Tutor: Identifying Vulnerabilities. 2 2
In this lesson, we are going to talk about the importance 3 3
of identifying vulnerabilities. 4 4
And the way we do this 5 5
is through a vulnerability assessment. 6 6
Now, it is really important to identify vulnerabilities 7 7
so that you can then mitigate those vulnerabilities. 8 8
Remember, every vulnerability in your system 9 9
represents a risk, 10 10
and you need to understand what those risks are 11 11
so you can accept them, 12 12
mitigate them, transfer them, or avoid them. 13 13
And so doing that 14 14
is going to be important to our security of our network, 15 15
and we do that through vulnerability assessments. 16 16
Now, a vulnerability assessment 17 17
is an evaluation of the system's security 18 18
and our ability to meet compliance requirements 19 19
based on the configuration state of the system, 20 20
as represented by the information collected from the system. 21 21
Now, that's a long way of saying, 22 22
"We have a piece of software 23 23
and it's going to go out there and it's going to scan our network, 24 24
it's going to learn about our network, 25 25
and then it's going to report back to us 26 26
the status of that network, 27 27
and then we're going to make decisions based on that." 28 28
Now, when we go and conduct a vulnerability assessment, 29 29
there are really three main steps. 30 30
The first one is to collect a set of target attributes. 31 31
This is a predetermined set of attributes here. 32 32
This will have things like specific parameters, 33 33
like rules for a firewall 34 34
or security policy for a Windows server, 35 35
or whatever it is that you want to check. 36 36
Then, we go into our second step, 37 37
which is analyzing the differences in the current 38 38
versus the baseline configurations. 39 39
So if I set up this firewall 40 40
and I only had two ports open and I check it today 41 41
and there are 20 ports open, 42 42
there's a big change there, 43 43
and we need to figure out what those 18 different ports are, 44 44
and why they were all opened. 45 45
That's the idea of analyzing the differences here. 46 46
And then the third thing we want to look at 47 47
is reporting the results. 48 48
Now that we've gone and we've collected the information, 49 49
we've analyzed the information, 50 50
we are going to report on that information. 51 51
And this is really 52 52
the simple three-step process we're going to use. 53 53
Now, vulnerability assessments 54 54
are typically going to be accomplished, though, 55 55
using automated tools. 56 56
The reason for this is 57 57
it would take a long time for me to go 58 58
and look at every single computer on my network. 59 59
The last network I worked on had over 1 million endpoints. 60 60
There is no way that I'd have enough time in the day 61 61
to go and look at every single one of those workstations. 62 62
So instead, we broke up the network into smaller networks, 63 63
and each of those smaller networks 64 64
underneath the larger network 65 65
would have people assigned 66 66
to scan and report on those areas. 67 67
And by doing that, we could roll up that information. 68 68
So at the highest level, 69 69
we could look over the entire network of 1 million machines 70 70
and know exactly which machines were patched, 71 71
and which ones weren't, 72 72
and which ones met our configurations, 73 73
and which ones didn't. 74 74
So we do a lot of that using these automated tools, 75 75
but automated tools alone are not enough. 76 76
We need an analyst 77 77
to help us go through that information as well. 78 78
The reason for that is, 79 79
we are going to have so many different things to look at, 80 80
and we have to figure out what is the priority. 81 81
Now as we start prioritizing things, 82 82
we take into account a lot of different things. 83 83
We're going to look at asset criticality 84 84
as one of those things. 85 85
For instance, is the workstation 86 86
sitting on your desk at work 87 87
as important as the one sitting on the CEO's desk, 88 88
or the one sitting on the accountant's desk? 89 89
Or, the file server down in the server room? 90 90
All of these assets to a vulnerability scanning machine, 91 91
just look like another computer, 92 92
but you as an analyst, 93 93
need to know which computers are more or less important, 94 94
which ones process more or less sensitive data, 95 95
and being able to put all that information in 96 96
will help you prioritize. 97 97
Now when everything else is equal 98 98
and you're looking at 100,000 computers 99 99
that are all used by assistants across the organization, 100 100
how do you prioritize those? 101 101
Well, based on the threats you find 102 102
and the vulnerabilities found on those systems, 103 103
certain vulnerabilities are going to be more or less critical, 104 104
and therefore, we'll prioritize them higher.