Skip to content
This repository has been archived by the owner on May 11, 2018. It is now read-only.

Automatically scores how well Windows systems have implemented some of the top 10 Information Assurance mitigation strategies. #nsacyber

License

Notifications You must be signed in to change notification settings

nsacyber/Splunk-Assessment-of-Mitigation-Implementations

Repository files navigation

Splunk Assessment of Mitigation Implementations

Mitigation implementations have not traditionally been evaluated or prioritized. NSA Information Assurance recommends mitigation strategies but there are few methods to validate proper implementation and prioritize fixes. The SAMI application was developed to monitor the degree to which specific aspects of the NSA Information Assurance top 10 mitigation strategies have been deployed on Windows endpoints. It monitors data related to the implementation of specific mitigations and returns prioritized recommendations to more completely implement those recommendations. The application can be used to determine a network’s mitigation implementation status and can be monitored over time to demonstrate improvements and identify changes that negatively impact mitigations.

SAMI evaluates several metrics:

  • Modern Operating System (MOS)
  • Anti-Virus File Reputation Service (AVFRS)
  • Host Intrusion Prevention System (HIPS)
  • Application Whitelisting (AW)
  • Anti-Exploitation (AE)
  • Pass-the-Hash (PtH)

The application aims to make automated measurement of mitigations both common and understandable. More specifically, the goals for SAMI are to:

  • Establish the importance of measuring mitigations;
  • Jumpstart community discussion on the topic;
  • Motivate vendors to support and build upon the capabilities;
  • Establish the concept and process of scoring mitigations as part of vulnerability risk scoring

Components

There are two main components:

  • SAMI - Main application.
  • SAMI-TA - Addon for data collection pieces of the SAMI application.

These components are available as Splunk applications and can be downloaded from Splunkbase:

The source code for the binary components (ae.exe and av.exe) in SAMI-TA are available in the LOCKLEVEL repository.

Documentation

Documentation available for SAMI:

A session about SAMI was given at Splunk .conf2015:

License

See LICENSE.

Disclaimer

See DISCLAIMER.

About

Automatically scores how well Windows systems have implemented some of the top 10 Information Assurance mitigation strategies. #nsacyber

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published