>> Vulnerability management.
The learning objectives for this lesson are to
define vulnerabilities and vulnerability management,
to discuss the importance of patch management,
and to utilize vulnerability scanners
in vulnerability management.
Let's get started. What is a vulnerability?
A vulnerability is any area of
your enterprise where you are not
fully protected and that this
could be exploited by an attacker.
A lot of times people tend to
think of these as bugs in software,
but this isn't the case.
It could be anything in your environment that
allows an attacker the opportunity to exploit.
We'll go over some specific examples in the next slide,
but what I want you to take away from now is
that it doesn't have to be about software only.
Here are some examples.
The first one we'll go over his staff not being
trained and then they click on phishing links.
We need to train our staff because they are not
keeping up with the latest techniques
that attackers are using.
We can't expect them to know or even understand those.
It's our job to help teach
them so that they know these things.
If we're not teaching them,
then that's why they're clicking on these links.
The next is having Ethernet ports
in common areas that are live.
Company moves into a new building,
buys it all up,
has everything plugged into a switch,
then they have drops in common areas or
maybe offices that are not occupied yet.
They're all live, but this gives
an opportunity for an attacker to come in,
plugin, and be on your network.
If you're not using those ports, we need to disable them.
You'd be surprised how many companies
don't have alarm systems.
After spending tens of thousands
or hundreds of thousands of dollars on
IT infrastructure and not to
mention the value of the data they have,
you would think they would consider
having an alarm system.
Next is having servers or other
critical systems that are not access controlled.
Ideally you want your server and
your networking infrastructure to
be in its own locked room.
However, we have seen cases where
someone had a server that was sitting
in the corner of a small office.
Anyone could have access to it.
If it contains important data
and it needs to be protected,
it needs to be separated.
Next is having laptops that have
VPN access to your office or they
contain sensitive data but they're not encrypted.
We'll get into this a little bit deeper when we
get into compliance frameworks like HIPAA,
but if you want to see examples of
companies that have paid a lot of
money in fines for violations like this,
go to the HIPAA wall of shame.
There have been several cases where laptops that
contain patient information were either
lost or stolen and companies or
practices had to pay out large sums for that.
If we're going to have our laptops
going out of the office they
need to be encrypted at all times.
Finally, we have outdated
software or software that's
no longer supported by the vendor.
A good example of this is Windows
7 or Windows Server 2008.
It's no longer supported by Microsoft,
so it's not getting those updates for
any new bugs or security flaws that are found.
Vulnerability management activities.
Here are some ways we can go about managing
our vulnerabilities in our environment.
The first common way is to use a vulnerability scanner.
We'll go over that in more detail in the next slide.
The next is patch management.
We want to make sure we deploy
all the patches that are available for
the devices and the operating systems in our environment.
Finally we can perform a risk assessment to help us find
areas that maybe we weren't
thinking about that we're vulnerable in.
Vulnerability scanners are software products
that will scan our network
to see where we might be vulnerable.
They're going to test devices or
operating systems against known exploits,
but they're also going to look for missing patches,
any misconfigurations, or maybe if we
left things in a default
setting and these need to be changed.
Two examples of a vulnerability scanner
will be Nitko and Nessus.
These are some critical components
of a vulnerability scanner.
We need to consider if we're going to
use credentials when we perform a scan.
The reason we might not want to use
credentials is if we want to
emulate an attacker in our environment,
an attacker wouldn't yet have
access to a system that they're scanning,
because of that, they were not going to be able to get
the full details back from a vulnerability scanner.
However, for the purposes of vulnerability management,
we are going to want to scan with credentials
so that we get back the full amount of information.
We also need to decide if we're going to
use agent or agentless.
Do we want to install a component on
each endpoint before it's scanned?
We also need to make sure that we
get a criticality ranking.
This will show the result of the scan with
the highest urgency at
the top so that we can make sure those are addressed.
Then finally we want to decide if
we're going to use active versus passive.
An active scan will go
through each device and scan them directly
whereas a passive scan is going to collect
information in a more indirect way.
Instructor side note. Nessus scanner
is a great vulnerability scanner.
Unfortunately, it's a little expensive,
but they do offer a free trial that will
allow you to scan up to 16 IP addresses.
That's 16 total not 16 per scan.
It's highly recommended that you download this.
You can get your feet wet with a vulnerability scanner.
You can go to the website on the slide
here, get your free scanner.
Maybe scan a couple of devices on
your network, see what it finds.
That way you can get an understanding of how these work
and then how they would be used
in a business environment.
Patch management. This is about identifying
the missing patches or
updates for every device on our network.
It's not limited to just operating systems.
For example, devices like switches and firewalls and
access points all have
new firmware that's released from time to time.
These will patch holes found in those devices.
We want to make sure that we deploy those too.
Installing missing patches keeps our systems fully
up-to-date but also closes those security holes.
Instructor side note. This is probably not on the test,
but I wanted you to be aware of it.
Ideally before you go
deploying patches on your critical systems,
you want to test them first.
Maybe have a test environment setup,
even a virtual machine that you
can install it on to make sure.
Because we've seen in the past where
sometimes for example,
Microsoft releases an update
that the side effect is blue screens.
We want to be able to test those before deploying it.
Some organizations actually use
change management that would
require us to test those
and then document them before deploying.
Vulnerability information sources.
Where do we find out about these vulnerabilities?
The first place we would go to are advisories.
These contain specific data
on the identified vulnerability.
This would include how
the vulnerability is identified, what it does,
sometimes a proof-of-concept, and then
maybe any mitigations if there are any available.
Next would be bulletins.
These are summaries or a
newsletter listing of advisories.
After that we have information sharing
and analysis center or ISACs,
is a non-profit group that usually specialize on
a specific sector such as finance or health care.
Finally we have news reports.
You may end up hearing about it in the news.
Large cases that hinge
on specific exploits are very common in the news lately.
Security Content Automation Protocol.
This is a suite of
interoperable specs that are designed to standardize
the naming conventions and the formatting
used to identify and report on software flaws.
It's made up of open standards and these enumerate
the software flaws and
the security-related configuration issues.
SCAP languages.
The first we're going to discuss is
the Open Vulnerability and Assessment Language or OVAL.
This provides a consistent way to collect and
assess the three main aspects of evaluated systems.
These are the system information,
the machine state, and reporting.
Next we have Asset Reporting Format or ARF.
This correlates to reporting
formats to device information.
Next is the Extensible Configuration Checklist
Description Format or XCCDF.
This is written in XML and it's designed to provide
a consistent way to define
the benchmarks and
the checks performed during assessments.
SCAP identification schemes.
First we have the Common Platform Enumeration or CPE.
These are standardized naming formats to
help us identify systems and software.
Then we have Common Vulnerabilities
and Exposures or CVEs.
This is a list of known
vulnerabilities and they're formatted with
CVE then the year and then
the actual number that's assigned to that.
From there we have the Common
Configuration Enumeration or CCE.
It's similar to CVE but it focuses on
the configuration issues that
may potentially lead to a vulnerability.
This is how it all comes together.
You can see the four main areas
that we're looking to address.
Software vulnerability management,
configuration management,
compliance management, and then asset management.
All of these circles overlap
each other in different areas.
However, each part plays
its own role in the overall method.
For example, if we're going to look at asset management,
we know that that's going to be CPE.
This identifies software and devices.
But if we're looking at configuration management,
we want CCE, this identifies configuration controls.
This is a good overview that can
help you understand how it all works together.
SCAP metrics.
The Common Vulnerability Scoring System or CVSS,
this is represented by
a numerical score to
show how severe the vulnerability is.
One thing to keep in mind is the vulnerability score
is not necessarily the same for every person.
You may have a different deployment of
a specific software product
that makes you more or less vulnerable,
but this is to give you a very
good guide on how this works.
You want to be able to know that anything in
the higher critical level needs to be addressed as
soon as possible and then work your way down from there.
Let's summarize. We discussed
vulnerabilities and vulnerability scanners.
We also went over vulnerability
management and patch management.
We also discussed SCAP,
the SCAP Languages,
the SCAP Identification Schemes, and SCAP Metrics.
Let's do some sample questions.
A blank is any weakness
that could be exploited and lead to a breach?
Vulnerability. Question 2.
Blank helps describe the three main aspects
to evaluate a system: system information,
machine state, and reporting.
Open Vulnerability and Assessment Language or OVAL.
Question 3, which identification scheme
is responsible for classifying configurations?
Common configuration enumeration or CCE.
Question 4, after
performing a scan with a vulnerability scanner,
the report shows that you have
one vulnerability with a score of 7.4,
what severity rating would this score represent?
7.0-8.9 is high.
I hope this was helpful for you and I hope you
learned something, and I'll see you in the next one.