Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

Amazon AWS Inspector

2018-11-15/0 Comments/in Cloud Security/by Kellep Charles

Amazon Inspector is an automated security assessment service that helps you test the network accessibility of your Amazon EC2 instances and the security state of your applications running on those instances.

Using Docker To Install OpenVAS On CentOS

2018-11-14/0 Comments/in Cloud Security/by Kellep Charles

An interesting post from Gerry Williams at gerrywilliams.net Description: Saw a post on r/sysadmin the other day with a walkthrough on using Docker for the first time. Thought I would take some notes: To Resolve: 1. On the host computer, open up Hyper V and create a new Virtual Machine. Download the Centos7 iso if […]

Amazon AWS Inspector

2018-11-15/0 Comments/in Cloud Security/by Kellep Charles

Using Docker To Install OpenVAS On CentOS

2018-11-14/0 Comments/in Cloud Security/by Kellep Charles

Full Sized Blog Element (Big Preview Pic)

Amazon AWS Inspector

2018-11-15/0 Comments/in Cloud Security/by Kellep Charles

What is Amazon Inspector?

Amazon Inspector allows you to automate security vulnerability assessments throughout your development and deployment pipeline or against static production systems. This allows you to make security testing a more regular occurrence as part of development and IT operations. Amazon Inspector is an API-driven service that uses an optional agent, making it easy to deploy, manage, and automate. Amazon Inspector assessments are offered to you as pre-defined rules packages mapped to common security best practices and vulnerability definitions.

Amazon Inspector consists of a technology that analyzes your network configurations, an Amazon-developed agent that is installed in the operating system of your EC2 instances, and a security assessment service that uses telemetry from the agent and AWS configurations to assess instances for security exposures and vulnerabilities.

Important

AWS does not guarantee that following the provided recommendations will resolve every potential security issue. The findings generated by Amazon Inspector depend on your choice of rules packages included in each assessment template, the presence of non-AWS components in your system, and other factors. You are responsible for the security of applications, processes, and tools that run on AWS services. For more information, see the AWS Shared Responsibility Model for security.

Note

AWS is responsible for protecting the global infrastructure that runs all the services offered in the AWS cloud. This infrastructure comprises the hardware, software, networking, and facilities that run AWS services. AWS provides several reports from third-party auditors who have verified our compliance with a variety of computer security standards and regulations. For more information, see AWS Cloud Compliance.

For more information, see Amazon Inspector Terminology and Concepts.

Benefits of Amazon Inspector

Amazon Inspector enables you to quickly and easily assess the security of your AWS resources for forensics, troubleshooting, or active auditing purposes at your own pace, either as you progress through the development of your infrastructures or on a regular basis in a stable production environment.
Amazon Inspector enables you to focus on more complex security problems by offloading the overall security assessment of your infrastructure to this automated service.
By using Amazon Inspector, you can gain deeper understanding of your AWS resources because Amazon Inspector findings are produced through the analysis of the real activity and configuration data of your AWS resources.

Features of Amazon Inspector

Configuration Scanning and Activity Monitoring Engine – Amazon Inspector provides an engine that analyzes system and resource configuration and monitors activity to determine what an assessment target looks like, how it behaves, and its dependent components. The combination of this telemetry provides a complete picture of the assessment target and its potential security or compliance issues.
Built-in Content Library – Amazon Inspector incorporates a built-in library of rules and reports. These include checks against best practices, common compliance standards and vulnerabilities. These checks include detailed recommended steps for resolving potential security issues.
Automatable via API – Amazon Inspector is fully automatable via an API. This allows organizations to incorporate security testing into the development and design process, including selecting, executing, and reporting the results of those tests.

Amazon Inspector Pricing

Amazon Inspector pricing is based on the number of Amazon EC2 instances included in each assessment and the rules packages used in those assessments. For detailed information about Amazon Inspector pricing, see Amazon Inspector Pricing.

Accessing Amazon Inspector

You can work with the Amazon Inspector service in any of the following ways.

Amazon Inspector Console

Sign in to the AWS Management Console and open the Amazon Inspector console at https://console.aws.amazon.com/inspector/.

The console is a browser-based interface to access and use the Amazon Inspector service.

AWS SDKs

AWS provides software development kits (SDKs) that consist of libraries and sample code for various programming languages and platforms (Java, Python, Ruby, .NET, iOS, Android, and more). The SDKs provide a convenient way to create programmatic access to the Amazon Inspector service. For information about the AWS SDKs, including how to download and install them, see Tools for Amazon Web Services.

Amazon Inspector HTTPS API

You can access Amazon Inspector and AWS programmatically by using the Amazon Inspector HTTPS API, which lets you issue HTTPS requests directly to the service. For more information, see the Amazon Inspector API Reference.

AWS Command Line Tools

You can use the AWS command line tools to issue commands at your system’s command line to perform Amazon Inspector tasks; this can be faster and more convenient than using the console. The command line tools are also useful if you want to build scripts that perform AWS tasks. For more information, see the Amazon Inspector’s AWS Command Line Interface.

Using Docker To Install OpenVAS On CentOS

2018-11-14/0 Comments/in Cloud Security/by Kellep Charles

An interesting post from Gerry Williams at gerrywilliams.net

Description:

Saw a post on r/sysadmin the other day with a walkthrough on using Docker for the first time. Thought I would take some notes:

To Resolve:

1. On the host computer, open up Hyper V and create a new Virtual Machine. Download the Centos7 iso if you don’t already have it.

2. Before starting the virtual machine, we need to edit its properties:

2a. Change UEFI option to UEFI Authority

2b. Change Network Adapter to Enable MAC Address spoofing

2c. Enable Nested Virtualization. On the host machine, open Powershell as admin and type:

Set-Vmprocessor -Vmname Docker -Enablevirtualizationextensions $True

1	Set-Vmprocessor –Vmname Docker –Enablevirtualizationextensions $True

3. Install Centos7 minimal on a Virtual Machine.

4. Update it and give it a static IP, and install Docker stuff:

# Update:<br /><br />
sudo yum update</p><br />
<p># Set a static ip = https://www.gerrywilliams.net/2016/10/setting-a-static-ip-in-centos/</p><br />
<p># Install docker<br /><br />
yum install -y yum-utils device-mapper-persistent-data lvm2<br /><br />
yum-config-manager –add-repo https://download.docker.com/linux/centos/docker-ce.repo<br /><br />
yum-config-manager –enable docker–ce-edge<br /><br />
yum-config-manager –enable docker–ce-test<br /><br />
yum install docker-ce</p><br />
<p># Start and enable docker<br /><br />
systemctl start docker<br /><br />
systemctl enable docker

# Update:

sudo yum update

# Set a static ip = https://www.gerrywilliams.net/2016/10/setting-a-static-ip-in-centos/

# Install docker

yum install –y yum-utils device-mapper-persistent-data lvm2

yum-config-manager —add-repo https://download.docker.com/linux/centos/docker-ce.repo

yum-config-manager —enable docker–ce-edge

yum-config-manager —enable docker–ce-test

yum install docker-ce

# Start and enable docker

systemctl start docker

systemctl enable docker

5. Now that docker is installed, we can search for images to run. For example, let’s install OpenVAS:

# Search docker images:<br /><br />
docker search openvas</p><br />
<p># Download an image<br /><br />
docker pull mikesplain/openvas</p><br />
<p># See images<br /><br />
docker images

# Search docker images:

docker search openvas

# Download an image

docker pull mikesplain/openvas

# See images

docker images

6. Now lets start and run it:

# To run: The command breakdown is: -d is background (detach), -p is ports, –name is just a name, and last is the image file.<br /><br />
docker run -d -p 443:443 -p 9390:9390 –name openvas mikesplain/openvas</p><br />
<p># To see running docker images:<br /><br />
docker ps</p><br />
<p># To see installation logs<br /><br />
docker logs -ft mikesplain/openvas</p><br />
<p># Add firewall exceptions:<br /><br />
firewall-cmd –zone=public –add-port=443/tcp –permanent<br /><br />
firewall-cmd –zone=public –add-port=9390/tcp –permanent<br /><br />
firewall-cmd –reload</p><br />
<p># To see all containers created, but some may be offline<br /><br />
docker ps -a

# To run: The command breakdown is: –d is background (detach), –p is ports, —name is just a name, and last is the image file.

docker run –d –p 443:443 –p 9390:9390 —name openvas mikesplain/openvas

# To see running docker images:

docker ps

# To see installation logs

docker logs –ft mikesplain/openvas

# Add firewall exceptions:

firewall-cmd —zone=public —add-port=443/tcp —permanent

firewall-cmd —zone=public —add-port=9390/tcp —permanent

firewall-cmd —reload

# To see all containers created, but some may be offline

docker ps –a

7. That is it, if you want to see the OpenVAS web GUI, just go to https://10.10.10.23 (if the Centos VM static IP is 10.10.10.23) in a browser on CentOS. It should bring up OpenVAS login! Creds are ‘admin/admin’

Video: