topic Re: Certificate vulnerabilities in Advanced Threat Prevention Discussions

Certificate vulnerabilities

mcruz10 — Tue, 05 Oct 2021 03:30:18 GMT

I have found several of my network devices are showing up within our vulnerability management scanner with X.509 Certificate Subject CN does not match the entity name as a vulnerability. This is more than likely a DNS issue as I do not have any network devices with DNS records. I have been told conflicting opinions and would like to know how do I find the best practices on this finding. Which one would be the most accurate process that I should follow:

It is best practice not to place DNS records on my network devices as it will make them unrecognizable on the public-facing side. Therefore, security by obscurity.
Attempt to place DNS records as this secures all devices and allows for security teams to identify and ensure that these devices are behaving as needed through the SIEM.

Re: Certificate vulnerabilities

OtakarKlier — Wed, 06 Oct 2021 21:33:39 GMT

Hello,

This can be several things or steps to remediate. Yes you should at least be running PKI certs from your internal cert authority, AD is great for this. Also the device that is performing the scans need to have those PKI root certs imported so that it can validate the internal PKI you are using.

Hope I got the question interpreted correctly.

Cheers!

Re: Certificate vulnerabilities

Wallace15 — Fri, 08 Oct 2021 07:10:32 GMT

Vulnerabilities in SSL Certificate is a Self Signed is a Medium risk vulnerability that is also high frequency and high visibility. This is the most severe combination of security factors that exists and it is extremely important to find it on your network and fix it as soon as possible.