DESIGN GOALS - FERRET


Previous tools for checking host vulnerabilities, like COPS and Tiger, have 
several limitations. For example, they do not offer easy ways to modify the 
set of vulnerabilities checked. The design goals of Ferret address of the 
limitations of such previous tools. Moreover, some of the design goals of 
Ferret follow the design goals used for Nessus, which contributed to the 
popularity of Nessus among the security community as a network 
vulnerability-checking tool. Indeed, Nessus is free, open-source, and based 
on plug-ins, and targets multiple operating systems. More specifically, 
Ferret's design goals are as follows.

Since the field of computing security changes extremely rapidly, checking 
vulnerabilities requires a modular approach. To this end, the framework for 
Ferret is designed to use independent plug-in modules, or plug-ins, for each 
vulnerability that it checks. This allows quick development and deployment 
of new vulnerability checks that do not require modification to the management 
portion (or core) of Ferret. In addition, plug-ins should be capable of 
interacting with a variety of other vulnerability checking tools, without 
affecting the core.

The plug-ins are designed to be as specific to particular vulnerabilities as 
possible, allowing each vulnerability plug-in to check only a single 
vulnerability. The decision to use that approach, instead of larger 
multi-purpose plug-ins, made it possible to check new vulnerabilities without 
modifying the code for the old vulnerabilities. The keyword functionality 
described later can be used to group the specific vulnerabilities into larger 
groups of vulnerabilities.

Much of the security field revolves around quick response to new 
vulnerabilities and the sharing of those findings among the security 
community. To help with this need, Ferret has been designed as an open-source 
project, with the goal of creating a community of contributors that will help 
keep the available vulnerability plug-ins current with security discoveries. 
This will facilitate the rapid development of new vulnerability-checking 
plug-ins when new vulnerabilities are found.

Scanning a large server with many files and users can be very time-intensive, 
and use large amounts of resources, especially when the number of 
vulnerabilities to check for is large. Ferret is designed to be fast and 
efficient, choosing performance and simplicity over complex additional 
features.

There are many different operating systems in use today, all of which have 
some unique vulnerabilities and some vulnerabilities that they share with 
others. The core of the Ferret system is designed to be platform-independent, 
and as many of the vulnerability checking plug-ins as possible are also 
platform-independent. In some cases, the vulnerability checked is specific 
to one platform, and thus the associated plug-in needs to be platform 
dependent. The framework is set up in such a way as to allow the individual 
vulnerability checking plug-ins to specify which operating systems they are 
relevant for, to allow the most flexibility for each plug-in. This allows a 
great flexibility, as each plug-in can choose whether to run on all systems 
or only those that is is applicable for.

To better allow the organization and grouping of the numerous vulnerability 
plug-ins, a keyword-grouping functionality was designed into the management 
portion (or core) of Ferret. Each plug-in will have a list of keywords 
associated with it that will allow relevant plug-ins to be selected without 
requiring all to be run.

To facilitate the generation of relevant reports from the tool, the output 
format was also designed to be modular, using output plug-ins to generate a 
report from Ferret's raw data. This allows the most flexibility in creating 
reports, which can range from raw text files to a centralized database using 
MySQL.

Based on different requirements, plug-ins may have to collect different 
information about vulnerabilities. For each of the different customized 
requirements there should be a corresponding mode. For example, two modes 
have now been implemented in Ferret. One mode indicates which vulnerabilities 
are present on the host. The second mode also provides information on how a 
vulnerability could be exploited and what privilege could be gained. This 
second mode is particularly helpful in building privilege graphs, which are 
a useful component for the evaluation of a system's security.