Please read the instructions

VM Scanner Evaluation Background Report

Prudence Kao

CMIT 421 <Section #6981> Threat Management and Vulnerability Assessment

07/16/2024

VM Scanner Evaluation Background Report

This report analyzes the Nessus vulnerability scan results for Mercury USA, a transportation company. The objective is to evaluate the organization's security posture by detailing the critical vulnerabilities detected and providing recommendations for remediation. A feasibility estimate for acquiring the Nessus commercial vulnerability scanner for ongoing security management will also be presented. The report will include an interpretation of the Nessus findings, a business case for security improvements, and a recommendation on adopting Nessus for further vulnerability management. Despite its cost and technological complexity, Investing in Nessus is essential for Mercury USA to enhance its information security framework, minimize critical vulnerabilities, ensure regulatory compliance, and maintain customer trust in the safety of its sensitive data.

Part 1: Nessus Vulnerability Report Analysis

The Nessus vulnerability report outlines all the security vulnerabilities in Mercury USA's network. This subsection interprets the report further to present a lucid picture of potential security setbacks and explain the need to translate the technical findings into cryptography for the non-technical audience.

Report Distribution and Interpretation

Offering the raw Nessus report directly to management is not advisable due to its technical complexity and detailed findings, which require expert analysis to be meaningful. The extensive technical terminology and intricate details could overwhelm and disengage non-technical stakeholders. Management recognizes the necessity of a straightforward summary that outlines the most critical security issues and the proposed remediation steps rather than presenting raw data. As the analyst, I convert these findings into actionable insights and recommendations that align with the organization's security objectives. This approach ensures management comprehends the most significant risks and the corresponding mitigation measures without sifting through technical details.

Evaluation of Output from Tool

The output is comprehensive and organized, with vulnerabilities categorized by criticality levels: Critical, High, Medium, Low, and Info. This categorization is vital for effective vulnerability management, as it helps prioritize remediation measures. Analysts can focus their attention on the most critical issues first. For example, by prioritizing critical vulnerabilities, resources are efficiently allocated to address the most dangerous problems first, thereby reducing overall risk across the network (Shivananjappa, 2024). This tool provides sufficient detail to allow analysts to focus on relevant items. However, the extensive information might be more than what a non-technical audience requires. While the detailed data benefits technical teams implementing security measures, it might need refinement for higher-level management reporting purposes.

Critical Vulnerabilities

1. 192.168.1.30: Critical Vulnerabilities

• Description: This host has five critical vulnerabilities: one high, twelve medium, and two low-level vulnerabilities.

• Impact: Critical vulnerabilities can be remotely run with code execution or without proper authorization, which may pose a significant threat to the network. In particular, in remote code execution vulnerabilities, attackers control affected systems entirely and can cause essential breaches, data theft, or loss of sensitive information (Borhani, 2024). Such vulnerabilities should be addressed as a top priority to avoid exploitation by devils.

2. 192.168.1.10: High Vulnerability

• Description: This host has one high and one medium-level vulnerability.

• Impact: Though at a smaller scale, the high vulnerability can still cause serious security breaches if worked on. High-severity vulnerabilities mainly comprise exploits that could be leveraged to gain first access to a network or escalate privileges within a network (Borhani, 2024). They must be worked on immediately to ensure they do not become a stepping stone for more far-reaching attacks.

3. 192.168.1.25: Medium Vulnerabilities

• Description: The host has one high, two medium, and two low-level vulnerabilities.

• Medium-impact vulnerabilities can be chained with others to escalate privileges or bring unauthorized access. Though a medium-severity vulnerability may not pose an immediate threat, this can be one of the steps in the attack chain (Borhani, 2024). Neglecting such vulnerabilities might provide attackers with an easy entry point into the network, which later could be utilized to launch more dangerous attacks. Therefore, these vulnerabilities are critical to improving the total security posture.

1. 192.168.1.100: Low Vulnerabilities

• Description: This host has one medium-level and twenty-six informational vulnerabilities.

• Impact: While not immediately critical, these vulnerabilities should still be addressed to maintain a robust security posture and prevent potential exploitation.

Remediation Information

Most Nessus reports' detailed remediation steps for each vulnerability include specific patches, configuration changes, or updates to mitigate the identified risk. All information is relevant for tackling and effectively prioritizing critical vulnerabilities (Jimmy, 2024). For example, it would be of high order to fix remote code execution vulnerabilities first and then those of critical and high severity ratings.

Screenshot

​Part 2: The Business Case

CEO Concerns and Organizational Context

From the CEO's perspective at Mercury, protecting critical customer data, ensuring compliance with standards, and maintaining operational integrity are paramount. Mercury USA, being heavily involved in the transport business, handles many customer information, including order details, sales leads, and potentially PCI data used in payment processing. Safeguarding this data is crucial for maintaining customer trust and meeting regulatory requirements (Jimmy, 2024). A breach in data security could result in substantial financial penalties and irreparable damage to the company's reputation, potentially impacting its competitive position in the market.

Current Security Posture

According to the Nessus vulnerability scans, Mercury USA's current security posture reveals several critical vulnerabilities that require immediate attention. Critical and high-severity vulnerabilities significantly increase the risk of data breaches, ransomware attacks, or unauthorized access to sensitive information (Jimmy, 2024). The vulnerabilities identified in the 192.168.1.30 host could allow attackers to take over or disrupt the system. These vulnerabilities highlight significant weaknesses in the security infrastructure that adversaries could easily exploit. Therefore, immediate remediation is essential to strengthen the company's defenses.

Potential Threats

The identified vulnerabilities open Mercury USA up to a variety of potential threats, such as:

1. Data Exfiltration: Adversaries could leverage these vulnerabilities to extract sensitive customer information. Data breaches might result in multi-million-dollar losses, legal implications, and company reputation damage. Protecting customer data is critical in building trust and avoiding the high cost of data breach remediation and possible fines.

2. Ransomware: Attackers may encrypt crucial data and attempt to extort a ransom for it. Ransomware is one of the most rising attacks that can break a business, leading to not-so-short downtime and financial impairment. Therefore, effective vulnerability management is critical, especially in preventing these attacks and maintaining regular business operations.

3. Privilege Escalation: Attackers could penetrate the network without authorization and secure high-level functions. By escalating their privileges, adversaries can move laterally within the network, gaining access to crucial systems and data. If the attacker takes control of critical assets and operations, this could lead to the entire network being compromised. Mercury USA can mitigate these risks by addressing its vulnerabilities, which will enhance the overall security framework and protect crucial data and the integrity of its operations.

Part 3: Nessus Purchase Recommendation

Presentation and Scoring features

Nessus offers precious features such as presentation and scoring, especially to technical professionals. It gives a clear severity rating for each vulnerability, thus enabling the proper prioritization of a user's efforts in remediation. Often, created reports by Nessus are very beneficial for the security teams to understand better the nature and severity of the vulnerabilities that are being faced exactly. These reports would also facilitate an in-depth study and strategic planning process for the remediation of the vulnerabilities so that the most critical ones are covered first to minimize the risk.

Regulatory Compliance

Nessus can assist Mercury USA in achieving and demonstrating compliance with several regulatory and standards needs, including PCI-DSS. Nessus plays a critical role in the company's compliance approach by identifying and rectifying security gaps that may lead to non-compliance (Uzougbo, 2024). This is because regular vulnerability scanning is mandatory for so many industry standards and regulations, and Nessus offers the organization tools and insight to do this.

Cost and Usability

The licensing price of Nessus gives value relative to the functionality available, extensive scanning, and reporting features. It is highly usable, and great support possibilities add value to continuous vulnerability management. Nessus found its place in the market relatively quickly, and the support in terms of documentation or the support itself was of great importance for its successful implementation and utilization (Uzougbo, 2024). This is justified by the potential designed Nessus investments worth Data Breaches, Regulatory Fines, Customer Trust, and Leads to a good decision for Mercury USA.

Management Suitability

Considering that the Nessus reports are in-depth, they are highly technical. Still, this tool offers executive summary reports that the appropriate or concerned management can use. These overviews will provide a high-level view of the security status against which the management can drill into the core issues and actions to be taken (Uzougbo, 2024). This two-tier reporting feature would ensure that the tool serves both the technical and non-technical users. The management will decide on future strategies based on the executive summaries, but the technical teams will use detailed reports and implement specific remediation measures against any particular vulnerability.

Recommendation

I recommend that Mercury USA purchase the Nessus Commercial vulnerability scanner. The Nessus vulnerability scanner has numerous advanced features and the ability to report using various reporting styles, allowing it to serve the company adequately. High-level reporting can serve the tool well in executive use or low-level reporting for system administrators. This can enable the entire organization to use the utility efficiently and effectively.

Conclusion

To conclude, the Nessus vulnerability report for Mercury USA highlights several critical vulnerabilities that need immediate attention. A detailed analysis of this report shows specific areas in the network that face vulnerability and what can be done to mitigate it. The purchase of the Nessus commercial scanner by Mercury USA ensures continuous monitoring and enhancement of its security framework for sensitive data, thereby meeting industry standards and regulatory compliance. The advanced features and powerful support offered by Nessus render its high price justifiable, and its purchase is invaluable for the organization.

References

Borhani, M., Gaba, G. S., Basaez, J., Avgouleas, I., & Gurtov, A. (2024). A critical analysis of the industrial device scanners’ potentials, risks, and preventives. Journal of Industrial Information Integration, 100623. https://doi.org/10.1016/j.jii.2024.100623

Jimmy, F. N. U. (2024). Cyber security Vulnerabilities and Remediation Through Cloud Security Tools. Journal of Artificial Intelligence General science (JAIGS) ISSN: 3006–4023, 2(1), 129–171. https://doi.org/10.60087/jaigs.v2i1.102

Shivananjappa, N., & Creutzburg, R. (2024). Vulnerability Management Using Open-Source Tools. Electronic Imaging, 36, 1-8. https://doi.org/10.2352/EI.2024.36.3.MOBMU-326

Uzougbo, N. S., Ikegwu, C. G., & Adewusi, A. O. (2024). Cybersecurity compliance in financial institutions: a comparative analysis of global standards and regulations. International Journal of Science and Research Archive, 12(1), 533-548. https://doi.org/10.30574/ijsra.2024.12.1.0802