Mitigation implementations have not traditionally been evaluated or prioritized. NSA Information Assurance recommends mitigation strategies but there are few methods to validate proper implementation and prioritize fixes. The SAMI application was developed to monitor the degree to which specific aspects of the NSA Information Assurance top 10 mitigation strategies have been deployed on Windows endpoints. It monitors data related to the implementation of specific mitigations and returns prioritized recommendations to more completely implement those recommendations. The application can be used to determine a network’s mitigation implementation status and can be monitored over time to demonstrate improvements and identify changes that negatively impact mitigations.
SAMI evaluates several metrics:
- Modern Operating System (MOS)
- Anti-Virus File Reputation Service (AVFRS)
- Host Intrusion Prevention System (HIPS)
- Application Whitelisting (AW)
- Anti-Exploitation (AE)
- Pass-the-Hash (PtH)
The application aims to make automated measurement of mitigations both common and understandable. More specifically, the goals for SAMI are to:
- Establish the importance of measuring mitigations;
- Jumpstart community discussion on the topic;
- Motivate vendors to support and build upon the capabilities;
- Establish the concept and process of scoring mitigations as part of vulnerability risk scoring
There are two main components:
These components are available as Splunk applications and can be downloaded from Splunkbase:
- SAMI - Splunk Assessment of Mitigation Implementations
- Technical Addon for SAMI Application (TA-SAMI)
The source code for the binary components (ae.exe and av.exe) in SAMI-TA are available in the LOCKLEVEL repository.
Documentation available for SAMI:
- User instruction manual:
- Business logic
A session about SAMI was given at Splunk .conf2015:
See LICENSE.
See DISCLAIMER.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent