WEBVTT 00:00.770 --> 00:08.210 The great news against the alarming news that we have to deal with vulnerabilities and new vulnerabilities 00:08.210 --> 00:10.790 in different systems all the time. 00:11.210 --> 00:17.390 The great news is there are plenty of excellent tools and solutions that we can turn our attention to. 00:18.050 --> 00:25.100 I'm going to go ahead and demonstrate the additional resources page for you and you'll notice a link 00:25.100 --> 00:27.740 to the common vulnerabilities scoring system there. 00:28.160 --> 00:39.020 The CV SS is famous for scoring vulnerabilities, for using a complex set of metrics to let you know 00:39.170 --> 00:45.890 just how potentially vulnerable something is, just how explainable it is. 00:46.370 --> 00:53.600 And then there's the Common Vulnerabilities and Exposures database where you actually see the vulnerabilities 00:53.780 --> 00:55.480 that are scored with the CV. 00:55.490 --> 00:56.150 SS. 00:56.690 --> 01:03.620 There's the National Vulnerability Database that ties into this as well, that is government managed 01:03.620 --> 01:04.820 from the United States. 01:05.420 --> 01:14.120 Now there's great vulnerability management tools out there and Nessus open vars nikto GFI land guard 01:14.120 --> 01:14.750 qualys. 01:14.960 --> 01:16.910 You should know these names. 01:17.180 --> 01:18.950 They'll be in the flashcards for you. 01:19.250 --> 01:28.040 And certainly, as time would allow download complimentary trial versions and experience this software, 01:29.150 --> 01:34.860 a lot of these vulnerability scanners are going to maintain databases for you. 01:34.880 --> 01:38.180 Of vulnerabilities that exist in your systems. 01:38.480 --> 01:47.450 And again you're going to be able to do the research on is it a serious enough threat and are the is 01:47.450 --> 01:54.290 the data or the service that's being protected, you know, requiring that level of protection? 01:54.530 --> 01:58.310 Again, remember, not all data is created equal. 01:59.470 --> 02:05.410 Well, now, as promised, let me show you the e h resources link at my age. 02:05.410 --> 02:07.710 S Networking Ecom blog site. 02:07.720 --> 02:15.550 So if you head there and by the way, the advertising that I'm doing with Google is getting obnoxious 02:15.550 --> 02:16.930 and I'm going to be trimming it back. 02:16.930 --> 02:18.550 I apologize for that, man. 02:19.030 --> 02:19.360 All right. 02:19.360 --> 02:22.930 Anyways, one of the sections in here is the vulnerability resources. 02:23.080 --> 02:27.040 And notice I've got the titles and the links for you. 02:27.280 --> 02:32.620 So if we go to the common vulnerability scoring system, for instance, hopefully it opens in a new 02:32.620 --> 02:33.040 tab. 02:33.040 --> 02:33.730 Oh, it does. 02:33.730 --> 02:34.390 Thank goodness. 02:35.350 --> 02:42.310 You should definitely spend time up here looking at the latest version of the common vulnerability scoring 02:42.310 --> 02:42.790 system. 02:43.090 --> 02:51.370 So notice there's a complimentary self-paced online training course that explains how all of this works. 02:51.670 --> 02:54.040 And that is complimentary, right? 02:54.040 --> 02:54.820 Yeah, yeah, yeah. 02:54.880 --> 02:58.540 So this is something you should be doing. 02:59.020 --> 03:00.370 Okay, for sure. 03:01.630 --> 03:05.110 Now, notice there's the calculator. 03:05.110 --> 03:12.520 I mean, if you don't have time to go through and take the course, at least come in here and look at 03:12.820 --> 03:16.270 the components that make up the base score. 03:16.600 --> 03:24.460 And notice there's the base score, there's the temporal score and the environmental score, and you 03:24.460 --> 03:26.710 can look at the parameters that are used. 03:26.920 --> 03:30.610 Notice, this is very complicated indeed, complicated stuff here. 03:30.850 --> 03:40.060 But how cool is this that they work so hard to score these vulnerabilities, doing all this research 03:40.270 --> 03:46.270 that's really going to help us when we're trying to figure out where we need to spend our time and our 03:46.270 --> 03:51.610 dollars to guard against exploits of various vulnerabilities. 03:52.210 --> 03:56.710 So another resource on this list that you're going to love is exploit. 03:56.710 --> 04:05.140 DB The exploit database is going to allow you to come in here and type A product name. 04:05.380 --> 04:15.220 Maybe it's Adobe Acrobat, and you're going to be able to find the vulnerabilities that have to do with 04:15.220 --> 04:16.450 that product. 04:16.870 --> 04:27.670 And notice you're going to get the date, the title, the type, the platform and who contributed this 04:27.670 --> 04:28.720 to the database. 04:28.960 --> 04:31.060 Of course, these are hyperlinks. 04:31.270 --> 04:41.650 So you can drill in and you can get all kinds of great details about the exact hack or the exact vulnerability. 04:42.040 --> 04:49.570 Hopefully it hasn't been exploited with a hack, but oftentimes, of course, it's here because it's 04:49.570 --> 04:50.350 been exploited. 04:50.350 --> 04:53.410 That's how it was discovered by the exploit. 04:53.920 --> 05:02.200 Is this an amazing tool that you're going to have in your tool belt as you are penetration testing or 05:02.470 --> 05:08.230 helping an organization design protections against such vulnerabilities?