Thursday, April 03, 2014

Browse this: & Oryon C Portable & WhiteHat Aviator


Please take a moment as you read this toolsmith to honor those lost in the Oso, WA landslide disaster and those who have lost loved ones, friends, and homes. Pro Civitas et Patria.

Prerequisites/dependencies
Windows for Oryon C Portable
Mac OS X or Windows for WhiteHat Aviator

Introduction
Spring is upon us and with April comes a focus on Security and Cloud Computing in the ISSA Journal and as such a focus on security-centric Chromium-based web browsers in toolsmith. It also freaks me out just a bit to say this but with April also comes the 90th consecutive toolsmith. I sure hope you enjoy reading it as much as I do writing it; it’s been a fabulous seven year plus journey so far.
Those of you who enjoy the benefits of rich web content, fast load times, and flexible browser extensibility have likely tried or use the Chrome browser. What you may not be aware of is that there are other Chromium-based browsers that are built with a bit more attention to privacy than might be expected from Chrome proper.
Full disclosure right up front: as a reminder, I work for Microsoft, and the one thing this article won’t be is any kind of a knock on Google Chrome privacy posture or a browser comparison beyond these two Chromium variants. There are plenty of other battles to fight than one in the Browser Wars. We will however have a usability and features-based discussion on Oryon C Portable, an OSINT-focused browser built on the SRWare Iron version 31.0.1700.0 of Chromium, and WhiteHat Aviator, also Chromium based. Note that Chromium, no matter the variant, includes sandboxing which has obvious security advantages.
Oryon C Portable is a web browser designed to assist researchers in conducting Open Source Intelligence (OSINT) investigations, with more than 70 pre-installed tools, while WhiteHat Aviator describes itself the “best and easiest way to bank, shop, browse, and use social networks while stopping viruses, advertisers, hackers, and cyber-crooks.”
According to Marcin Meller of OSINT Insight, the next version of Oryon C will be named Oryon C OSINT Framework and will be based on their own build of Chromium. They’ve made some changes to the tool sets and information sources. While there will be a few new interesting solutions, they also managed to reduce features that proved to be unnecessary. The browser will be lighter, clearer, and more effective, and the new version will offer a cross-platform support including Windows, Linux, and Mac OS X along with a special edition of Oryon F based on the Mozilla source code, specifically for Firefox enthusiasts. These new releases should appear online sometime this summer at the latest. Marcin says that thanks to great feedback from users, including some excellent OSINT specialists, they are highly motivated to make Oryon an even more solid and powerful tool. The active users are the strength of this project, thus, Marcin invites everyone to share their experiences and support Oryon.   
When I pinged Jeremiah Grossman, now WhiteHat’s CEO, he reminded me that Robert ‘RSnake’ Hansen, VP of WhiteHat labs, leads the Aviator project. Ah, the fond memories of April Fools’ Day past (5 years ago now) and the birth of the Application Security Specialist (ASS) certification. Jeremiah is the master of April Fools’ mayhem. It’s not often that you get the opportunity for a photo opp with both Jeremiah and RSnake, but if you’re wearing your ASS shirt at the BlueHat conference, you just might.

FIGURE 1: Robert, Russ, and Jeremiah: certified
Robert filled me in in the Aviator project: “WhiteHat Aviator started off being a more private and secure browsing option for our own internal users. It has morphed into being a consumer product (Mac and Windows) that has additional and originally unforeseen merits.  For instance, it is significantly faster due to having no ads, and by virtue of making Flash and Java a "click-to-play" option.  Users on GoGo inflight wireless love it, because it makes the web usable over latent connections, not to mention it uses less power on your laptop.  We are giving the browser away for free for now, and all users who download it will be grandfathered in, but in the future we will charge for the browser to ensure that our interests are aligned with the user and to help pay for development without requiring us to steal personal information from our users. ;-)  We will quite possibly be the first browser with tech-support!

Both of the browsers offer the added benefit of enhanced privacy but serve rather different purposes, so let’s explore each for their strengths.

Oryon C Portable

OSINT fans rejoice, there’s a browser dedicated to your cause! Oryon includes more than 70 pre-installed tools, more than 600 links to specialized sources of information and online investigative tools, additional privacy protection features, and a ready-to-use OPML file containing a sorted collection of information sources specific to OSINT, Intelligence, InfoSec, defense, and more. Oryon C Portable is also quite literally…portable. You can run it from all sorts of USB and optical media. I’ll pause for a second so you can take in all the glorious OSINT power at your fingertips as seen in Figure 2.

FIGURE 2: Revel in the OSINT majesty
 You can manage the Oryon C tools from the, yep, you guessed it, the Oryon C tool button. As you do so you’ll see the related button appear on the toolbar and a popup notice that the extension has been enabled. From the same tools button as seen in Figure 3 you can open the full tools menu to create extensions groups and search/sort your extensions.

FIGURE 3: Enable Oryon tool families
There are so many tools to explore with it’s hard to discuss them all but I’ll mention a few of my favorites. Do keep in mind that you may find part of the feature set using Polish as Oryon C is developed by Mediaquest in Poland. The IP Geolocator uses Google Maps and MaxMind to zoom in on the location of IP addresses you enter in the form field. Fresh Start is a cross browser session manager that allows you to save a session and reimport it or recover if it’s crashed. I love Split Screen as it lets you conduct two sessions side by side for comparison. Wappalyzer is a browser extension that uncovers the technology used on websites including content management systems, eCommerce platforms, web servers, JavaScript frameworks, analytics tools and many more. Want to spoof your user-agent? Rhetorical question; yes you do. Make use of the Chrome UA Spoofer. Don’t hesitate to dive into the hyperlinks folders as that represents an entire other level of exploration. The All in one Web Searcher aggregates results from a plethora of search results in one UI as seen in Figure 4.

FIGURE 4: All in one Web Searcher results
Oryon C = playtime for OSINT nerds, and I proudly count myself as one. I literally spent hours experimenting with Oryon and am certain to spend many more similarly. At least I can count it as time towards work. ;-)

WhiteHat Aviator

For Aviator I thought I’d conduct an interesting study, albeit not following optimal scientific standards.
On a Windows 7 virtual machine, I conducted default installations of Aviator and Chrome and made no setting changes. With no other applications running, and no processes generating any network traffic, I executed the following:
Step 1
1)      Started Wireshark
2)      Initiated a capture on the active interface
3)      Started Aviator
4)      Browsed to http://holisticinfosec.blogspot.com
5)      Terminated Aviator
6)      Stopped Wireshark with 5250 frames captured
Step 2
1)      Started Wireshark
2)      Initiated a capture on the active interface
3)      Started Chrome
4)      Browsed to http://holisticinfosec.blogspot.com
5)      Terminated Chrome
6)      Stopped Wireshark with 5250 frames captured
Step 3
1)      Open aviator.pcap in NetworkMiner 1.5 and sorted by Hostname
2)      Open chrome.pcap in NetworkMiner 1.5 and sorted by Hostname 
3)      Compared results

The results were revealing to be sure.

I’m glad to share the captures for your own comparisons; just ping me via email or Twitter if you’d like copies. Notice in Figure 5 the significant differences between counts specific to hosts, files, images, credentials, sessions, DNS, and Parameters.

FIGURE 5: Comparing the differences between Aviator and Chrome browser session network traffic
Aviator is significantly less chatty than Chrome.
Supporting statistics as derived from results seen in Figure 5:
120% less host contact in Aviator capture vs. Chrome capture
69% less file interaction (download of certs, gifs, etc.) in Aviator capture vs. Chrome capture
86% fewer images presented (ads) in Aviator capture vs. Chrome capture
63% fewer total sessions in the Aviator capture vs. the Chrome capture
69% fewer DNS lookups in the Aviator capture vs. the Chrome capture
Hopefully you get the point. :-)

These differences between default configurations of Aviator and Chrome are achieved as follows:

  • Aviator's privacy and security safeguards are preconfigured, active and enabled by default
  • Aviator eliminates hidden tracking and uses the Disconnect extension to block privacy-destroying tracking from advertisers and social media companies
  • WhiteHat is not partnering with advertisers or selling click data
  • Unwanted access is prevented as Aviator blocks internal address space to prevent malicious Web pages from hitting your websites, routers, and firewalls

It’s reasonable to ascertain that those with an affinity for strong default privacy settings will favor WhiteHat Aviator given the data noted in Figure 5 and settings provided out of the gate.

In Conclusion

These are a couple of fabulous browsers for your OSINT and privacy/security pleasure. They’re so easy to install and use (I didn’t even include an installation section, no need) that I strongly recommend that you do so immediately.
Take note, readers! July’s ISSA Journal will be entirely focused on the Practical Use of InfoSec Tools. Rather than put up what is usually just me going on about infosec tools, you should too! Send articles or abstracts to editor at issa dot org.
Ping me via email if you have questions or suggestions for topic via russ at holisticinfosec dot org or hit me on Twitter @holisticinfosec.
Cheers…until next month.

Acknowledgements

Marcin Meller, OSINT Insight
Robert ‘RSnake’ Hansen, VP WhiteHat Labs, Advanced Technology Group

Sunday, March 02, 2014

toolsmith: SpiderFoot



Prerequisites/dependencies
Python 2.7 if running on *nix as well as M2Crypto, CherryPy, netaddr, dnspython, and Mako modules
Windows version comes as a pre-packaged executable, no dependencies

Introduction
All good penetration tests and threat assessments should be initiated with what you’ve seen referred to in toolsmith as OSINT, or open source intelligence gathering. This practice contributes greatly to collecting a useful list of targets of opportunity. One key element to remember though, the bad guys are conducting this same activity against you and your Internet-facing assets too. It’s probably best then that you develop your own OSINT practice so you can find the information you may not wish to, or even know, you are exposing. Steve Micallef’s SpiderFoot is another tool in the arsenal specific to this cause. You may already be aware that the four phases of a web application security assessment, as defined using the SamuraiWTF distribution, are recon, mapping, discovery, and exploitation. The SANS GIAC Certified Web Application Penetration Tester (GWAPT) curriculum follows suit given that Secure Idea’s Kevin Johnson contributed heavily (developed) to both. SpiderFoot nicely blends both recon and mapping as part of its feature set. As we consider legal, privacy, and ethics issues for the March ISSA Journal, OSINT and reconnaissance become interesting and related topics. I have, on more than one occasion, discovered very damaging data via OSINT tactics that, if in the wrong hands, could have been very damaging. When you consider findings of this nature with regard to ethics and the legality you may find yourself in an immediate quandary. Are you obligated to report findings that you know could cause harm to the target if left unmitigated? What if during your analysis you come into possession of classified or proprietary information that having in your possession could create legal challenges for you? Imagine findings of this caliber and it becomes easy to recognize why you should always conduct intelligence gathering and footprinting on your own interests before the wrong people do it for you. SpiderFoot, as a tool for just such purposes, allows you to understand “as much as possible about a given target in order to perform a more complete security penetration test.” For large networks, this can be a daunting task, and SpiderFoot automates this process significantly, allowing penetration testers to focus their efforts on security testing itself.
Steve provided us with some SpiderFoot history as well as insight on what he finds useful and interesting. He originally wrote SpiderFoot as a C# .NET application in 2005, purely as an exercise to learn C#, having been inspired by BiDiBLAH’s developers from Sensepost (who went on to create Maltego), thinking he could make a lighter open source version. For seven years that was Steve’s first and only release until he decided to resume development again in 2012. His work on next generation versions have led SpiderFoot to be cross platform (Python), far more extensible, functional, with a much nicer user interface (UI).
Steve’s current challenge with SpiderFoot is deciding what cool functionality to implement next, his to-do list is ever growing and there are a numerous features he’d love to extend it to include. He typically balances his time between UI/analysis functionality versus new checks to identify more items to aid the penetration tester. The aforementioned OSINT (Open Source Intelligence) community also continues to produce new sources which in turn inspire Steve to build new SpiderFoot checks.
He finds it interesting testing out a new module, and actually finding insightful items out there on the Internet simply during the development process. Steve’s favorite functionality at the moment is identifying owned netblocks, and co-hosted sites. Owned Netblocks indicates entire IP ranges that an organization owns, which enables penetration testers to more completely scan the perimeter of a target. Co-hosted Sites shows you any websites on the same server as the target, which can also be revealing. If your target is hosted on the same server as sites identified as being malicious by the malicious site checker, or the blacklist checker plug-in it could potentially indicate that your target is hosted on a compromised server.
As you read this it’s likely that the following planned enhancements are available in SpiderFoot or will be soon:
·         2.1.2 (early March)
o   SOCKS proxy support
o   Real-time scan progress viewer
o   Identify scan quality impacting issue
o   Autoshun (www.autoshun.org) lookup as part of malicious checks
o   SANS (isc.sans.edu) lookup as part of malicious checks (queue the Austin Powers voice: “Yeah, baby!”)
o   Update GeoIP checker
·         2.1.3 (mid April)
o   VirusTotal, SHODAN, Facebook, Xing, Pastebin and GitHub plug-ins
Note that when you pull SpiderFoot from GitHub, you are downloading a beta version of the next release, as Steve commits new functionality there periodically in preparation for the next version. For instance, SOCKS functionality is in the GitHub repository right now but not in the packaged released version (2.1.1.).
SpiderFoot is a great project with a strong development roadmap, so let’s get down to business and explore.

Quick installation notes

Windows installation is an absolute no brainer; download the package, unpack it, execute sf.exe, and browse to http://127.0.0.1:5001. All dependencies are met including a standalone Python interpreter, so you may find this option optimal.
Linux (I installed it on SamuraiWTF) users need to settle a few dependencies easily solved with the following few steps that assume pip is already installed:
sudo apt-get install swig
sudo pip install mako cherrypy netaddr M2Crypto dnspython
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot/
sudo python ./sf.py 0.0.0.0:9999
The last line indicates that you’d like SpiderFoot to bind to all addresses (including localhost) and listen on port 9999. You can define your preferred port or just accept default if undefined (5001). Steve reminds us on his installation page to be cautious regarding exposing SpiderFoot to hostile networks (Intranet, security conference wireless) given that there is currently no authentication scheme.

SpiderFoot unleashed

The SpiderFoot UI is, how shall I say, incredibly simple, intuitive, and obvious even. To start a scan…wait for it…select New Scan. Figure 1 represents a scan being kicked off on my domain (don’t do it) as defined by the By Module view.

FIGURE 1: Kicking off a new scan with SpiderFoot
If you wish to more granularly define your scans, select the By Required Data view (default) then pick and choose your preferred data points including elements such as malicious affiliations, IP data, URL analysis, SSL certificate information, affiliate details, and many other record. You should then be treated to a success message. Scans results are stored in a SQLite DB so over time you’ll likely build up a collection if you don’t purge. Under the Scans tab as seen in Figure 2 you can click the scan in the Name column of the table view and review results. You’ll also note status here and can also halt the scan if need be. I imagine the real-time scan progress viewer will show itself here in the near future as well.

FIGURE 2: SpiderFoot Scans view
If need be (default settings work quite well), you can tune the actual scan configuration as well via Settings, with attention to how you’d like to tune storage, search engines, port scanning, spidering, TLD searches (see Figure 3), amongst others.

FIGURE 3: SpiderFoot Settings view
When my scan completed, with default settings and all checks enabled, the results included 11360 elements. For you data miners, metrics minions, and hosting harvesters, you can export the results to CSV (see Figure 4) and filter by findings type and module, or your preferred data pivot.

FIGURE 4: SpiderFoot results and export functionality
As I navigated all the results, I was intrigued to find a hit for URL (Uses Flash) simply because I didn’t recall any Flash features on my site. I immediately chuckled when I reviewed the result as it was specific to a Flash video I’d created for the 2008 ISSA Northwest Regional Conference wherein I ripped on the now defunct Hacker Safe trustmark for indicating that their customer’s sites were “hacker safe” when, in fact, they were not. Oh, the good old days.
Want to visualize your results? No problem, you can choose from a bubble view of data elements or the discovery path. Figure 5 represents the discovery path for Social Media Presence findings. Hover over each entity for details specific to initial target type, the source module, and the related result.

FIGURE 5: SpiderFoot visualizes a discovery path
SpiderFoot will absolutely uncover nuggets you may have long forgotten about and may want to remove as they are potentially vulnerable (outdated plugins, modules, etc.) or unnecessarily/unintentionally exposed. I found an old dashboard I’d built by hand eons ago with long dead extenal JavaScript calls that had no business still being available. “Be gone!”, I said. That is what SpiderFoot is all about. Add it to the tool collection for penetration tests and OSINT expeditions; you won’t be disappointed.

In Conclusion

Steve Micallef’s SpiderFoot is functionally simple but feature rich and getting better all the time as it is well built and maintained. Follow @binarypool on Twitter and keep an eye out for timely and regular releases.
Ping me via email if you have questions or suggestions for topic via russ at holisticinfosec dot org or hit me on Twitter @holisticinfosec.
Cheers…until next month.

Acknowledgements

Steve Micallef (@binarypool), Spiderfoot author

Monday, February 03, 2014

toolsmith: SimpleRisk - Enterprise Risk Management Simplified



Prerequisites/dependencies
LAMP/XAMPP server

Introduction
Our editorial theme for February’s ISSA Journal happens to be Risk, Threats, and Vulnerabilities which means that Josh Sokol’s SimpleRisk as our toolsmith topic is bona fide kismet. I am a major advocate for simplicity and as the occasional practitioner of simpleton arts, SimpleRisk fits my needs perfectly. SimpleRisk is a free and open source web application, released under Mozilla Public License 2.0, and is extremely useful in performing risk management activities. In my new role at Microsoft, I’m building, with a fine team of engineers, a Threat Intelligence and Engineering practice. This effort is intended to be much more robust than what you may currently understand to be Threat Intelligence. Limiting such activity to monitoring threat feeds, deriving indicators of compromise, and reporting out findings is insufficient to cover the vast realm of risk, threats, and vulnerabilities. As such, we include constant threat assessments of our infrastructure and services in a manner that includes risk analysis and threat modeling, based on SDL principles and the infrastructure threat modeling guidance I wrote some years ago. Keeping in mind that threat modeling can be software-centric, asset-centric, and attacker-centric, recognize that the amount of data you generate can be overwhelming. In addition to embracing the principles of good data science, we’ve also expanded our tooling to include the likes of SimpleRisk. I asked Josh to provide us with insight on SimpleRisk in his own words:
As security professionals, almost every action we take comes down to making a risk-based decision.  Web application vulnerabilities, malware infections, physical vulnerabilities, and much more all boil down to some combination of the likelihood of an event happening and the impact of that event.  Risk management is a relatively simple concept to grasp, but the place where many practitioners fall down is in the tool set.  The lucky security professionals work for companies who can afford expensive GRC tools to aide in managing risk.  The unlucky majority out there usually end up spending countless hours managing risk via spreadsheets.  It's cumbersome, time consuming, and just plain sucks.  After starting a Risk Management program from scratch at a $1B a year company, I ran into these same barriers, and when budget wouldn't allow me the GRC route, I finally decided to do something about it.  At Black Hat and BSides Las Vegas 2013, I formally debuted SimpleRisk. A SimpleRisk instance can be stood up in minutes and instantly provides the security professional with the ability to submit risks, plan mitigations, facilitate management reviews, prioritize for project planning, and track regular reviews.  It is highly configurable and includes dynamic reporting and the ability to tweak risk formulas on the fly.  It is under active development with new features being added all the time and can be downloaded at http://www.simplerisk.org.  SimpleRisk is truly Enterprise Risk Management simplified.
I can tell you with certainty that a combination of tactics, techniques, and procedures inclusive of threat modeling and analysis, good data science (read The Field Guide to Data Science), and risk management with the likes of SimpleRisk, will lead to an improved security posture. I’ll walk you through a recreation of various real world scenarios and current events using SimpleRisk after some quick installation pointers.

Quick installation notes

I run SimpleRisk on an Ubuntu 13.10 virtual machine configured with a full LAMP stack. Without question you should read the SimpleRisk LAMP Installation Guide, but I’ll give you a quick overview of my installation steps, establishing SimpleRisk as the primary application in the Apache web root:
1)      cd /var/www
2)      Download the latest installation bundle, currently (subject to change): sudo wget http://simplerisk.googlecode.com/files/simplerisk-20131231-001.tgz
3)      sudo tar zxvf simplerisk-20131231-001.tgz
4)      sudo mv simplerisk/ * . (moves all SimpleRisk app files to the web root)
5)      sudo rm simplerisk-20131231-001.tgz (removes the installation bundle)
6)      sudo rm simplerisk (removes the now empty simplerisk directory)
7)      cd ~
8)      Download the SimpleRisk database import: wget http://simplerisk.googlecode.com/files/simplerisk-20131231-001.sql
9)      mysql –u root -p
10)   create database simplerisk;
11)   use simplerisk;
12)   source ~/simplerisk-20131231-001.sql (populates the SimpleRisk database)
13)   GRANT SELECT, INSERT, UPDATE, DELETE ON simplerisk.* TO 'simplerisk'@'localhost' IDENTIFIED BY 'CHANGEME'; (creates the SimpleRisk database user, change CHANGEME to your preferred password)
14)   exit
15)   sudo gedit /var/www/includes/config.php
16)   Edit line 16 with the database password you set in step 13 (you can also change your timezone in config.php)
17)   Browse to your web server’s root and login as admin with password admin
18)   Click the Admin button in the upper right of the UI then click My Profile
19)   Change the admin password!

SimpleRisk and the Flintstones

Flintstone, Inc. a prehistoric cave retailer with a strong online presence has been hacked by the Bedrock Electronic Militia. In one breach, 40 million clams have been stolen, and soon thereafter it is revealed that 70 million additional clams are compromised. Additionally, the attackers have used social engineering to gain access to Flintstone.net social media accounts, including Critter and Cavebook, as well as the Flintstone, Inc. blog. Even the Bedrock news media outlet, Cave News Network, is not immune to Bedrock Electronic Militia’s attacks. Fred and Wilma, the CISO and CEO, are very concerned that their next PCI audit is going to be very difficult given the breach and they want to use SimpleRisk to track and manage the risks they need to mitigate, as well as the related projects necessary to fulfill the mitigations. The SimpleRisk admin has created two accounts for Fred and Wilma; they’re impressed with the fact that the User Management options under Configure are so granular specific to User Responsibilities, including the ability to Submit New Risks, Modify Existing Risks, Close Risks, Plan Mitigations, Review Low Risks, Review Medium Risks, Review High Risks, and Allow Access to "Configure" Menu. Fred and Wilma are also quite happy that the SimpleRisk user interface is so…simple. Fred first uses the Configure | Add and Remove Values menu to add Online and Retail Stores as Site/Location values given the variety and location of risks identified. He also adds Identity Management under Team, as well as POS and Proxy under Technology. Fred notes that the Configure menu also offers significant flexibility in establishing risk formula preferences, review (high, medium, low) settings, and the ability to redefine naming conventions for impact, likelihood, and mitigation effort. He and Wilma then immediately proceed to the Risk Management menu to, you guessed it, begin to manage risks exposed during the breach root cause analysis and after action report. To get started the Flintstones immediately identify five risks to document:
1)      Account compromise via social engineering
a.       The Flintstone.net Critter and Cavebook accounts were compromised when one of their social media management personnel were spear phished
2)      Inadequate antimalware detection
a.       One of the spear phishing emails included a malicious attachment that was not detected by Dinosoft Security Essentials
3)      Flintstone, Inc. users compromised via watering hole attacks
a.       A lack of egress traffic analysis, detection, and prevention from Flintstone.net corporate networks meant that users were compromised when enticed to visit a known good website that had been compromised with the Blackrock Exploit Kit
4)      Flintstone.com web application vulnerable to cross-site scripting (XSS)  
a.       Attackers can use XSS vulnerabilities to deliver malicious payloads in a more trusted manner given that they execute in the context of the vulnerable site
5)      Flintstone, Inc. Point Of Sale (POS) compromised with Frack POS malware
a.       All POS devices must be scanned with the SecureSlate’s Frack POS Malware Scan

As seen in Figure 1, Fred can be very specific in his risk documentation.

FIGURE 1: Fred submits risk for SimpleRisk documentation
As Fred works on the watering hole risk, he decides he’d rather use CVSS risk scoring than classic and is overjoyed to discover that SimpleRisk includes a CVSS calculator as seen in Figure 2. There is also an OWASP calculator the Fred uses when populating the XSS risk and a DREAD calculator he uses for the POS risk.

FIGURE 2: Fred calculates a CVSS score with SimpleRisk CVSS calculator
When Fred and Wilma move to the Plan Your Mitigations phase they are a bit taken aback to find that SimpleRisk has stack ranked the XSS risk as the highest, as seen in Figure 3, but they recognize that risk calculations can be somewhat subjective and that each scoring calculator (CVSS, DREAD, OWASP) derives scores differently. SimpleRisk does include links to references for how each is calculated.

FIGURE 3: SimpleRisk risk ranking allows mitigation prioritization
Fred and Wilma believe that the XSS vulnerability happens to be one they can have mitigated rather quickly and at a low cost, so they choose to focus there first. Clicking No under Mitigation Planned for ID 1004 leads them to the Submit Risk Mitigation page. They submit their planned mitigation as seen in Figure 4.

FIGURE 4: SimpleRisk XSS mitigations submittal
After SimpleRisk accepts the mitigation Fred and Wilma are sent promptly to the Perform Management Reviews phase where they choose to review ID 1001 Account Compromised via social engineering by clicking No in the related row under the Management Review column. Under Submit Management Review they choose to Approve Risk (versus reject), Consider for Project as the Next Step and add Deploy two factor authentication under Comments.
Under Prioritize for Project Planning, Fred and Wilma then add a new project called Two Factor Authentication Deployment. They can add other projects and prioritize them later. They also set a schedule to review risks regularly after planning mitigations for, and a conducting reviews of, their remaining risks.
As the CISO and CEO of Flintstone, Inc., Fred and Wilma love their executive dashboards. They check the SimpleRisk Risk Dashboard under Reporting, as seen in Figure 5.

FIGURE 5: SimpleRisk Risk Dashboard
They also really appreciate that SimpleRisk maintains an audit trail for all changes and updates made.
Finally, Fred and Wilma decide to take advantage of some SimpleRisk “extras” that cost a bit but are offered under a perpetual license:
·         Custom Authentication Extra: Currently provides support for Active Directory Authentication and Duo Security multi-factor authentication, but will have other custom authentication types in the future.
·         Team Based Separation Extra: Restriction of risk viewing to team members the risk is categorized as.
·         Notification Extra: Email notifications when risks are updated or due for action.
·         Encrypted Database Extra: Encryption of sensitive text fields in the database.

In Conclusion

Josh has devised a great platform in SimpleRisk; I’m really glad to have caught mention of it rolling by in Twitter reads. It fits really nicely in any threat/risk management program. On a related note, as I write this Adam Shostack’s new book, ThreatModeling: Designing for Security is nearing its publication date (17 FEB 2014, Wiley). Be sure to grab a copy and incorporate its guidance into your risk, threat and vulnerability management practice along with the use of SimpleRisk.
Ping me via email if you have questions or suggestions for topic via russ at holisticinfosec dot org or hit me on Twitter @holisticinfosec.
Cheers…until next month.

Acknowledgements

Josh Sokol, SimpleRisk developer and project lead