ports open.
Same with .5.
And .6 has port 21 open.
So I would assume that we've got some server in the FTP server,
a web server, and a SQL database server that
might be attached to a website.
And then, we're on .2.
So we could dig in a little more and Nmap all those,
the ones of note.
1, 3, and 6.
And we can run an aggressive scan.
It's our network.
And the aggressive scan is not going
to do anything that should break it.
It's just going to show up on all the scans.
Then again, the Nmap scan's probably
going to show up in the IDS and IPS anyways.
This scan might take a little bit longer.
And we're back.
That wasn't too horrible.
The aggressive scan runs a send scan, a service scan,
an operating system identifier, and a traceroute.
And also, some of the default scripts tack as C, if you will.
So-- OK, up here.
There we go.
Port 22.
We can see, it's got a open SSH.
We see that it's the Linux box.
And traceroute puts it one hop away from us via .1.
That one's probably our router or our switch in this case.
Can't come up with anything too crazy.
Our .3, there's another Ubuntu machine.
And we got some more information out of this.
Looks like there's a gate repository from the scans.
And then .6, We've got this FTP server.
And those should be pretty straightforward.
Those should be exactly what we expect.
Now, after looking at these findings,
looking at the network map, an auditor
would say, OK, these all match.
Quality Assurance would say that we have an accurate inventory.
If they don't, then it should either be updated or mitigated
or looked at and worked with.
But that's fairly straightforward,
simple look at asset management.
There are more tools.
There's many more ways of managing a greater enterprise
system.
But the generic, the general way of going about this
is kind of the same for auditing that it is for pen testing.
And it's going to be the same for a lot of your blue-teamers,
who also need to double check and do, maybe, some asset
management on the fly.
A lot of cybersecurity is the same for everyone.
It's just how you're looking at the ball determines what
you're going to do with it.