Auditing with the Critical Security Controls in Washington State

Transcription

1 Auditing with the Critical Security Controls in Washington State 2017 NSAA IT Conference and Workshop October 6, 2017 Joe Clark Performance Auditor Sunia Laulile IT Security Specialist Michael Hjermstad Assistant Audit Manager O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r What we will cover today Impact of our IT security audits Audit program and tools we use Lessons learned O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 2

2 What we do and why IT security audits are important to: Identify security gaps in state and local government IT systems Offer remedies and strategies to improve IT security through our recommendations The goal: To help governments better serve Washingtonians and protect the data they hold O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 3 A sample of audit findings reveals serious problems Procedural deficiencies Lack of policies and procedures Broken vulnerability and patch management processes Incomplete visibility into networks Technical vulnerabilities Missing patches Misconfigured devices O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 4

3 Agency reactions demonstrate audit value Remediate vulnerabilities as quickly as possible Correct procedural deficiencies Prioritize security Agencies request audits O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 5 Building expertise within our Office Auditors Lead and conduct audits Communicate with auditees Develop findings and recommendations Technical support Solicit feedback and clarification IT security specialists Review/validate findings Help craft findings and recommendations Knowledge transfer to auditors and auditees O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 6

4 Audits scoped in two parts Penetration testing Critical Security Controls assessment Interviews Validation Core testing O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 7 Critical Security Control assessment Critical Security Controls (CSCs) Prioritized list of security measures, focused on value Endorsed by public and private organizations Surveyed WA state agencies prefer CSCs over NIST O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 8

5 The CSCs we use 1. Inventory of authorized and unauthorized devices 2. Inventory of authorized and unauthorized software 3. Secure configurations for hardware and software 4. Continuous vulnerability assessment and remediation 5. Controlled use of administrative privileges 11. Secure configurations for network devices O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 9 CSC audit program Measurable sub-controls to implement each CSC Developed procedures using AuditScripts criteria, examining four topic areas: Policy Implementation Automation/Technical enforcement Reporting O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 10

6 CSC assessment procedures Interviews Assessment sheets sent to auditee in advance Participants may include: CIO CISO IT staff Allocate about three hours to review each control O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 11 CSC assessment procedures Validation Technical validation includes: Observations Screenshots Assessment with tools Level of evidence depends on risk and significance Goal: Conduct all interviews and validation in one week O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 12

7 Validation tools in our toolbox Tenable Nessus AdAssetInventory.PS1 Lynis O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 13 Validation tool: Nessus Name: Tenable Nessus Paid license required Purpose: Identify vulnerabilities Perform security benchmark tests Assess maturity level of patch and vulnerability management O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 14

8 Validation tool: Nessus O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 15 Validation tool: Nessus Output review Review security groups Identify critical vulnerabilities Assess system configuration Value Can identify configuration and software weaknesses Assesses many types of systems O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 16

9 Validation tool: AD Asset Inventory Name: AdAssetInventory.PS1 Cost: Free Purpose: Identify membership in default privilege groups Verify accounts follow security standards (such as password requirements) O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 17 Validation tool: AD Asset Inventory O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 18

10 Validation tool: AD Asset Inventory O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 19 Validation tool: AD Asset Inventory Output review Review security group membership Is least privilege being followed? Are standards being followed? Value Provides heat map of accounts of interest Generates both HTML and Excel outputs of reports Can be run with user-level permissions O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 20

11 Validation tool: Lynis Name: Lynis Cost: Free Purpose: Gain situational awareness on Linux/Unix systems Assess whether system follows known best practices O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 21 Validation tool: Lynis O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 22

12 Validation tool: Lynis HRDN-7230 Harden the system by installing at least one malware scanner, to perform periodic file system scans O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 23 Validation tool: Lynis Output review Review warnings and suggestions provided by tool Patch levels and configurations Value Assess Linux/Unix systems With another tool, generate PDF or HTML for easier viewing O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 24

13 CSC assessment procedures Core testing Core evaluation testing Effectiveness test for each CSC Demonstrates importance of CSC Mostly technical/hands-on Minimize risk to and impact on organization Conduct in one week Follow Rules of Engagement O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 25 Audit results Overview Deliverable Critical Security Control assessment sheets AuditScripts spreadsheet Critical Security Control results document Audience IT management, technical staff Executives, IT management, technical staff Executives, IT management O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 26

14 Audit results CSC Assessment Sheets Result of interviews and testing Used to document and aggregate evidence Specific, detailed results Intended for technical staff Conclusions feed into AuditScripts spreadsheet O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 27 Audit results AuditScripts spreadsheet Includes dashboard with charts/graphs Intended for agency technical staff and mid-level management Customized by our auditors O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 28

15 AuditScripts dashboard O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 29 AuditScripts dashboard O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 30

16 AuditScripts dashboard O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 31 AuditScripts dashboard O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 32

17 AuditScripts CSC 1 Tab O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 33 AuditScripts CSC 1 Tab O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 34

18 AuditScripts CSC 1 Tab O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 35 AuditScripts CSC 1 Tab O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 36

19 AuditScripts CSC 1 Tab O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 37 AuditScripts CSC 1 Tab O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 38

20 Audit results Critical Security Controls Results in brief Overall results Detailed results section Explains why each control is important What we found Our recommendations O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 39 CSC Results In Brief Maturity Rating Implementation by Control O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 40

21 CSC Results Control Introduction Control description Does the organization have and maintain an inventory of all the devices that are connected to its network? Why this control is important O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 41 CSC Results What the audit found What the audit found Alignment percentage Implementation description Areas of strength Areas for improvement Test results Reasons not fully implemented O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 42

22 CSC Results Recommendations General recommendations Covers all of the sub-controls Specific recommendations Unique to the government Resource aware Provides prioritization O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 43 Public reporting and confidentiality Information largely protected under state law RCW (4) Public audit reports published with limited details Present high-level results to governing stakeholders Joint Legislative Audit and Review Committee for state audits Council, board or executive for local audits O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 44

23 Lessons learned Start interviews with Implementation question Core evaluation tests will be optional Clearly communicate audit expectations to auditee O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 45 References AuditScripts spreadsheet: Center of Internet Security Critical security controls: Additional tools listed on slides State Auditor s Office website: O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 46

24 Questions? O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 47 Contacts Joseph Clark Performance Auditor (360) Joseph.Clark@sao.wa.gov Pat McCarthy State Auditor (360) Pat.McCarthy@sao.wa.gov Chuck Pfeil, CPA Director of Performance Audit (360) Chuck.Pfeil@sao.wa.gov Michael Hjermstad Assistant Audit Manager (253) Michael.Hjermstad@sao.wa.gov Sunia Laulile IT Security Specialist (360) Sunia.Laulile@sao.wa.gov O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 48

25 Tools used in our audits Nessus: Gain awareness of patch levels Check systems against known benchmarks Gain awareness of privileged accounts Lynis: Free audit tool for Linux, Unix, and Apple systems. AdAssetInventory.PS1: Active-Directory-Audit-7754a877 PowerShell script that identifies privileged accounts in AD and provides insight O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 49 More tools used in our audits NetBrain: Maps networks for situational awareness Generates network diagram Assists in configuration review Nipper: Networking auditing tool CIS-CAT: Center of Internet Security tool for checking CIS benchmarks O f f i c e o f t h e W a s h i n g t o n S t a t e A u d i t o r 50