DASM Administration Guide

• Administration and Feature Usage
• Typical Use Cases
• Data Attack Surface Manager Main Dashboard
• Data Attack Surface Manager Offensive Actions
• Dynamic DataShield Policy Operations
• Data Classification - How it Works
• Data Classification Categories
• Operations
• Local Login
• Active Directory Login
• 2FA with Google Authenticator
• Alert and Webhook Configuration with Data Security Edition
• Software Start/Stop
• Log Gather For Support

Administration and Feature Usage

Typical Use Cases

1. Identify high risk hosts for rapid remediation, patching and hardening.
   1. Features needed:   The base feature that produces an AI predicted data attack surface
2. High Security Data Risk.  Set security baseline for hosts or users to access data
   1. Features needed: Dynamic DataShield autonomous enforcement policies

Data Attack Surface Manager Main Dashboard

1. The main dashboard shows the data attack surface.
   1. The columns indicate the contributing factors to the Data Risk Score shown the Vulnerability Level. 
   2. If Data Classification is enabled. The PII score rates the level of PII data that was detected from this host and user combination.    
   3. The Access list shows the number of SMB or NFS exports the host has access to by user or by ip address
   4. Open ports indicates the listening ports on the client that could be used by an attacker to comprimise the host.
   5. The Anomaly column indicates if the user behavior profile indicates any abnormal deviations of reads or writes to data that would indicate suspicious user behavior.
   6. The CVE score is an average of all CVE found in the scan results.
   7. The CVE description shows a list of some of the CVE's found on the host.
   8. The CVE last scan indicates how current the scan results are when used to predict the Data Risk Score
2.  

Data Attack Surface Manager Offensive Actions

1. Offensive Remediation:
   1. DVM supports remediation for high risk hosts and users with host level blocking.  This allows high risk hosts to be blocked from accessing data until remediation can be completed and unblocking allows the host to access data.
   2.  
2. Risk Discovery
   1. Identify Data Attack Surface hosts with no vulnerability scan results exposing data and user accounts to breach from zero day or malicious actor that has joined a machine to the network.   
   2.   
   3. SOC Analysts can chose to block hosts without a completed vulnerability scan assessment.
3. Autonomous Data Shield (DDS) Policies 
   1. 
   2. The DDS policies allows creation of policies that automate the remediation of high risk data score hosts and users from accessing data until minimum security assessment is complete or the DRS (Data Risk Score) drops below a specific threshold.
      1. Create policy will require the following fields (Matching criteria will use AND logic for all 3 fields to match)
         1. name - text field - describes the policy purpose.
         2. source host IP - IP address range - x.x.x.x/yy syntax to identify source computers by network, default “*” which means any source ip
         3. Data Risk Score (mandatory field) - drop down of risk scores => greater and equal to. example medium means medium and above DRS (Data Risk Score)
         4. Path - absolute path , input will be absolute path example /ifs/marketing (which will be treated as /ifs/marketing/* all paths under the marketing folder. NOTE: we will ignore device name for now so this means a path can apply to any device under management, the risk of path overlap is low
            1. default will be any path
         5. Action
            1. Once a policy is created DDS monitors incoming audit data to match criteria and enforce host lockouts.
            2. Unblock logic - DDS will reassess on an hourly basis, if the AI model  assessment of the DRS (Data Risk Score) indicates the the threat level has dropped equal to or Less than < DRS score, the host level unblock logic is executed and a webhook alert is sent.
            3. Host lockouts will update the policy dashboard to display status.
            4. The main dashboard in DVM  will show column for policies in the dashboard under the  “Autonomous data protection policy name”.
            5. Alerting
               1. Each time a policy acts with a lockout response. The following will occur happen:
                  1. A webhook using the superna Zero Trust payload schema will be sent so that Incident Response teams will be informed that autonomous security policies have been activated or deactivated.

Dynamic DataShield Policy Operations

1. When DDS policies activate the dashboard will show locked status and the policy name that triggered the lockout on the host
2. 
   
3. 
4. Each hour the Superna Data AI inferencing runs to re-evaluate the Data Risk Score of the attack surface including any hosts that a lockout has been applied.  If the DRS score falls below the policy definition the lockout is removed.

Data Classification - How it Works

1. Overview: This feature adds valuable data to the Superna AI model to influence the Data Risk Score based on the type of data a user is accessing.    The classification can can detect and classify using NLP (Natural Language Processing) and pattern-matching techniques. The methods of classification support the following methods.   
   1. Pretrained spaCy models (for names, locations, etc.)

   2. Regex patterns (e.g., SSNs, credit card numbers)

   3. Checksum validation (for entities like credit cards and IBANs)

2. How it works

   1. Users that are detected on high risk data attack surface hosts have their most recent activity sampled with a default of 10% of the files touched by a user. The results are leveraged to compute a PII score between 0 to 10 with 10 being the highest and this influences the AI model predictions.

   2. The current solution uses snapshots on file systems that are NFS mounted to read any data over a read only NFS mount.  The snapshot is deleted after the processing of user files is completed.   This ensures the snapshot will not consume space when it is not required.

Data Classification Categories

Identity & Demographics (6)

Sensitive Numbers & Codes (7)

Digital Identifiers & Network Data (6)

Location-Based Identifiers (2)

Professional & Organizational (2)

 National IDs (Non-US) (1)

Summary Table

Operations

Local Login

1. Open a new Browser tab and point to this URL https://<ip-address-of-dvm-vm>:5001/. It will open the initial login page
   1. The default user login is dasmadmin default password Vuln3r@b1l1ty!
   2. 
      ​

Active Directory Login

1. This requires the OS to be joined to Active Directory with the steps below:
2. Login to the OS over ssh as admin user with default password 3y3gl4ss
3. sudo -s 
4. enter admin password
5. sudo yast2 samba-client
6. Complete the dialog box to authenticate and join your AD domain
7. Once completed successfully the login page will support user@domain syntax AD login
8. 
   

2FA with Google Authenticator

1. This solution will support login to a local user account or AD account + the addition of the One time Password provided by the Google authenticator application.

Alert and Webhook Configuration with Data Security Edition

Software Start/Stop

Log Gather For Support

1. cd /mnt/ml_data/ml-cvm​
2. python3 cvm_loggather.py
3. This command will generate a zip file that can be uploaded to support cases