In order for us to update the JAB on our compliance in a consistent way, we need to deliver a Continuous Monitoring report monthly (our standard due date is the 2nd of the month. If these dates fall on a weekend or federal holiday, adjust to the last business day before the date.)
We need to process our scan results and prepare documentation for any updated or new items, including updating the vulnerability tracker and POA&M.
(Vulnerabilities that are patched within RA-05/SI-02 deadlines are not reported on the POA&M sheet).
Workstation Processing
First time setup
Set up Google Drive - install from GSA SelfService
Have cg-scripts in your $PATH
PIP install nessus-file-reader
I keep all the conmon materials locally in ~/Documents/ConMon, and have a symlink
to the few scripts that I use for parsing the conmon materials, as follows:
pushd Production-and-Tooling-Vulnerability-and-Compliance-scans_2021-03-23
spaces2underscores
cd ../RDS_Compliance_Scans_2021-03-23
spaces2underscores
popd
Run nessus_log4j. This generates a table something like this:
------- Log4J REPORT ------
Log4j plugin: 155999
Log4J violations on Diego cells on phantom paths (safe): 0
Log4J violations on Diego cells in customer path (safe): 6
Log4J violations on Logstash nodes at known path (safe): 27
Log4J violations of unknown origins found (UNSAFE) : 0
Immediately assign to CloudOps and discuss with them
Once clean, screenshot and attach to this issue.
Run nessus_daemons
Review any findings, if they're legitimate daemon, open an issue in cg-scripts to patch parse-nessus-xml.py.
Link to the issue, or PR, in the comments below
If they're suspicious, follow our IR processes.
Once clean, screenshot and attach to this issue.
Run prep_nessus function
This generates MM.nessus_summary.txt and MM.nessus_work.txt - This month's summary is compared, using comm to last month's summary.
Review MM.nessus_summary.txt, see if it's OK.
The file MM.nessus_work.txt looks like this:
LAST MONTH (fixed)
THIS MONTH (new)
BOTH (persisting)
147163, Risk: Medium, Plugin Name: Apache Tomcat 7.0.0 < 7.0.108 RCE, https://www.tenable.com/plugins/nessus/147163
..hostnames or number of impacted hosts
The items left-aligned are ones that we're in last months' report but are now fixed, the next indent are those that are new (present now, absent last month), and the third indent are present in both months' scans (persisting issues)
Run nessus_csv to generate the MM.csv file
Copy the new .txt and the CSV files to Google Drive for the other team members to processing
Be sure to:
Review the RDS scans:
cd to the directory with the RDS compliance scans,
run ../../../bin/parse-rds.sh
if there are version out-of-date findings, see latest version in AWS with:
Depending on scan results, we sometimes also have to do these tasks:
For any items that require a monthly checkin with a vendor, Cloud Operations needs to make the appropriate support request to the vendor.
Write Deviation Requests for operational requirements, risk adjustments, and false positives.
Update our boards with current info about vulnerabilities and open POAM items and any necessary followup stories about compliance work and related technical work to prepare for the next month's report.
wz-gsa
commented
3 months ago
In order for us to update the JAB on our compliance in a consistent way, we need to deliver a Continuous Monitoring report monthly (our standard due date is the 2nd of the month. If these dates fall on a weekend or federal holiday, adjust to the last business day before the date.)
For context, see our Continuous Monitoring Strategy, including the monthly reporting summary explanation.
We need to process our scan results and prepare documentation for any updated or new items, including updating the vulnerability tracker and POA&M. (Vulnerabilities that are patched within RA-05/SI-02 deadlines are not reported on the POA&M sheet).
Workstation Processing
First time setup
cg-scriptsin your$PATHnessus-file-readerI keep all the conmon materials locally in
~/Documents/ConMon, and have a symlink to the few scripts that I use for parsing the conmon materials, as follows:Monthly processing
cd ConMon; source bin/conmon.sh- Set up functions for conmonsetup_dirs YYYY MM DD- Set up the correct names, env vars, and places for our copies of the scanConMon/2021/11)ZAP and Nessus results/2021-11-22nessus_log4j. This generates a table something like this:nessus_daemonsparse-nessus-xml.py.prep_nessusfunctionMM.nessus_summary.txtandMM.nessus_work.txt- This month's summary is compared, usingcommto last month's summary.MM.nessus_summary.txt, see if it's OK.MM.nessus_work.txtlooks like this:The items left-aligned are ones that we're in last months' report but are now fixed, the next indent are those that are new (present now, absent last month), and the third indent are present in both months' scans (persisting issues)
nessus_csvto generate theMM.csvfile.txtand the CSV files to Google Drive for the other team members to processingBe sure to:
../../../bin/parse-rds.shaws rds describe-db-engine-versions --output=table --engine postgres --engine-version X.YGoogle Drive processing
Process the Nessus and Zap
_work.txtand CSV fileconmon.sh)nessus_csvDatamenu to convert toSplit Text to ColumnsManage the POA&Ms, Inventory, and ConMon Summary
Any Java and Tomcat findings will require work outside our normal stemcell patching. See closed issues in the private repository for examples
Work through the
MM.zap_work.txtfile produced byprep_zap, abovePay special attention to the High and Moderate findings
Move fixed issues from Open to Closed tabs. Be sure to
Review the Inventory
Address all gravely late POA&Ms
Manage the container scans:
Be sure you've done all the following
Depending on scan results, we sometimes also have to do these tasks:
Upload to the FedRAMP repository
Acceptance criteria
There! You've completed KHAN!-mon