Operating Systems Vulnerability Assessment Project Report

This project details the process of assessing operating system vulnerabilities in both Windows and Linux environments. The assessment utilizes Microsoft Baseline Security Analyzer (MBSA) for Windows and OpenVAS for Linux, two widely-used tools for identifying security misconfigurations and missing updates. The project involves the installation, configuration, and execution of these tools, followed by an analysis of the scan results to identify vulnerabilities. Specifically, the report demonstrates the use of MBSA to identify missing service packs and updates on a Windows system, and OpenVAS to detect vulnerabilities on a Linux system. The final step involves creating a comprehensive security assessment report summarizing the findings, including the identified vulnerabilities, their severity levels, and potential remediation steps. The report highlights administrative vulnerabilities and weak passwords, and provides a clear overview of the security posture of the assessed systems.

Lab Experiment
(Step 4 and Step 5)

Table of Contents
Step 4 - Review Vulnerability Assessment Tools for OS and Applications...............................1
1. Windows OS using Microsoft Baseline Security Analyzer..............................................1
2. Linux OS using OpenVAS..................................................................................................7
Step 5 - Create the Security Assessment Report.......................................................................14
References.....................................................................................................................................15

Step 4 - Review Vulnerability Assessment Tools for the Operating System &
Applications
This step reviews the OS and application’s vulnerability assessment tools by using the
vulnerability and security assessment analysis tools. Microsoft Baseline Security analyzer is used
for the Windows OS, and for Linux, OpenVAS is utilized. Because, these two tools are standard
and also it is developed for providing the streamlined method to determine the common security
misconfiguration, and the missing security updates for the OS and applications. These two tools
also work on layer 5 to 7 of the OSI model.
1. Windows OS using Microsoft Baseline Security Analyzer
First, the MBSA tool for Windows VM is used to determine the vulnerability and security
assessment analysis.
MBSA helps the administrators to scan the system for common security misconfiguration
and missing security updates. This tool helps the server operating system, IIS and SQL server.
To do MBSA vulnerability assessment, first download and install the MSBA on Windows
VM. The involved steps are demonstrated below ("Check Your Windows System for
Vulnerabilities with Microsoft’s Free Baseline Security Analyzer", 2019).
First, download the MBSA setup file, then right click on the downloaded file and press
the RUN button, which opens the following wizard.
1

Press the Next button for opening the License agreement page. Proceed by clicking on I accept
the license agreement. Further, enter next button as shown below.
Choose the destination directory and click on the Next button.
2

Then, continue the installation by clicking on the install button.
3

Once installation is completed, the following popup will be displayed then click on the
OK button.
Open MBSA and select Scan a computer to check Windows operating system
vulnerabilities.
As Scan a computer wizard is opened, choose enter the computer name as computer.
4

Once, everything is setup appropriates, click on Start scan button to scan a computer
(Elias, 2019).
Once scanning is completed, the following results will be displayed, where MBSA has
5

discovered two service packs or updates that the rollups are missing. Click on the result details,
and it shows the details of missing updates. The determined vulnerabilities are presented below.
6

Next, vulnerabilities are resolved by clicking on how to correct them on help page, which
is used to provide the easy solution for the below displayed vulnerabilities.
2. Linux OS using OpenVAS
Further, OpenVAS is used on Linux VM to determine the vulnerability and security
assessment analysis. OpenVAS is a one of the advanced open source vulnerability scanner and
manager, which performs vulnerability analysis and assessment. It helps to determine the
vulnerabilities that could be easily ignored during the manual assessment.
To do OpenVAS vulnerability assessment, first install OpenVAS on Linux VM (dookie,
2019).
Install OpenVAS on Linux VM by typing the below command.
7

OpenVAS setup takes long time to update and download all the required SAP, CVE
definitions.
OpenVas setup generates password during the installation and is printed on the console at
the end of the setup.
8

Verify OpenVas on Linux by typing the below command,
Once verification is completed, start OpenVAS by typing the below command on a
terminal.
After the installation, the following address is used to access OpenVAS web application,
https://127.0.0.1:9392
It is presented below ("OpenVAS - Vulnerability Assessment install on Kali Linux", 2019).
9

In this case, add exception security is added to acknowledge a self-signed certificate.
10