Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Tracking Down Privilege Escalation Failures

Credentialed scanning is a key aspect of any vulnerability management program, but how can you be sure the scans are successful? Changes to infrastructure or specific hosts could result in the wrong credentials being used to elevate privileges during scans. If this happens, your scans could fail to gather the vulnerability data essential to effectively implementing your vulnerability management plan. The Tenable.io™ Elevated Privilege Failures report can give you detailed insight into the *nix hosts in your network that may not be getting scanned as thoroughly as believed.

Privilege escalation in credentialed scans

Configuring a non-root account on all scan targets is recommended when running credentialed scans

When SSH is used for credentialed scanning, you have the option of specifying an account to use for privilege elevation. This feature lets you use a non-root account for the scan to log in via SSH. The scan will then escalate privileges with the configured root account to gather data that is not available to non-root users. The method of separately logging in and elevating privileges keeps root credentials off the wire, thereby being more secure. Therefore, configuring a non-root account on all scan targets is recommended when running credentialed scans.

Elevated Privilege Failures report: scan credentials

The Tenable.io solution

Tenable.io can efficiently identify hosts where privilege escalation in credentialed scans has failed. The Elevated Privilege Failures report provides detailed information on these hosts.

Elevated Privilege Failures report

The Elevated Privilege Failures report provides you with comprehensive and detailed lists of the hosts on your network that may not be getting scanned thoroughly. This information is broken down by operating system and host. The Elevated privilege failure summary by Operating System pie chart shows privilege escalation failures by operating system and could indicate whether recent configuration changes may have caused the failures to start happening. For example, you will be better able to track the source of failures if the root account password has been changed for a specific operating system but not network-wide.

Elevated Privilege Failures report pie chart

The Systems with elevated privilege failures table lists which hosts’ failures have been detected based on the results of the Authenticated Check: OS Name and Installed Package Enumeration plugin (ID 12634). The table filters for plugin results that contain a phrase indicating that local privileges were not successfully elevated. This table also acts as an index for the next table, which provides more in-depth information about the hosts impacted.

Elevated Privilege Failures report IP list

The vulnerability details table lists results from plugin ID 12634, including the plugin output, for each host impacted. Details about the host, such as the IP and MAC addresses, are provided along with the plugin output that describes the attempt and failure to elevate the privileges of the scan account.

Elevated Privilege Failures report IP detail

Regardless of your approach to credentialed vulnerability scanning with Tenable.io, ensuring proper credential configuration is the first step to gathering thorough scan results. Tenable.io provides information security professionals with the tools and resources needed to perform accurate and rigorous credentialed vulnerability scanning. The Elevated Privilege Failures report provides insight into potential failures impacting the accuracy of credentialed scanning. Armed with Tenable.io, you can be sure that your credentialed scans are able to gather all available data.

Ensuring proper credential configuration is the first step to gathering thorough scan results

Try Tenable.io

Tenable.io provides accurate information on how well your organization is addressing security risks and helps track improvements over time. Get a free trial of Tenable.io Vulnerability Management for 60 days.

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training