In this lesson,
we're going to talk about threats and vulnerabilities.
After all, where threats and vulnerabilities intersect
is where risk exists within our enterprise networks.
So if we can understand
the different threats and vulnerabilities
we may have in our networks,
we can then add protection mechanisms
to help mitigate that risk.
Often I hear people use the words threats
and vulnerability interchangeably,
but they're technically not the same thing.
A threat is a person or an event
that has the potential for impacting a valuable resource
in a negative manner.
So a hacker would be a threat
since they want to steal your data.
But so is a hurricane
because it could cause a power outage
that takes down your valuable network.
Now, a vulnerability, on the other hand,
is a quality or characteristic
within a given resource or its environment
that might allow a threat to be realized.
Now, essentially, a vulnerability is any weakness
in system design, implementation, source code,
or lack of preventative mechanisms
that would prevent a threat from occurring.
So for example, if you're not running the latest version
of Microsoft Windows on your servers,
that is considered a vulnerability.
If you have a battery backup to your network
that only lasts 15 minutes
and you don't have any backup generators,
that again is a vulnerability
because if you lose power, after 15 minutes,
the entire network is going to crash on you.
Now, it's only going to be when you combine
a threat with a vulnerability
that we actually get risk that's being realized
and now something bad will occur.
This is an important distinction.
Because if I have a network device like a switch or a router
and it has a vulnerability,
but there's no threats
that would ever go after that vulnerability,
then guess what?
There's not really a risk there.
On the other hand,
if I have an asset that doesn't have any vulnerabilities,
then it doesn't matter if I have a dedicated threat
trying to attack me
because they won't ever be able
to cause any harm to my network
because there's absolutely no vulnerabilities
for them to exploit.
Now, in the real world,
there's almost always some kind of threat
and some kind of vulnerability out there
that we're going to be facing.
So we almost always have risk.
The amount of risk, though, is really going to be determined
by how big of a threat
or how major vulnerability we actually have.
So let's dive into threats and vulnerabilities
a bit deeper here.
First, let's cover threats.
Threats come in two basic varieties.
We have internal threats and external threats.
Now, an internal threat is any threat
that originates from within the organization itself.
Normally, these are conducted
by a current or former employee, a contractor,
or business partner
who's going to cause damage to your systems
or steal your data.
When we're dealing with internal threats,
these can be caused by people who intend to do us harm
or those who do it accidentally.
For example, if you have an insider threat,
this could be a person who uses their authorized access
to get onto your network
and then harm your organization.
Maybe you had an employee
who just got passed over for promotion
and now they're pretty upset,
so they decide to download
your entire client contact database to their thumb drive
and take it home with them.
That way, they decide to quit next week,
they could start calling up all of your clients
and bring them over to a new company
that will end up hiring them.
On the other hand, you may also have an end user
who unknowingly causes damage to your systems.
For example, we may have a salesperson
who opens up an email that contains malware
and this starts infecting your systems and your servers.
Now, that person, they weren't being malicious.
They didn't do this on purpose.
They just opened an email
and they didn't think that it would cause any problems.
This is an unwitting or unknowing internal threat.
Now, in addition to internal threats,
we also have external threats.
External threats can be people like a hacker
or it could be an event or an environmental condition.
For example, if I was going to have a wildfire near my office,
that would be an environmental threat against my facility
and the network that it contains.
Or maybe I'm working as the IT director
for a large oil company
and I have a lot of angry hacktivists
who want to take down my network
because they don't agree with our company's policies
concerning drilling within the Alaskan wilderness.
This would also be considered an external threat
because it's something external to my organization,
these hacktivists or hackers who are trying to break in.
Now, next, we need to talk a little more
about the types of vulnerabilities
that we can have in our organizations and its networks.
Remember, a vulnerability is any weakness
in the system design, implementation, software code,
or a lack of preventive measures in your systems.
Now, these can take the form
of environmental, physical, operational,
or technical vulnerabilities.
When we talk about environmental vulnerabilities,
these are focused on undesirable conditions or weaknesses
that are in the general areas surrounding your building
where you're going to operate your networks.
So for example, we have the ever-present threat
of hurricanes and earthquakes
that could exploit a vulnerability
in how we provide services to our office,
including our power, water, heating, and air conditioning.
So to mitigate this,
we actually have four sources of power at our facility,
including solar power,
a full building battery backup, a diesel generator,
and, of course, our local power grid
from the electric company.
Physical vulnerabilities are focused
on undesirable conditions or weaknesses
in the buildings where you operate your networks.
Now, some examples of physical vulnerabilities
might be things like unlocked doors, unmonitored hallways,
misconfigured sprinkler systems,
or cables that are running across the floor.
These things could lead to a threat actor
being able to get into your building
and stealing all your data,
or a fire could break out
and cause massive amounts of damage,
or maybe somebody will trip over a misplaced cable
and that will cause damage to themselves or to your network.
Operational vulnerabilities are focused
on how the network and its systems are being run
from a policy and procedure perspective.
These vulnerabilities or weaknesses usually result
from either poorly worded
or unenforceable policies within your organization.
This can allow a threat actor
to exploit weaknesses in these policies
to their own advantage.
Now, technical vulnerabilities
are system-specific conditions
that create a weakness in our security.
This includes misconfigurations,
outdated hardware, malicious software,
and other technical weaknesses
in the implementation or operation of our networks
and its devices.
When it comes to technical vulnerabilities
that focus on network or system exploitation,
we normally are going to classify these
as a CVE or a zero-day vulnerability.
Now, CVE or the common vulnerabilities and exposures
is going to be a list of publicly disclosed
computer security weaknesses or flaws.
Basically, it's an official list
of all the known technical vulnerabilities
for each and every piece of software
that's publicly available.
When you look up a CVE, for example,
you might see something like CVE-2017-0144
and then you can look at that
and read all about that vulnerability,
what it is, what software it effects,
and a list of references so you can learn more about it.
Now, in the case of CVE-2017-0144,
this was the 144th vulnerability
that was disclosed in the year 2017.
This particular CVE was actually a really serious one,
and it was one that was exploited by the WannaCry ransomware
that spread rapidly across the globe.
Due to its widespread exploitation,
it also received a code name
and became known as EternalBlue.
Now, EternalBlue affected Windows Vista,
Windows 7, Windows 8,
Windows 10 on desktop and laptop computers,
and then also Windows Server 2008, 2012,
and 2016 on servers.
This vulnerability allowed an attacker
to be able to remotely execute arbitrary code
via well-crafted packets over the network
that could lead to a remote code execution vulnerability.
Now, you don't need to know the specifics
of the EternalBlue exploit,
but you should be aware of what a CVE is
and the kind of information it can give you
as a network administrator.
So while CVEs provide us with a list
of all the known vulnerabilities,
there's also a lot of unknown vulnerabilities
that may be out there too.
These are known as zero-day vulnerabilities.
Now, a zero-day vulnerability is any weakness
in the system design, implementation, software code,
or a lack of preventive mechanisms
within a given system or network
that is unknown at the time of publication.
Now, basically, a zero-day vulnerability
is a new vulnerability that not everyone is aware of.
Once cybersecurity professionals become aware
of this vulnerability,
they're going to report it
and a CVE will be created for that zero-day,
making it no longer a zero-day,
and now it's going to be called a CVE.
So remember, CVEs are a list of known vulnerabilities
while a zero-day is a brand-new vulnerability
that no one else has discovered or reported yet.
Finally, let's talk about how a vulnerability is attacked.
After all, a vulnerability is just a weakness,
but until it's attacked or exploited,
as we like to call it in the cybersecurity world,
it's just sitting there
and it's really not hurting anyone.
When you take advantage of a vulnerability
as a threat actor,
this is called exploiting the vulnerability.
We do this using an exploit.
Now, an exploit is a piece of software code
that takes advantage of a security flaw
or vulnerability within a system or network.
Because CVEs are known vulnerabilities,
most of them have a matching exploit.
This is because when a new vulnerability
is discovered and reported,
a patch is created by the software's creators.
For example, if a new zero-day vulnerability was discovered
in Windows 10,
then Microsoft will create a software patch
to fix this vulnerability
and they'll release that software patch
and a CVE to the public
so we can all know about it.
Now, at the same time,
attackers are going to reverse engineer that software patch
and research the CVE
to determine what vulnerability
that patch is trying to solve.
Then they can create some code
that will take advantage of that vulnerability
if a system isn't properly patched and updated.
Since many people don't patch their systems right away
using the latest security patches,
this means there's a period of time
where a lot of window systems may still be vulnerable,
and so we can actually use this exploit
to attack those vulnerable systems for weeks or months
after the release of a patch.
So now the attackers have a working exploit
for this vulnerability,
and they can find
any unpatched Windows 10 machines out there
and exploit them by running their new software code
against those unpatched systems.
This exploit code is often incorporated into malware
and this allows it to propagate
and run intricate scripts against vulnerable computers,
therefore increasing the damage
that these attackers can do with this exploit.
To prevent this, you need to ensure your systems remain
up to date and patched with the latest security releases,
and ensure that your systems have an up-to-date anti-malware
or antivirus software installed
to protect them from these known vulnerabilities.