NIST-RA-5 Vulnerability Monitoring and Scanning

a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1. Enumerating platforms, software flaws, and improper configurations; 2. Formatting checklists and test procedures; and 3. Measuring vulnerability impact; c. Analyze vulnerability scan reports and results from vulnerability monitoring; d. Remediate legitimate vulnerabilities [Assignment: response times] in accordance with an organizational assessment of risk; e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: personnel or roles] to help eliminate similar vulnerabilities in other systems; and f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.

Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers. Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). Vulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation. Organizations may also employ the use of financial incentives (also known as "bug bounties" ) to further encourage external security researchers to report discovered vulnerabilities. Bug bounty programs can be tailored to the organization’s needs. Bounties can be operated indefinitely or over a defined period of time and can be offered to the general public or to a curated group. Organizations may run public and private bounties simultaneously and could choose to offer partially credentialed access to certain participants in order to evaluate security vulnerabilities from privileged vantage points.

• T1011.001 Exfiltration Over Bluetooth • T1021.001 Remote Desktop Protocol • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1046 Network Service Discovery • T1047 Windows Management Instrumentation • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.005 Visual Basic • T1059.007 JavaScript • T1068 Exploitation for Privilege Escalation • T1078 Valid Accounts • T1091 Replication Through Removable Media • T1092 Communication Through Removable Media • T1098.004 SSH Authorized Keys • T1127 Trusted Developer Utilities Proxy Execution • T1127.001 MSBuild • T1127.002 ClickOnce • T1133 External Remote Services • T1137 Office Application Startup • T1137.001 Office Template Macros • T1176 Browser Extensions • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1204.003 Malicious Image • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1218.015 Electron Applications • T1221 Template Injection • T1482 Domain Trust Discovery • T1484 Domain or Tenant Policy Modification • T1505 Server Software Component • T1505.001 SQL Stored Procedures • T1505.002 Transport Agent • T1505.003 Web Shell • T1505.004 IIS Components • T1505.005 Terminal Services DLL • T1525 Implant Internal Image • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1546.002 Screensaver • T1546.014 Emond • T1547.006 Kernel Modules and Extensions • T1547.007 Re-opened Applications • T1547.008 LSASS Driver • T1548 Abuse Elevation Control Mechanism • T1548.002 Bypass User Account Control • T1548.003 Sudo and Sudo Caching • T1548.006 TCC Manipulation • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1552.006 Group Policy Preferences • T1557 Adversary-in-the-Middle • T1558.004 AS-REP Roasting • T1559 Inter-Process Communication • T1559.002 Dynamic Data Exchange • T1560 Archive Collected Data • T1560.001 Archive via Utility • T1562 Impair Defenses • T1562.010 Downgrade Attack • T1563 Remote Service Session Hijacking • T1563.001 SSH Hijacking • T1563.002 RDP Hijacking • T1566 Phishing • T1574 Hijack Execution Flow • T1574.001 DLL Search Order Hijacking • T1574.004 Dylib Hijacking • T1574.005 Executable Installer File Permissions Weakness • T1574.007 Path Interception by PATH Environment Variable • T1574.008 Path Interception by Search Order Hijacking • T1574.009 Path Interception by Unquoted Path • T1574.010 Services File Permissions Weakness • T1578 Modify Cloud Compute Infrastructure • T1578.001 Create Snapshot • T1578.002 Create Cloud Instance • T1578.003 Delete Cloud Instance • T1612 Build Image on Host