DHA-ACAS Scanning Requirements_Read Only 06.17.21.pdf

CYBER SECURITY ENGINEERING AND SUPPORT

DHA Cyber Security Division

DHA ACAS SCANNING REQUIREMENTS

22 MAR 2017

Version 1.0

<UNCLASSIFIED>

Cyber Security Engineering and Support DHA ACAS Scanning Requirements

FOR OFFICIAL USE ONLY i

DOCUMENT HISTORY

Version Date Topic Author

1.0 22 MAR 2017 Initial Release Cyber Security

Engineering and Support

SUGGESTED IMPROVEMENTS: Send comments, suggested improvements, or recommendations to the DHA Cyber Security Engineering and Support office email address:

dha.jbcharleston.health-it-supp.list.cyber-security-es@mail.mil

DISTRIBUTION STATEMENT: Distribution is limited to US Government agencies and their contractors who have a need-to-know the information contained herein. Requests for redistribution should be sent to dha.jbcharleston.health-it-supp.list.cyber-security-es@mail.mil

TRADEMARKS AND REFERENCES: US Government Restricted Rights - Trademarked names may appear throughout this document. Rather than list the names and entities that own the trademarks or insert a trademark symbol with each mention of the trademarked name, the publisher states the names are used only for editorial purposes and to the benefit of the trademark owner with no intention of infringing upon that trademark.

APPROVED BY:

Mr. Willie Arrington

Chief of Cyber Security Operations Branch, Cyber Security Division Cyber Security Operations Branch J-6 Health Information Technology, Defense Health Agency

FOR OFFICIAL USE ONLY ii

TABLE OF CONTENTS

1 INTRODUCTION

2 PURPOSE

3 SCAN REQUIREMENTS

3.1 Scan Policies

3.2 Scan Frequency

3.3 Scan Configuration

3.4 Audit (SCAP) Files

4 CONCLUSION

FOR OFFICIAL USE ONLY 1

1 Introduction Assured Compliance Assessment Solution (ACAS) is a DoD vulnerability scanning tool suite leveraging the Tenable Commercial of the Shelf (COTS) Product. Tenable’s Nessus vulnerability scanner and Passive Vulnerability Scanner (PVS) are designed to actively and passively scan operating systems and applications including database management software and web applications. The policies, plugins, reports, and vulnerability tracking information is consolidated and managed by the Security Center application. When these three applications are used collectively, the ACAS tool suite allows consumers to identify their cybersecurity posture and report their results in accordance with DoD and DHA requirements.

2 Purpose The purpose of this document is to provide detailed guidance on ACAS scanning within DHA. Prior to their transition into MedCOI, Service Medical activities relied on the policies and procedures that were put in place by their respective Service Cyber Components. This document will specify the information required to fulfill USCYBERCOM and DHA ACAS scanning requirements.

3 Scan Requirements

3.1 Scan Policies

DHA scan policies are provided by the Assessment & Authorization Branch and maintained by the Cybersecurity Operations Branch. Three categories of policies (Discovery, Full System, and SCAP) are available to ACAS users. The scan policies maintained by DHA can be identified by their naming convention and/or owner. If viewing the available policies from the Scans-Policies tab, the group and owner will be listed as “Administrator”. Scan policies will be selectable from a list of policies when configuring vulnerability scans.

To ensure correct scan policies are utilized, any custom policy resembling the DHA Scan Policy naming convention will be removed by the Cybersecurity Operations Branch. A list of all DHA maintained scan policies can be viewed on the first tab of Technical Attachment 1.

All scan policies are created as a Custom-Advanced Scan by the DHA ACAS administrators. This allows the CNDSP and CCRI inspectors to review the policy and ensure all appropriate plugins have been selected. Additionally, ACAS consumers will not need to modify their scan templates to incorporate future policy updates as this will be done automatically within the DHA scan policies. The settings for each category of policy are specified on the second tab of Technical Attachment 1.

Technical Attachment 1- DHA Scanning Requirements

Available Scan Policies

Scan Policy Name Category

DHA-Host Discovery Policy Discovery

DHA-Full Safe Scan Full System

DHA-Full Safe Scan-Low Bandwidth Full System

DHA-SCAP-AIX 6.1 STIG SCAP

DHA-SCAP-HP-UX 11.31 SCAP

DHA-SCAP-Windows 10 SCAP

DHA-SCAP-Windows 2008 DC SCAP

DHA-SCAP-Windows 2008 MS SCAP

DHA-SCAP-Windows 2008 R2 DC SCAP

DHA-SCAP-Windows 2008 R2 MS SCAP

DHA-SCAP-Windows 2012 and 2012 R2 DC SCAP

DHA-SCAP-Windows 2012 and 2012 R2 MS SCAP

DHA-SCAP-Windows 7 STIG Benchmark SCAP

DHA-SCAP-Windows 8/8.1 SCAP

DHA-SCAP-Windows Vista SCAP

DHA-SCAP-Red Hat 5 SCAP

DHA-SCAP-Red Hat 6 SCAP

DHA-SCAP-Solaris 10 SPARC SCAP

DHA-SCAP-Solaris 10 X86 SCAP

DHA-SCAP-Solaris 11 SPARC SCAP

DHA-SCAP-Solaris 11 x86 SCAP

DHA-SCAP-IE 10 SCAP

DHA-SCAP-IE 11 SCAP

DHA-SCAP-Google Chrome for Windows SCAP

Scan Policy Configuration

Advanced Scan Options DHA-Full Safe Scan Policy DHA-Host Discovery Policy DHA-SCAP-<OS/Browser> Policy

Section Individual Setting Full Scan Policy Low Bandwidth Policy

Advanced Tab

General Settings Enable safe checks enabled enabled enabled enabled

Stop scanning hosts that become unresponsive during the scan disabled disabled disabled disabled

Performance Options Slow down the scan when network congestion is detected disabled disabled disabled disabled

Use Linux kernel congestion detection disabled disabled disabled disabled

Network timeout (in seconds) 5 5 5 5

Max simultaneous checks per host 4 4 5 4

Max simultaneous hosts per scan 30 2 30 30

Max number of concurrent TCP sessions per host - - - -

Max number of concurrent TCP sessions per scan unlimited unlimited unlimited unlimited

Host Discovery Tab

Ping the remote host enabled enabled enabled enabled

General Settings Test the local Nessus host enabled enabled enabled enabled

Use fast network discovery disabled disabled disabled disabled

Ping Methods ARP enabled enabled enabled enabled

TCP enabled enabled enabled enabled

Destination ports built-in built-in built-in built-in

ICMP enabled enabled enabled enabled

Assume ICMP unreachable from the gateway means the host is down disabled disabled disabled disabled

Maximum number of retries 2 2 2 2

UDP disabled disabled disabled disabled

Fragile Devices Scan Network Printers disabled disabled disabled disabled

Scan Novell Netware hosts disabled disabled disabled disabled

Wake-on-LAN List of MAC addresses - - - -

Boot time wait (in minutes) 5 5 5 5

Network Type Network Type Mixed Mixed Mixed Mixed

Port Scanning Tab

Ports Consider unscanned ports as closed disabled disabled disabled disabled

Port scan range: default default default default

Local Port Enumerators SSH (netstat) enabled enabled enabled enabled

WMI (netstat) enabled enabled enabled enabled

SNMP enabled enabled enabled enabled

Only run network port scanners if local port enumeration failed enabled enabled enabled enabled

Verify open TCP ports found by local port enumerators disabled disabled disabled disabled

Network Port Scanners TCP disabled disabled disabled disabled

SYN enabled enabled enabled enabled

Override automatic firewall detection Automatic Automatic Automatic Automatic

UDP disabled disabled disabled disabled

Service Discovery Tab

General Settings Probe all ports to find services enabled enabled disabled enabled

Search for SSL/TLS services enabled enabled enabled enabled

Search for SSL/TLS on Known SSL ports Known SSL ports Known SSL ports Known SSL ports

Identify certificates expiring within x days 60 60 60 60

Enumerate all SSL/TLS ciphers enabled enabled enabled enabled

Enable CRL checking (connects to the Internet) disabled disabled disabled disabled

Assessment Tab

Accuracy Override normal accuracy Normal Normal Normal Normal

Perform thorough tests disabled disabled disabled disabled

Antivirus Antivirus definition grace period (in days): 1 1 0 0

SMTP Third party domain example.mil example.mil example.mil example.mil

From address nobody@example.mil nobody@example.mil nobody@example.mil nobody@example.mil

To address postmaster@[AUTO_REPLACED_IP] postmaster@[AUTO_REPLACED_IP] postmaster@[AUTO_REPLACED_IP] postmaster@[AUTO_REPLACED_IP]

Brute Force Tab

General Settings Only use credentials provided by the user enabled enabled enabled enabled

Oracle Database Test default accounts (slow) disabled disabled disabled disabled

Hydra Always enable Hydra (slow) disabled disabled disabled disabled

Logins file - - - -

Passwords file - - - -

Number of parallel tasks 16 16 16 16

Timeout (in seconds) 30 30 30 30

Try empty passwords disabled disabled disabled disabled

Try login as password disabled disabled disabled disabled

Stop brute forcing after the first success disabled disabled disabled disabled

Add accounts found by other plugins to the login file disabled disabled disabled disabled

PostgreSQL database name - - - -

SAP R3 Client ID (0 - 99) - - - -

Windows accounts to test local accounts local accounts local accounts local accounts

Interpret passwords as NTLM hashes disabled disabled disabled disabled

Cisco login password - - - -

Web page to brute force - - - -

HTTP proxy test website - - - -

LDAP DN - - - -

Malware Tab

General Settings Disable DNS resolution disabled disabled disabled disabled

Hash and Whitelist Files Provide your own list of known bad MD5 hashes: - - - -

Provide your own list of known good MD5 hashes: - - - -

Hosts file whitelist - - - -

File System Scanning Scan file system disabled disabled disabled disabled

Directories Scan %Systemroot% disabled disabled disabled disabled

Scan %ProgramFiles% disabled disabled disabled disabled

Scan %ProgramFiles(x86)% disabled disabled disabled disabled

Scan %ProgramData% disabled disabled disabled disabled

Scan User Profiles disabled disabled disabled disabled

Custom Filescan Directories - - - -

Yara Rules Files - - - -

SCADA Tab

Modbus/TCP Coil Access Start at register 0 0 0 0

End at register 16 16 16 16

ICCP/COTP TSAP Addressing Weakness Start COTP TSAP 8 8 8 8

Stop COTP TSAP 8 8 8 8

Web Application Tab

Web Application Settings Scan web applications disabled disabled disabled disabled

Windows Tab

General Settings Request information about the SMB Domain enabled enabled enabled enabled

Enumerate Domain Users Start UID 1000 1000 1000 1000

End UID 1200 1200 1200 1200

Enumerate Local Users Start UID 1000 1000 1000 1000

End UID 1200 1200 1200 1200

Report Tab

Processing Override normal verbosity Normal Normal Normal Normal

Show missing patches that have been superseded disabled disabled disabled disabled

Hide results from plugins initiated as a dependency enabled enabled enabled enabled

Output Designate hosts by their DNS name disabled disabled disabled disabled

Display hosts that respond to ping disabled disabled enabled disabled

Display unreachable hosts disabled disabled disabled disabled

Generate SCAP XML Results disabled disabled disabled enabled

Authentication Tab

Authentication Add Authentication Settings - - - -

SNMP UDP port 161 161 161 161

Additional UDP port #1 161 161 161 161

Additional UDP port #2 161 161 161 161

Additional UDP port #3 161 161 161 161

SSH known_hosts file - - - -

Preferred port 22 22 22 22

Client version OpenSSH_5.0 OpenSSH_5.0 OpenSSH_5.0 OpenSSH_5.0

Windows Never send credentials in the clear enabled enabled enabled enabled

Do not use NTLMv1 authentication enabled enabled enabled enabled

Start the Remote Registry service during the scan enabled enabled enabled enabled

Enable administrative shares during the scan enabled enabled enabled enabled

Plaintext Authentication Perform patch audits over telnet disabled disabled disabled disabled

Perform patch audits over rsh disabled disabled disabled disabled

Perform patch audits over rexec disabled disabled disabled disabled

HTTP Login method POST POST POST POST

Re-authenticate delay (seconds) 0 0 0 0

Follow 30x redirections (# of levels) 0 0 0 0

Invert authenticated regex disabled disabled disabled disabled

Use authenticated regex on HTTP headers disabled disabled disabled disabled

Case insensitive authenticated regex disabled disabled disabled disabled

Compliance Tab

Compliance Add Audit File - - - <Appropriate Audit File to Match Policy Name>

Plugins Tab

Plugins AIX Local Security Checks enabled enabled disabled disabled

Amazon Linux Local Security Checks enabled enabled disabled disabled

Backdoors enabled enabled disabled disabled

Brute force attacks Disabled Disabled disabled disabled

CentOS Local Security Checks enabled enabled disabled disabled

CGI abuses enabled enabled disabled disabled

CGI abuses : XSS enabled enabled disabled disabled

CISCO enabled enabled disabled disabled

Databases enabled enabled disabled disabled

Debian Local Security Checks enabled enabled disabled disabled

Default Unix Accounts enabled enabled disabled disabled

Denial of Service disabled disabled disabled disabled

DNS enabled enabled disabled disabled

F5 Networks Local Security Checks enabled enabled disabled disabled

Fedora Local Security Checks enabled enabled disabled disabled

Firewalls enabled enabled disabled disabled

FreeBSD Local Security Checks enabled enabled disabled disabled

FTP enabled enabled disabled disabled

Gain a shell remotely enabled enabled disabled disabled

Gentoo Local Security Checks enabled enabled disabled disabled

HP-UX Local Security Checks enabled enabled disabled disabled

Huawei Local Security Checks enabled enabled disabled disabled

Incident Response enabled enabled disabled disabled

Junos Local Security Checks enabled enabled disabled disabled

MacOS X Local Security Checks enabled enabled disabled disabled

Mandriva Local Security Checks enabled enabled disabled disabled

Misc. enabled enabled disabled disabled

Mobile Devices enabled enabled disabled disabled

Netware enabled enabled disabled disabled

Oracle Linux Local Security Checks enabled enabled disabled disabled

OracleVM Local Security Checks enabled enabled disabled disabled

Palo Alto Local Security Checks enabled enabled disabled disabled

Peer-To-Peer File Sharing enabled enabled disabled disabled

Policy Compliance Disabled Disabled disabled Mixed Windows/Broswers:66759, 66756, 66758 Linux: 66759, 66757, 66758

Red Hat Local Security Checks enabled enabled disabled disabled

RPC enabled enabled disabled disabled

SCADA enabled enabled disabled disabled

Scientific Linux Local Security Checks enabled enabled disabled disabled

Service detection enabled enabled disabled disabled

Settings enabled enabled mixed Plugin: 19506 mixed Plugins: 19506, 21745

Slackware Local Security Checks enabled enabled disabled disabled

SMTP problems enabled enabled disabled disabled

SNMP enabled enabled disabled disabled

Solaris Local Security Checks enabled enabled disabled disabled

SuSE Local Security Checks enabled enabled disabled disabled

Ubuntu Local Security Checks enabled enabled disabled disabled

VMware ESX Local Security Checks enabled enabled disabled disabled

Web Servers enabled enabled disabled disabled

Windows enabled enabled disabled disabled

Windows : Microsoft Bulletins enabled enabled disabled disabled

Windows : User management enabled enabled disabled disabled

*Plugin Families Not Listed Above* enabled enabled disabled disabled

DHA Scan Policy Configuration 20 MAR 2017

DHA Scanning Requirements Technical Attachment-ACAS Scanning Requirements.xlsx

FOR OFFICIAL USE ONLY 2

3.2 Scan Frequency

DHA ACAS users are expected to complete scans in accordance with the schedule set in Table 1. The schedule specified is the minimum scan frequency and meets the requirements set forth in TASKORD 17-0019. Users responsible for scanning may take a more proactive approach and scan more frequently than listed below.

Scan Category Frequency Discovery Monthly Full System Weekly1 SCAP Monthly

3.3 Scan Configuration

Utilize the DHA-Host Discovery Policy to conduct a non-authenticated scan of all site IP ranges. This includes all unused IP space. A single scan should be used to scan all available IP space.

Utilize the DHA-Full Scan Policy and the corresponding credential set(s) to scan all active IP ranges.

Unused subnets may be excluded from this scan. Scans consisting of more than 2,500 hosts should be divided into multiple scans. For locations with limited bandwidth or remote assets, a DHA-Full Safe Scan- Low Bandwidth policy is available and may be used in place of the Full Scan Policy. It is recommended to plan accordingly when using the Low Bandwidth policy as it only scans two assets simultaneously and will take considerably longer to complete.

Utilize each applicable operating system/application SCAP Policy and the corresponding credential set(s) to scan all active IP ranges. SCAP Policies for operating systems and applications that are not present on the network (i.e. RHEL6 and AIX) are not required.

3.4 Audit (SCAP) Files

Audit files are uploaded by the Cybersecurity Operations Branch. Only supported IASE SCAP benchmarks will be uploaded for use. The name of the audit file is generic to the application/operating system it is designed for. Each SCAP Policy from Technical Attachment 1 will utilize the corresponding audit file. Version and revision information for the SCAP benchmark are listed within the description field of the audit. As each scan policy template is uploaded, the name must be updated to reflect the correct OS or application. The corresponding audit file will need to be selected on the Compliance tab of the policy.

DISA periodically releases updates for SCAP benchmarks. Updates will be uploaded into the current and respective audit file when available through the DISA repository. The description field of each audit will be updated to reflect the new version and/or revision number of the benchmark. This methodology assures ACAS users that modification to previously scheduled scans will not be required after each benchmark update.

1 The Cybersecurity Vulnerability Management Plan may specify authorized deviations for specific DHA organizations.

FOR OFFICIAL USE ONLY 3

4 Conclusion USCYBERCOM issued TASKORDER 17-0019 to provide ACAS operational guidance to all DoD components. By conducting ACAS scans with the policies and frequency outlined in this DHA-ACAS Scanning Requirements document, all DHA components will meet the requirements within TASKORDER 17-0019. System owners that are unable to meet the ACAS scanning requirements, including medical systems that could potentially result in loss in life, are required to request an exemption through the DHA CIO. Exemptions will not be effective until final approval is granted by the DHA AO. A list of exempted assets will be maintained by DHA Cyber Operation Branch and will be provided to USCYBERCOM upon request. Exemption approval must be re-evaluated in conjunction with the system owner’s accreditation effort.

Standardized scan policies and consistent scanning frequencies will allow DHA to accurately track vulnerabilities across all sites, enclaves, and Programs of Record (PORs). Scanning for accreditation efforts, Information Assurance Vulnerability Management (IAVM) compliance, and Cyber Readiness Inspections is achievable by utilizing the DHA provided scan policies. Vulnerability reporting will be consistently updated with the latest vulnerability information. Analysis of discovery, SCAP, and full scans results can be conducted to ensure 100% off all assets are scanned and returning accurate results.

4 Conclusion