Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-025614-01, Revision 1
Security Threat Response Manager
Managing Vulnerability Assessment
Release 2008.2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
Managing Vulnerability Assessment
Release 2008.2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
June 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
ABOUT THIS GUIDE
Conventions 3
Technical Documentation 3
Documentation Feedback 3
Requesting Support 4
1OVERVIEW
Configuring Vulnerability Assessment 5
Viewing Scanners 6
2MANAGING IP360 SCANNERS
Adding an ip360 Scanner 9
Editing an ip360 Scanner 11
Deleting an ip360 Scanner 11
Exporting Reports 12
3MANAGING NESSUS SCANNERS
Adding a Nessus Scanner 13
Editing an Nessus Scanner 16
Deleting a Nessus Scanner 16
4MANAGING NESSUS SCAN RESULT IMPORTERS
Adding a Nessus Scan Result Importer 17
Editing a Nessus Scan Result Importer 19
Deleting a Nessus Scan Result Importer 20
5MANAGING NMAP SCANNERS
Adding a Nmap Scanner 21
Editing an Nmap Scanner 23
Deleting an Nmap Scanner 24
6MANAGING QUALYS SCANNERS
Adding a Qualys Scanner 25
Editing a Qualys Scanner 27
Deleting a Qualys Scanner 27

7MANAGING FOUNDSCAN SCANNERS
Adding a FoundScan Scanner 29
Editing a FoundScan Scanner 32
Deleting a FoundScan Scanner 32
Importing Custom Certificates 32
Example Of TrustedCA.pem File 34
Example of Portal.pem File 34
8MANAGING JUNIPER NSM PROFILER SCANNERS
Adding a Juniper NSM Profiler Scanner 39
Editing a Profiler Scanner 41
Deleting a Profiler Scanner 41
9MANAGING RAPID7 NEXPOSE SCANNERS
Adding a Rapid7 NeXpose Scanner 43
Editing a Rapid7 NeXpose Scanner 45
Deleting a Rapid7 NeXpose Scanner 45
10 MANAGING SCAN SCHEDULES
Scheduling a Scan 47
Editing a Scan Schedule 49
Deleting a Scheduled Scan 50
11 VIEWING ASSET PROFILE INFORMATION
INDEX

Managing Vulnerability Assessment
ABOUT THIS GUIDE
The Managing Vulnerability Assessment Guide provides you with information for
managing vulnerability scanners and scan schedules using STRM.
Conventions Table 1 lists conventions that are used throughout this guide.
Technical
Documentation You can access technical documentation, technical notes, and release notes
directly from the Juniper networks Support Web site at
http://www.juniper.net/support/.
Documentation
Feedback We encourage you to provide feedback, comments, and suggestions so that we
can improve the documentation. Send your comments to
[e-mail], or fill out the documentation feedback form at
http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be
sure to include the following information with your comments:
•Document name
•Document part number
•Page number
•Software release version
Table 1 Icons
Icon Type Description
Information note Information that describes important features or
instructions.
Caution Information that alerts you to potential loss of
data or potential damage to an application,
system, device, or network.
Warning Information that alerts you to potential personal
injury.

Managing Vulnerability Assessment
4ABOUT THIS GUIDE
Requesting
Support • Open a support case using the Case Management link at
http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,
Canada, or Mexico) or 1-408-745-9500 (from elsewhere).

Managing Vulnerability Assessment
1OVERVIEW
Vulnerability assessment integration enables vulnerability assessment data to
build profiles of attackers and targets. Vulnerability assessment data uses
correlated event data, network activity, and behavioral changes to remove false
positives to determine the threat level for each critical business asset.
STRM's integration with vulnerability assessment tools allows you to schedule
scans to keep your vulnerability assessment data up-to-date.
Note: You must have permissions to all CIDRs you wish to scan. Also, do not
include CIDRs in your vulnerability assessment that are configured in your global
exclusions list. For more information on global exclusions, see the Offense
Resolutions Users Guide.
This chapter provides an overview of configuring vulnerability assessment,
including:
•Configuring Vulnerability Assessment
•Viewing Scanners
Configuring
Vulnerability
Assessment
To configure vulnerability assessment, you must:
Step 1 Configure your scanner using one of the following supported scanners:
•Chapter 2 Managing ip360 Scanners
•Chapter 3 Managing Nessus Scanners
•Chapter 4 Managing Nessus Scan Result Importers
•Chapter 5 Managing Nmap Scanners
•Chapter 6 Managing Qualys Scanners
•Chapter 7 Managing FoundScan Scanners
•Chapter 8 Managing Juniper NSM Profiler Scanners
•Chapter 9 Managing Rapid7 NeXpose Scanners

Managing Vulnerability Assessment
6OVERVIEW
The scanner determines the tests performed during the scanning of a host. The
selected scanner populates your asset profile data including the host information,
ports, and potential vulnerabilities.
You must configure scanners using the Administration Console. For information on
accessing the Administration Console, see the STRM Administration Guide.
Step 2 Schedule vulnerability assessment. See Chapter 10 Managing Scan Schedules.
Step 3 View the results of the asset profile. See Chapter 11 Viewing Asset Profile
Information.
Note: If you add, edit, or delete a scanner or if you add, edit, or delete a scheduled
vulnerability assessment scan, you must select Configurations > Deploy
Configuration Changes from the Administration Console menu for the changes to
take effect.
The results of the scan provides the operating system and version on each CIDR,
server, and version of each port. Also, the scan provides the known vulnerabilities
on discovered ports and services.
Viewing Scanners To view currently configured scanners:
Step 1 In the Administration Console, click the SIM Configuration tab.
The SIM Configuration panel appears.
Step 2 Click the VA Scanners icon.
The VA Scanners window appears.
The VA Scanners window provides the following details for each scanner:
Table 1-1 Scanner Parameters
Parameter Description
Name Specifies the name of the scanner.
Type Specifies the type of scanner, for example, Nessus Scan Results
Importer.
Host Specifies the IP address or host name of the host on which the
scanner operates.
Approved CIDR
Ranges Specifies the CIDR range(s) you wish this scanner to consider. Multiple CIDR ranges are displayed using a comma separated
list.
Description Specifies a description for this scanner.

Managing Vulnerability Assessment
Viewing Scanners 7
Status Specifies the status of the scanner schedule.
Table 1-1 Scanner Parameters (continued)
Parameter Description