In the wake of recent incidents which led to security
breaches, it has been ascertained that the company develops a security
assessment plan. It is noted that these anomalies have not shown signs of being
correlated and hence it is not yet discovered whether they emanate from a
single source or from multiple sources. However, some of these anomalies led to
the crashing of three of the corporate databases as well as unauthorized
changes in the network system configuration.
In order to navigate the
management through the actual state of the company security posture, this
report will elaborate on the various Operating Systems (OS) embraced within the
company’s information system as well as their vulnerabilities. Further, the
report will weight on the significance of network vulnerability scanning with
their necessary assessment tools for OS and Applications. Lastly, the report
will give recommendations on how to tackle effectively current and potential security
The OS is the system software
which manages computer software and hardware resources while providing common
services for computer programs
(Egele et al, 2012). In a computer network such as the one used at
the company in the oil and natural gas sector, there are different computing
devices as well as network nodes which help in ensuring security, connectivity,
communication as well as storage of information for the whole company. As such,
the following diagram shows the basic functioning of an OS and the aspects it
controls (applications, kernel, CPU, memory and device operations) (Fox et al, 2003).
From the analysis of the company
network architecture, it is shown that the main operating systems in place are
Windows and Linux operating systems. Furthermore, it is expected that various
network nodes will have different embedded operating systems as well. Note that
embedded systems are specialized OS for dedicated use for larger mechanical and
electrical systems; this OS is actually involved in the different mechanisms which
help control company’s drilling and filtration equipment.
Moreover, it is vital to check
on the system architecture along with company business policies and procedures which
define the structure of the network as well as how systems components should interact
with each other and also with the users (Fox
et al, 2003). The company’s system components include both physical and
virtual aspects. The physical parts encompass tangible devices such as
computers, cables, routers, switches, bridges, printers, servers and other
relevant devices. The virtual part of the network involves intangible aspects from
cloud computing whereby operations and storage of data are based on resources
accessed over the internet.
Lastly, it is vital to pinpoint
the relationship of the company information system with its OS as a whole, as users
are prone to use various parts of the network components through making
business decision for operational excellence as well as competitive advantage, customer
and supply privacy and for business day-to-day survival (Garfinkel & Rosenblum, 2003).
Therefore, configuring the network to carry out company daily
operations will involve putting in place a system that set employees privilege and
right access to systems with respect to their authorizations and
After ascertaining that the information
system as well as the OS are the backbones of the computer network, the next
step involves checking the vulnerabilities encompassed by the OS and network.
Some of the vulnerabilities experienced in the company’s network include the
Windows vulnerabilities – these
are the vulnerabilities exposed to the devices which operate on Windows OS.
These vulnerabilities include file sharing permissions which can be exploited
by attackers who interject files or simply search for certain public shared
information and hence lead to identity thefts or eavesdropping (Egele et al, 2012). Lack
of personal firewall protection is yet another vulnerability encompassed by the
windows environment. Personal firewalls can help in blocking malware intrusions
as well as the common wireless intrusions which are used by external attackers
to access systems remotely. Lastly, weak or nonexistent drive encryption is yet
another vulnerability that is experienced in windows environment. Lack of
whole-disk encryption is one of the main issues which can make the whole system
to be vulnerable to various cyber-attacks.
Linux vulnerabilities –
contrary to popular beliefs, the Linux OS has security risks which can lead to
malicious attacks to the whole network if not checked well. As such,
administrators should carry out vulnerability testing. The first vulnerability
includes lack of patch management for Linux OS. In this case, studies have
shown that organizations have patching systems and methodologies for Windows OS
but often overlook the OS. For example, the Linux OS lacks the 2003:138-08
patch for Samba which fixes vulnerabilities exploited by the Metasploit tool (Egele et al, 2012). The
second vulnerability is outdated third-party applications which is facilitated
by running of outdated software such as PHP, Apache, OpenSSL and MySQL. This
outdated software creates footprints which can be exploited with malicious
intents leading to unauthorized system access.
Mac OS vulnerabilities – The
Mac OS used in various components in the network can expose it various attacks.
There are two vulnerabilities which have been associated with the Mac OS which
are Spectre and Meltdown. Spectre encompass two exploitation techniques which
are branch target injection or CVE-2017-5715 and bounds check bypass or
CVE-2017-5753. These vulnerabilities make items in kernel memory to be
available to users hence making these items to be intercepted by attackers.
Meltdown on the other hand include an exploitation technique which is called
the rogue data cache load or CVE-2017-5754. This technique enables a user
process to access kernel memory which is the most potential that is usually
exploited by users.
SQL PL/SQL, XML and other
injections – PL/SQL is vulnerable to SQL injection attacks. This is an attack
which encompasses insertion of a SQL query to a client’s input data to the
application. A successful SQL injection attack can lead to reading of sensitive
information from a database or modify database information. These attacks
encompass SQL commands being interjected in data plane input so as to execute
predefined SQL commands. These are vulnerabilities which could be used by
attackers in accessing information from the company’s database.
After identifying weaknesses in
the system, it is imperative to run vulnerability scans in highlighting which areas
are being exploited by attackers, and which areas are susceptible for further abuses
so as to come up with methodologies to mitigate and eliminate such
exploitations (Fox et
al, 2003). A vulnerability scanner is a program or a software designed
to assess computer systems and networks in detecting and classifying network weaknesses
and hence predict the effectiveness of projected countermeasures. For example, the
vulnerability scanner OpenVAS which runs on Linux OS was used in checking
efficiently for vulnerabilities in the network. This tool provides full service
daemon, user management and feed management (Garfinkel
& Rosenblum, 2003). The second tool used in the vulnerability scanning
is the Retina Network Community which offers vulnerability scanning services as
well as patching for Windows and its third party applications. Lastly,
Microsoft Baseline Security Analyzer (MBSA) was used in contacting both remote
and local scans on windows computers and servers to identify any missing
services packs, security misconfigurations and security patches (Verdon & McGraw, 2004). These
free tools are straightforward and easy to work with accordingly.
Assessment Tools for OS and Applications
After carrying out a comprehensive
vulnerability scan with the aid of free tools, it is ascertained that the company
information system with many uncertainties is possibly subjected to serious exposures
that might get exploited by attackers. With Windows administrative vulnerabilities
present and privileges escalated due to illegal access, attackers were able to
intrude the network easily. Moreover, this vulnerability is easily shown by the
Microsoft Baseline Security Analyzer (MBSA) which effectively showed which
computers nodes had been used to access the network configuration. As such, the
windows based vulnerabilities to work on, are the ones arising from file
sharing permissions and lack of personal firewall protection. In alleviating these
issues, file sharing should be monitored so to make files accessible to limited
known individuals. Moreover, personal firewalls should be installed to filter
out and restrict access to malware which can be used as backdoors for remote
access to the network by attackers.
Linux vulnerabilities on the
other hand were ascertained through the use of OpenVAS which offers dynamic
assess of missing security updates. Just like in the Windows environment, they
are pertinent vulnerabilities which were exploited by attackers in gaining
access to the network. The main issues with the Linux systems encompass the use
of outdated third party applications and lack of patch management for Linux OS.
These vulnerabilities provide a fertile ground through which cyber attackers
eavesdrop on the network, intercept communication and hence access information
leading to the compromising of the whole network (Verdon & McGraw, 2004). As such, the third
applications should be updated to prevent further attacks. Also, it is
recommended that effective patch management is implemented effectively.
It is then imperative to keep an
active focus on system scanning as to check whether there are any arising
attacks. Also, contemporary attacks are dynamic in nature hence the scanning
should be comprehensive in nature and should cover every facet of the network.
This approach ensures that the company is alerted at all times for cyber-attacks
and hence organize its response teams to effectively thwart and eradicate any
Data gathered from the scanning
Linux OS with outdated third party applications and mismanaged patches.
windows computers lacked personal firewall protection and the file sharing
system was accessible.
44 Windows computers had faulty patch management.
From the above expostulation on
the company’s security posture as well as the analysis of the vulnerability
scans, it can be ascertained that the company’s computer system as well as its
network is at great risk of being compromised by attacks. It is well understood
that the network’s security has already been compromised hence leading to the
unauthorized configuring of the network as well as the crushing of the database
servers. The major aspects of the network and computer system which were
compromised by being faulty, were mainly the operating systems. From the
analysis, it can be shown that windows and Linux OS encompassed in the network,
have been contributing heavily to the ongoing attacks. And through the free
tools we used with respect to OpenVAS and MBSA, it has been possible to check
the areas that have been vulnerable to attacks. As such, it is recommended that
such areas be addressed effectively and immediately in closing all avenues and loopholes
in the compromise. And since the vulnerability tools used in accessing the
exploits are reliable by being practical to predict the effectiveness of counterattack
measures, it is then prudent to lay out strategies in helping block future
It is then prudent to note that
proactive risk management is the best methodology of protecting against risks.
As such, it is recommended that the IT administrators carry out continuous and
aggressive system scanning in attempts to stay alert to cyber-attacks. In doing
so, the security experts including the engineers and analysts will have to relentlessly
brainstorm on new avenues that can be subjugated by attackers and hence tackle those
issues proactively and meticulously.
The above security assessment has
been developed in addressing the company network security postures accordingly.
As such, it can be ascertained that the major areas which are exploited by
attackers are the different OS vulnerabilities used by the numerous network devices.
In the end, eliminating the existing risks and addressing future
vulnerabilities effectively will go a long way in ensuring that the company is
safe through identifying and assessing hazards, evaluate and monitor them efficiently,
and implement a stringent risk plan for potential attacks