WEBVTT 00:00.400 --> 00:00.790 All right. 00:00.790 --> 00:07.570 Really, the only thing that we like about the number of vulnerabilities that are constantly appearing 00:07.570 --> 00:10.480 in our world is the job security. 00:10.900 --> 00:15.550 There are so many vulnerabilities occurring all of the time. 00:15.790 --> 00:21.820 It's really necessary for us to classify them, to break them down into different classifications. 00:22.120 --> 00:25.180 This can help us guard against them. 00:25.810 --> 00:32.650 This is another area where a lot of training is going to come in right to play so we can have this help 00:32.650 --> 00:35.290 us design training mechanisms. 00:35.980 --> 00:43.300 The first thing that we are going to have, which creates sometimes massive vulnerabilities in systems, 00:43.300 --> 00:45.940 is good old fashioned misconfiguration. 00:46.270 --> 00:46.570 Yep. 00:46.810 --> 00:54.130 From a fat fingered command is what we would typically say in the industry where you have just mis clicked 00:54.130 --> 01:00.280 the wrong thing or maybe you just didn't understand, heaven forbid how a feature worked and you flat 01:00.280 --> 01:03.880 out misconfigured it misconfigured an application. 01:04.670 --> 01:09.710 Right alongside this is things left in their defaults. 01:10.040 --> 01:19.190 There was oh, my gosh, there's been so many Microsoft based attacks, attacks against Microsoft products 01:19.400 --> 01:26.360 due to default, administrator credentials left somewhere, default administrator passwords left in 01:26.360 --> 01:26.990 systems. 01:27.290 --> 01:30.290 It's just unbelievable how much it happens. 01:30.710 --> 01:36.710 So one of the things that you'll note I do and I teach is never using defaults. 01:36.980 --> 01:42.920 When we go up and build something in a WAC, we don't use the default VPC. 01:43.130 --> 01:47.720 We build a new VPC just to our special parameters. 01:47.720 --> 01:53.420 So this is a great habit to get into across everything you touch. 01:53.960 --> 01:59.930 Buffer overflows are a vulnerability and we'll be dealing with those elsewhere in this course. 02:00.170 --> 02:04.640 But just understand buffer overflows another key vulnerability vector. 02:05.120 --> 02:11.990 This is by the way, the buffer overflow is something that attackers can trigger and that's a bad thing. 02:12.620 --> 02:23.390 Unpatched devices remember we are constantly on that on that just given take of we want our lives to 02:23.390 --> 02:28.670 go simple and smooth and that would mean we're not patching our systems every darn day. 02:28.940 --> 02:36.740 But if we don't patch our systems, yeah, we're compiling more and more vulnerabilities that we can 02:36.740 --> 02:37.670 be attacked through. 02:37.940 --> 02:45.140 So while it's risky to patch our systems because something may break, oh boy, we are running the risk 02:45.140 --> 02:46.310 of vulnerabilities. 02:46.790 --> 02:51.230 I aggressively patch everything in my life now. 02:52.040 --> 02:52.790 I really do. 02:53.030 --> 03:01.550 Especially when you think about like with cloud based storage and with my stuff always being backed 03:01.550 --> 03:03.290 up that I care about. 03:03.650 --> 03:09.980 Patching the underlying operating system on my device becomes less of a scary thing. 03:10.190 --> 03:14.480 Because if the worst case scenario happened and there was data loss and backed up. 03:15.870 --> 03:16.860 Design flaws. 03:17.930 --> 03:26.000 These are something that obviously through training we are going to hope our dev team can mitigate as 03:26.030 --> 03:27.770 they design the stuff. 03:28.220 --> 03:36.350 Operating system flaws are going to exist always in any OS, some more than others. 03:36.530 --> 03:42.550 And I'm not going to say another word before I -- someone off that's watching this application flaws. 03:42.560 --> 03:50.480 So when something in the application just is vulnerable, a classic that always comes to mind for me 03:50.480 --> 03:58.790 in this regard when I'm teaching this subject matter is the like super long you are well that early 03:58.790 --> 04:07.550 versions of Internet exploder I mean Internet Explorer would fall down so imagine that I mean they released 04:07.550 --> 04:14.060 the browser and no one thought to do a maximum character limitation in the address field. 04:14.060 --> 04:17.720 And so you could send, you know, certain number of characters. 04:17.720 --> 04:23.180 And once you got up to that threshold, you could buffer overflow the machine and cause all kinds of 04:23.180 --> 04:23.780 problems. 04:24.050 --> 04:31.070 So you can only imagine things like this need to be checked for and hopefully the dev teams are doing 04:31.070 --> 04:31.310 that. 04:31.910 --> 04:33.470 This one drives me insane. 04:33.470 --> 04:36.560 We need to harden all of our devices. 04:36.560 --> 04:44.270 You need to know what protocols your various devices are speaking and shut down those services that 04:44.270 --> 04:45.230 are not needed. 04:45.560 --> 04:49.640 And my goodness, talk about using defaults. 04:49.940 --> 04:55.400 There should never be a default password anywhere near your systems. 04:55.760 --> 04:59.780 Well, those are common ways to classify vulnerabilities. 04:59.990 --> 05:01.550 They're pretty straightforward. 05:01.790 --> 05:06.140 But clearly it was, I hope, valuable for you to run through those with me.