Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Appendix E. Vulnerability Assessment
As part of the evaluation, we requested that the Bureau of Diplomatic Security, Security
Infrastructure Directorate, Office of Computer Security (DS/SI/CS), execute vulnerability scans
on a sample of 16 systems during the period August 1 to September 1, 2011. A total of 472
hosts 1 from the 16 systems were active and tested. DS/SI/CS is responsible for performing
vulnerability scans on the Department’s systems as part of its security assessment duties. As part
of the Department’s continuous monitoring program, DS stores the vulnerability scans in a
database for iPost. iPost subsequently retrieves the vulnerability scan results and analyzes the
results for the risk scoring program. For the systems tested, we reviewed the vulnerability scan
configurations, analyzed the results, and summarized the results. The weaknesses we identified
are summarized as follows:
A. Systems, operating systems, and applications with critical system and security
patches which had not been applied.
B. Systems that did not meet the standards set forth in the System Configuration
Policy and Procedures.
C. Systems that allowed access to system resources via anonymous logins and
passwords, default credentials, and unsecured access points.
The risk ratings are defined as follows:
� High Risk - Exploitation of the vulnerability discovered on the system can directly
lead to an attacker gaining privileged access (for example, an administrator or a, root
accounts) to the machine over a remote connection. Examples are: IIS Remote Data
Services, remote procedure call automount daemon (RPC Automountd).
� Medium Risk - The vulnerability discovered on the system can lead directly to an
attacker gaining non-privileged access (for example, standard user) to the machine
over a remote connection. Examples are: Coldfusion viewexample.cfm and, Open
and accessible NetBIOS ports.
� Low Risk - The vulnerability discovered on the system provides enticement data to
the attacker that may be used to launch a more informed attack against the target
environment. In addition, the vulnerability may indirectly lead to an attacker’s
gaining some form of access to the machine over a remote connection.
1 A host is computer that is connected to a Transmission Control Protocol/Internet Protocol (TCP/IP) network,
including the Internet. Each host had a unique IP address.
50
UNCLASSIFIED