Scope, authorization and method of an internal audit

Objective

Understand why an administrator must know what their own machines expose, within which legal framework they are allowed to check it, and follow a simple internal audit method. You will finish with a first scan… of your own VM.

Key points

• Nmap is an inventory tool: it tells you which ports answer on a machine and which services run there. For an administrator, it is the equivalent of a property inspection.
• You only scan your own machines or a network for which you hold a written authorization from the organization. Without it, it is an offense (Moroccan Penal Code, articles 607-3 and following).
• An audit is scoped before it starts: exact scope (addresses), sponsor, authorization document, time window, emergency contact.
• You log every command you run, with the date and time: it is your proof that you stayed within the scope.
• In this course, all exercises target 127.0.0.1, that is, your VM itself.

Why inventory your own machines?

Take Samira, a technician in a logistics SME in Tangier. Her file server was installed three years ago by a contractor. Nobody knows exactly what runs on it. One day, an old, forgotten remote administration service lets ransomware in.

Attackers inventory your machines in a few seconds. The only reasonable defense is to do it before them and close whatever is useless. That is exactly the role of an internal audit:

1. Inventory: which ports are open, which services, which versions?
2. Compare with what should exist (the "allowlist": the website, the administration SSH…).
3. Fix the gap: stop, restrict, filter, update.
4. Verify with a new scan that the fix works.
5. Repeat regularly, and compare with the previous inventory.

These five steps are the common thread of the whole course.

What Moroccan law says

Law No. 07-03 added articles 607-3 to 607-11 to the Penal Code, on offenses against automated data processing systems. In short, and without replacing a lawyer's advice:

Remember the logic: what separates an audit from an attack is the authorization. The same scan, run against a neighbor's server, can be seen as an access attempt or as hindrance (especially if it slows down a fragile device). Run against your own server, with the written consent of your management, it is an administrator's work.

Two other texts matter in an internal audit:

• Law 09-08 on the protection of personal data (CNDP): a hospital audit report must not contain patient data;
• Law 05-20 on cybersecurity and the DNSSI (national information systems security directive) for public administrations and critical infrastructures, which precisely require you to know and control your systems.

The written authorization

Even internally, even if you are "the in-house IT person", ask for an authorization signed by someone who has the power to give it (director, IT director, CISO). It must specify:

For a hospital, be even more careful: some biomedical devices or PLCs react badly to an aggressive scan. Exclude them from the scope, or scan them at low speed, with the biomedical department present.

The method, tool by tool

Nmap is installed from your distribution's repositories:

sudo apt install nmap            # Debian, Ubuntu
sudo dnf install nmap            # Rocky, Alma, RHEL
nmap --version                   # Nmap version 7.93 ( https://nmap.org ) on Debian 12

Step 1: check the target list without sending anything

The list scan (-sL) displays the addresses Nmap would target, without sending a single packet to them. It is the best way to review your scope before launching anything.

nmap -sL -n 10.20.30.0/29
# Nmap scan report for 10.20.30.0
# Nmap scan report for 10.20.30.1
# ...
# Nmap done: 8 IP addresses (0 hosts up) scanned in 0.01 seconds

-n avoids DNS queries. "0 hosts up" is normal: Nmap did not query anything.

To exclude a machine from the scope:

nmap -sL -n 10.20.30.0/24 --exclude 10.20.30.50

Step 2: the first scan, on your own machine

nmap -sT -p 8080 127.0.0.1
# PORT     STATE SERVICE
# 8080/tcp open  http-proxy

• -sT: Nmap opens a real TCP connection, as a browser would. It is the most "polite" scan and it works without root privileges.
• -p 8080: a single port.
• 127.0.0.1: the machine itself (the loopback address).

The SERVICE column (http-proxy) is only the usual name of this port, taken from a table: Nmap has not yet looked at what really answers. That is the topic of lesson 2.1.

Step 3: keep a record

nmap -sT -p 8080 127.0.0.1 -oN /root/audit/premier.txt     # saved output
echo "$(date '+%F %T') nmap -sT -p 8080 127.0.0.1" >> /root/audit/journal.txt

The first line of an -oN file already records the command and the time: # Nmap 7.93 scan initiated … as: nmap -sT -p 8080 …. The log, for its part, gathers all the audit commands in a single file that your manager can read.

Common pitfalls

• "It's the company network, I work here, so I'm allowed": no. Without a written authorization that specifies the scope, you are at fault, even with good intentions.
• Getting the address wrong: one typo (10.20.3.0/24 instead of 10.20.30.0/24) and you scan someone else's network. Always review with -sL first.
• Scanning a hosting provider or cloud network without reading its terms: many regulate scanning, even of your own machines.
• Forgetting the log: if an incident happens during the audit window, it is what will prove what you did (and did not do).

Lab

You prepare a mini-audit of your VM: you write the scoping sheet (target, sponsor, authorization, window), you review a scope with the list scan without sending any packet, then you run your first TCP scan of port 8080 on 127.0.0.1 and record it in the audit log. Start with sudo ml demarrer nmap-1-1.

Quiz

1. What legally distinguishes an audit from an attack?
2. What does the -sL option do? Does it send packets to the targets?
3. Name four essential items of an audit authorization.
4. Why must you be careful in a hospital?
5. In the output 8080/tcp open http-proxy, did Nmap check that it is a proxy?

Reference sources: Nmap Reference Guide and the nmap(1) manual page; Moroccan Penal Code (Law No. 07-03). Original MasterLinux text.