[u06a1] Week 6 Assignment: Identifying Risks, Threats, and Vulnerabilities in an IT Infrastructure Using Nmap and Nessus Reports

Overview

Vulnerability scanners test vulnerabilities to see if they exist but also to see if they have been properly closed after a patch or control has been put in place. There are two widely used vulnerability scanners, Nmap and Nessus, which produce scan reports. By using these reports, you can identify operating systems, services, hosts, open ports, and applications that are vulnerable in an organization. As part of this assignment, you will download the Nmap software and use a test site provided by Nmap to run a number of scans. See the Week 6: Identifying Risks, Threats, and Vulnerabilities in an IT Infrastructure Using Nmap and Nessus ReportsLinks to an external site. reading list.

Nmap Test Network Scan

Go to this Downloading Nmap site and download the latest stable release of Nmap for the operating system that you use. You will want to download the self-installer. For example, if you are using a Windows operating system you will look for a link that looks similar to this: Latest stable release self-installer: nmap-7.70-setup.exe. Note: The version number may have changed, but the description of the download will be similar.

To do this test:

1. Click the setup.exe file that downloads and follow the instructions on the screen, leaving all default settings selected. Note: Once Nmap is installed, you should see an icon on your desktop that you can use to run Nmap.
2. Open Nmap.
3. Type scanme.nmap.org in the Target field.
4. Select Quick scan from the Profile drop down list.
5. Click Scan. A list appears of the ports, the state of each port, and the service.
6. Take a screenshot of the scan results and copy it at the bottom of the Word document used for Part 1.
7. Run a Regular scan and one other scan of your choice, taking screenshots of each and adding to the Word document.

Underneath your screenshots write a brief summary of your experience using Nmap and discuss briefly what the scan results showed you.

You can learn more about the Nmap interface and interpreting scans at Interpreting Scan Results.

Instructions

1. Once you have completed your Week 6 lab activity, write your lab report as directed in the lab.
2. Complete the Nmap test network scan for Part 2.
3. Add the screenshots from Part 2 to your lab report.
4. Upload the lab report with the test network scan screenshot to the assignment this week.

Assignment Criteria

Your assignment must meet these criteria. Please refer to the rubric for this assignment.

• Review an Nmap network discover and port scanning report and a Nessus software vulnerability report.
• Identify minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report.
• Identify operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report.
• Use the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities and conduct searches on this site and describe the search results.
• Download, install, and use Nmap to run a variety of vulnerability scans.
• Use style and vocabulary generally appropriate to the message and intended audience.

Assignment Requirements

• Lab Report: Lab report with elements described in the assignment criteria including screenshots from the Nmap test network vulnerability scan. This report is considered a professional document. See the Writing CenterLinks to an external site. for helpful resources.
• Written communication: Written communication is free of errors that detract from the overall message.
• APA formatting: Resources and citations are formatted according to APA style and formatting.
• Length of paper: At least 5 pages, excluding the references page.
• Font and font size: Times New Roman, 12 point.

Competencies Measured

By successfully completing this assignment, you will demonstrate your proficiency in the following course competencies and rubric criteria:

• Competency 1: Analyze the range and level of threat that exists in cyberspace.
• Use the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities and conduct searches on this site and describe the search results.
• Competency 3: Analyze information technology systems to discover vulnerabilities that introduce risk to the organization.
• Review an Nmap network discover and port scanning report and a Nessus software vulnerability report.
• Identify minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report.
• Identify operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report.
• Download, install, and use Nmap to run a variety of vulnerability scans.
• Competency 6: Communicate effectively to a range of professional and technical audiences.
• Use style and vocabulary generally appropriate to the message and intended audience.

View RubricIdentifying Risks, Threats, and Vulnerabilities in an IT Infrastructure Using Nmap and Nessus ReportsIdentifying Risks, Threats, and Vulnerabilities in an IT Infrastructure Using Nmap and Nessus ReportsCriteriaRatingsPtsReview an Nmap network discover and port scanning report and a Nessus software vulnerability report.8.5 to >7.23 ptsDISTINGUISHEDReviews an Nmap network discover and port scanning report and a Nessus software vulnerability report and provides an in-depth description of the report details.7.23 to >5.95 ptsPROFICIENTReviews an Nmap network discover and port scanning report and a Nessus software vulnerability report.5.95 to >0 ptsBASICReviews an Nmap network discover and port scanning report and a Nessus software vulnerability report, but the review is vague or missing key points.0 ptsNON_PERFORMANCEDoes not review an Nmap network discover and port scanning report and a Nessus software vulnerability report./ 8.5 ptsIdentify minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report.9 to >7.65 ptsDISTINGUISHEDIdentifies minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report and provides a rationale for why there are vulnerabilities.7.65 to >6.3 ptsPROFICIENTIdentifies minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report.6.3 to >0 ptsBASICIdentifies some of the minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report.0 ptsNON_PERFORMANCEDoes not identify minor, major, and critical software vulnerabilities from the Nessus vulnerability assessment scan report./ 9 ptsIdentify operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report.9.5 to >8.08 ptsDISTINGUISHEDIdentifies operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report and provides the significance of these network components to network security.8.08 to >6.65 ptsPROFICIENTIdentifies operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report.6.65 to >0 ptsBASICIdentifies some of the operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report.0 ptsNON_PERFORMANCEDoes not identify operating systems, applications, services, hosts, and open ports on devices from the Nmap scan report./ 9.5 ptsUse the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities and conduct searches on this site and describe the search results.9 to >7.65 ptsDISTINGUISHEDUses the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities and conduct searches on this site and provides details and insight about the search results.7.65 to >6.3 ptsPROFICIENTUses the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities to conduct searches on this site and describes the search results.6.3 to >0 ptsBASICUses the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities to conduct searches on this site, but does not describe the search results.0 ptsNON_PERFORMANCEDoes not use the Common Vulnerabilities and Exposures (CVE) online listing of software vulnerabilities to conduct searches on this site./ 9 ptsDownload, install, and use Nmap to run a variety of vulnerability scans.9 to >7.65 ptsDISTINGUISHEDDownloads, installs, and uses Nmap to run a variety of vulnerability scans and provides details and insight about the vulnerability scans.7.65 to >6.3 ptsPROFICIENTDownloads, installs, and uses Nmap to run a variety of vulnerability scans.6.3 to >0 ptsBASICDownloads, installs, and uses Nmap to run a variety of vulnerability scans, but does not describe the results of the vulnerability scans.0 ptsNON_PERFORMANCEDoes not download, install, and use Nmap to run a variety of vulnerability scans./ 9 ptsUse style and vocabulary generally appropriate to the message and intended audience.5 to >4.25 ptsDISTINGUISHEDUses style and vocabulary fully appropriate to the message and intended audience.4.25 to >3.5 ptsPROFICIENTUses style and vocabulary generally appropriate to the message and intended audience.3.5 to >0 ptsBASICUses style and vocabulary somewhat appropriate to the message and intended audience.0 ptsNON_PERFORMANCEDoes not use style and vocabulary appropriate to the message and intended audience./ 5 ptsTotal Points: 0