-: Vulnerability reporting, so in the last lesson,
we talked about the three steps
where you have to detect, remediate, and then test.
Well, once you detect it, you have to send it
to the system administrators for remediation.
We're gonna talk about
what some of those reports are that you have
and the information that you can give
to the system administrators.
So, when you do your analysis,
you need to communicate your issues
to the system administrators like we just discussed
and the scanners are gonna provide you
detailed reporting that can be automated
to alert the system administrators
either through trouble tickets
like we mentioned in the last lesson
or as a full report either an HTML, PDF format,
or other formats.
You can give that to them in periodic intervals,
after every scan or once a week or once a month
depending on your corporate policy.
Critical vulnerabilities need to be sent out of cycle
because they are so critical.
So, if it's a low or a medium or a high,
you may wait until that week mark to give it to them,
but if you made a scan today and found there's a critical
remote code execution out there,
you need to let them know right now
so they can go get that fixed.
Now dashboards, part of reporting is gonna be dashboards
and managers love dashboards
because it gives them an easy way to look at things
and provide a high-level summary of issues.
This one for instance is from a newer version of Nessus
and it gives you a good overview of the network.
So in this case, you can see there's a bright red 18.
That's critical, there are 18 critical vulnerabilities.
That's really bad.
We need to get those fixed right away.
Then there's 37 highs, 67 mediums,
and then we have four that are just lower information.
So again, those 18 critical,
that's where our focus is gonna be.
Get those things cleared up as quickly as possible
because otherwise your manager is gonna be like,
"What's going on?"
You can even see here on the screen there's a little graph
and you could see trends over time from the last cycle
and you could see there's been an increase in red
or critical vulnerabilities
so we wanna go ahead and work on fixing that
through the remediation cycle.
Now, another view you can use
is what's called the overview of hosts
and this is one that I really like inside Nessus.
It will show you every host on the network from your scan
and show you which are the most vulnerable.
So if you had to look on the screen
and figure out what's the most vulnerable host,
which one do you think it is?
Well, it's 192.168.1.11
or the top one because there's 176 critical vulnerabilities
with that big bright red bar.
If I had to look and say
which one was my least vulnerable system?
Well, there's one on there that only has 35 issues
and those are all medium or lower issues
and that one is down at .55,
the fourth or fifth from the bottom there.
So as you see this, you can look really quickly
where should I be applying my resources
based on the most critical and most vulnerable host
that we see out there.
Now, the other thing I wanna look at is criticality
and we mentioned this already.
We have critical, high, medium, and low.
You can look at this on this screen, this report,
based on the criticality and severity.
You can filter by any of these fields
whether it's the plugin ID, the count,
the severity, the name, or the family.
In this case if you sort it by criticality,
you can see that there are six or seven vulnerabilities here
that are critical.
We wanna get those fixed first
with the system administrators.
You can actually double click on one of those
and for instance this one I double clicked on
which was plugin 34477,
you could see this was a remote code execution.
It is a critical severity
and it's gonna give us the details of it.
What is it allowed to do?
The synopsis, a description of that,
a solution, in this case Microsoft has a patch for it,
and it gives you the knowledge-based article
so you could download that patch
and install it on your systems,
what the criticality factor is,
and then there at the bottom you could see
that it has a CVSS base score
and we talked about this in an earlier lesson
that that is your Common Vulnerability Scoring System.
It is a 10.0 which is what determines that this is critical.
If it was a nine, it would only be a high, right?
And so each of those criticality, high, medium, low,
has a different number associated with it.
And then you can read across there
where it has whether it's affecting your availability,
your confidentiality, or your integrity
using that CVSS base score.
We'll talk more about CVSS base score
and dig in deep on that in a future lesson.