学生宿舍网信息安全风险评估13p

1、/个JxL卜佥评佔【经典资料，WORD文档，可编辑修改】【经典考试资料，答案附后，看后必过，WORD文档，可修改】学生宿舍网信息安全风险评估班级：信息安全XXX班姓名：XXX学号：?J 、/.目录实验2:学生宿舍网信息安全风险评 估2一、实验目的4二、实验步骤4三、实验记录4四、宿舍信息安全风险评估报告9一、实验目的学习利用信息安全风险评估的有关技术、方法和工具对学生宿舍网络进行信息安全风险评估，将评估 结果形成一个完整的评估报告。（所使用的技术、方法和工具不限）二、实验步骤（1）使用Holes扫描本机（2）使用Nessus扫描本机和路由器（3）对报告中的警告进行分析三、实验记录用holes漏

2、洞扫描软件，扫描本机目标IP地址为：扫描目标主机开放的端口：21号端口 （ftp）开放！135号端口（epmap）开放!139 号端口 （netbios-ssn） 开放！开始扫描FTP漏洞：FTP服务器的Banner:测试匿名用户没有匿名用户开始扫描SMTP!洞：目标没有开放 SMTF服务.开始扫描FINGER漏洞：目标没有开放FINGER服务开始扫描CGI漏洞：目标没有开放WW服务开始扫描IIS漏洞：目标没有开放WW服务开始扫描RPC漏洞：目标没有开放RPC查询服务说明：扫描NTUSE漏洞：-一此功能基于NT/2K以上版本的系统开始查询SHARES列举netbios共享(尝试winnt/20

3、00系统).要等待一段时间NetBIOS Share ResultsShare Enu merati on Error (0)列举netbios共享(尝试win95/98).要等待一段时间 Share Enu merati on Error (0)开始查询USERS列举用户名要等待一段时间User Enu merati on Error:(5)开始查询GROUPS列举工作组要等待一段时间开始查询TRANSPORTS列举netbios transports.要等待一段时间A system error has occurred: 5Total of 0 en tries enu merate开始查

4、询DATETIME列举时间.要等待一段时间.A system error has occurred: 5开始查询SERVICES列举服务.要等待一段时间.Error with Ope nSCMa nager开始查询SESSIONS列举空会话(NULLSESSION)要等待一段时间Null Session NOT Established Error: 67.列举空连接(NULLDISCONNECT)要等待一段时间 Null Session NOT Termi nated Error: 2250.开始查询REGISTRY列举远程注册表.要等待一段时间 RegCo nn ectRegistry (H

5、KEY_PERFORMANCE_DATA) ERROR: 5RegCo nn ectRegistry ERROR: 5开始查询MORE远程解析主机信息OS is UNIX/LINUX or OS Detection Error 5:扫描完毕！ !本机win8系统，软件比较老，对版本信息列举不足，不过，基本的端口和协议来看，系统比较安全。漏洞扫描器扫描Ml注的目标机器的H|192.163.1 22开始扫描停止扫描扫揃项目7 FTF 7 Finger “ USR/ SHTF 丽 CGI M ItPC 厂SHASES P GROUTS V DATEriNE R7 SESSIQBS 啟 MOM

6、1; USERS 啟 THAKF0RTS 7 SERVICES R? REGHSTKT 厂清隐显示关于保存记录减 hOle3S定版FOR IIM9X/TIME/iT/ri»2KhDL«安全扫描工具Author by HDRSE_E CopyRicht (C) 2000 - 2001列举服务.要等蒔一段时间Error with Up电诟匚卅gag电r 开贻查询S出SICIMS :列举空会话0MI5ESSION .要等荐一段时间一Kull Session I0T Established Errr: 57 列卒空连接aHJLLDISCOIfflECT).要尊待一段时间Kull S

7、ewsig HOT Terminated Errsr: 2250. 开始查询REGISTRY :列卒远程注珊表.要等待一段时间.CKKEY_FEKFOBHANCE_DATA) ERBCR' 5AagCcirmftctRegistry ERROR: 5 开查询MOKE :远程解析主机信扈.OS is IDTTJC/nm 吹 OS 加七乂订皿 Error 5: 扫描完毕！ ! TThe audit was performed on 2 systems, 2 of which were found to be active and were sca nned.vulnerabilities

8、by Seventy.o.5e.5.cl;5Q.5.o4 3 3 2 2 1 1 o oNodes by Vulnerability SeverityCrilieaiSeveieModerateCle»nDM:1 口 5 口 5 5 D .o了.5.2.0了.5.2.0 2 11110 D D DCriticalSvvtrvMa d» rat*There were 4 vulnerabilities found during this sean. No critical vulnerabilities were found. Critical vulnerabilities

9、 require immediateattention. They are relatively easy for attackers to exploit and may provide them with full control of the affected systems. 4vuln erabilities were severe. Severe vuln erabilities are often harder to exploit and may not provide the same access to affectedsystems. There were no mode

10、rate vuln erabilities discovered. These ofte n provide in formati on to attackers that may assist them in moun ti ng subseque nt attacks on your n etwork. These should also be fixed in a timely manner, but are not as urge nt as the other vuln erabilities.No critical vulnerabilities were found on any

11、 of the systems. 2 systems were found to have severe vulnerabilities. No moderatevuln erabilities were found on any systems. No systems were free of vuln erabilities.Most Common Vulnerabilitiescifs-xrnbtigning-dlixjibltd亡如 mbti gni no- eel厲 4 u i>«dicp-ie uim-jp pfnid m a lionMost Common Vul

12、nerability Categories CIFS-50% Denial of Service - 25% Network-25%There were 2 occurre nces of thecifs-smb-sig nin g-disabled,cifs-smb-sig ning-no t-requiredandtep-seq-nu m-approximati onvuln erabilities, maki ng them the most com mon vuln erabilities. There were 4 vuln erabilities in the CIFS categ

13、ory, making it the mostcom mon vuln erability category.Highest Risk Vulnerabilitiesu ifs-sm b-sig oio g-n ot- re q uiiire dc IH- *m b-sig ruling- dlsd bledtc p-se q-o u m- a p p irexiiim ati o nvulinerabiiiliitiesO IO 2030-40500070 SO 0100Page 2Audit ReportThe cifs-smb-signing-not-requiredand cifs-s

14、mb-signing-disabled vulnerabilities pose the highest risk to theorganization with a riskscore of 100. Vulnerability risk scores are calculated by looking at the likelihood of attack and impact, based uponCVSS metrics.The impact and likelihood are then multiplied by the number of instances of the vul

15、nerability to come up with the final risk score.One operating system was identified during this scan.There were 4 services found to be running duri ng this sca n.所以另外找了 Nessus, Nessus被认为是目前全世界最多人使用的系统漏洞扫描与分析软件。漏洞库比 较完善。使用Nessus扫描本机，发现一个中等危险的漏洞。查询其详细信息为firih<nlCcNTBLDd: Dec 1, 201214:44fifflh<n

16、l Wu|rw»MW Swihwx I hfcrQMTBLDd: hBC 1, 2<FI214:44在报告中给出了一些解决方法。Soluti on:Enforce message signing in the host's configuration. On Windows, this is found in the LocalSecurity Policy. On Samba, the setting is called 'server signing'.See the 'see also' links for furtherdetai

17、ls.中文意思大概为：加强信息登录主机的配置。在Windows中，被发现在本地安全策略。在samba中，设置被称为的服务器签名“。四、宿舍信息安全风险评估报告评估工作概述：于2012年11月30日至12月1日开展了信息安全 风险自评估工作。评估范围：本次评估范围是宿舍的个人计算机系统。本系统是基于微软的windows操作系统，图形化界面，对硬件、软件的兼容性好，方便冋学日常的学习与娱乐使用。主要功能有：(1) 网络浏览、收发邮件、即时通讯、网络购物等。(2) 听音乐、看电影、游戏、制作文本、PPT文件等。评估组织：以个人的形式，对本人的计算机信息安全进行评估。评估依据和标准：依靠现成的系统漏洞

18、扫描工具，对系统进行安全评估。使用holes、Nessus等工具。资产识别：资产风险值表一一硬件资产序号资产名称重 要 程 度威胁类威胁发 生可能 性威胁影响程度威胁风险系数资产风险值是否可 接受风 险风险等级1防火墙60操作失误225150是极低MAC地址过滤功能 设置不合理349350否低维护错误136180是极低负载过重339300否中等原发抵赖237150是极低未授权访问资源336230否低2认证服务50操作失误328240否低木马后门攻击3315450否高数据库风险3315450否高设备硬件故障225150是极低系统负载过载3218300否中等网络病毒传播21260是极低330操作失误11130是极低SAM计费管理服 务维护错误239270否低未授权访问资源12390是极低4