1 1 00:00:00,270 --> 00:00:02,910 Identifying Vulnerabilities. 2 2 00:00:02,910 --> 00:00:05,460 In this lesson, we are going to talk about the importance 3 3 00:00:05,460 --> 00:00:07,410 of identifying vulnerabilities. 4 4 00:00:07,410 --> 00:00:08,370 And the way we do this 5 5 00:00:08,370 --> 00:00:10,470 is through a vulnerability assessment. 6 6 00:00:10,470 --> 00:00:13,170 Now, it is really important to identify vulnerabilities 7 7 00:00:13,170 --> 00:00:15,900 so that you can then mitigate those vulnerabilities. 8 8 00:00:15,900 --> 00:00:18,240 Remember, every vulnerability in your system 9 9 00:00:18,240 --> 00:00:19,800 represents a risk, 10 10 00:00:19,800 --> 00:00:21,510 and you need to understand what those risks are 11 11 00:00:21,510 --> 00:00:22,860 so you can accept them, 12 12 00:00:22,860 --> 00:00:25,710 mitigate them, transfer them, or avoid them. 13 13 00:00:25,710 --> 00:00:26,700 And so doing that 14 14 00:00:26,700 --> 00:00:28,770 is going to be important to our security of our network, 15 15 00:00:28,770 --> 00:00:31,260 and we do that through vulnerability assessments. 16 16 00:00:31,260 --> 00:00:32,820 Now, a vulnerability assessment 17 17 00:00:32,820 --> 00:00:35,430 is an evaluation of the system's security 18 18 00:00:35,430 --> 00:00:37,440 and our ability to meet compliance requirements 19 19 00:00:37,440 --> 00:00:40,380 based on the configuration state of the system, 20 20 00:00:40,380 --> 00:00:43,590 as represented by the information collected from the system. 21 21 00:00:43,590 --> 00:00:45,157 Now, that's a long way of saying, 22 22 00:00:45,157 --> 00:00:46,710 "We have a piece of software 23 23 00:00:46,710 --> 00:00:48,930 and it's going to go out there and it's going to scan our network, 24 24 00:00:48,930 --> 00:00:50,370 it's going to learn about our network, 25 25 00:00:50,370 --> 00:00:51,690 and then it's going to report back to us 26 26 00:00:51,690 --> 00:00:53,070 the status of that network, 27 27 00:00:53,070 --> 00:00:55,380 and then we're going to make decisions based on that." 28 28 00:00:55,380 --> 00:00:57,990 Now, when we go and conduct a vulnerability assessment, 29 29 00:00:57,990 --> 00:01:00,150 there are really three main steps. 30 30 00:01:00,150 --> 00:01:03,570 The first one is to collect a set of target attributes. 31 31 00:01:03,570 --> 00:01:05,760 This is a predetermined set of attributes here. 32 32 00:01:05,760 --> 00:01:07,650 This will have things like specific parameters, 33 33 00:01:07,650 --> 00:01:09,180 like rules for a firewall 34 34 00:01:09,180 --> 00:01:11,310 or security policy for a Windows server, 35 35 00:01:11,310 --> 00:01:13,350 or whatever it is that you want to check. 36 36 00:01:13,350 --> 00:01:15,240 Then, we go into our second step, 37 37 00:01:15,240 --> 00:01:17,730 which is analyzing the differences in the current 38 38 00:01:17,730 --> 00:01:20,010 versus the baseline configurations. 39 39 00:01:20,010 --> 00:01:21,390 So if I set up this firewall 40 40 00:01:21,390 --> 00:01:23,730 and I only had two ports open and I check it today 41 41 00:01:23,730 --> 00:01:25,290 and there are 20 ports open, 42 42 00:01:25,290 --> 00:01:26,217 there's a big change there, 43 43 00:01:26,217 --> 00:01:29,370 and we need to figure out what those 18 different ports are, 44 44 00:01:29,370 --> 00:01:30,900 and why they were all opened. 45 45 00:01:30,900 --> 00:01:33,390 That's the idea of analyzing the differences here. 46 46 00:01:33,390 --> 00:01:34,920 And then the third thing we want to look at 47 47 00:01:34,920 --> 00:01:36,720 is reporting the results. 48 48 00:01:36,720 --> 00:01:38,730 Now that we've gone and we've collected the information, 49 49 00:01:38,730 --> 00:01:40,170 we've analyzed the information, 50 50 00:01:40,170 --> 00:01:42,240 we are going to report on that information. 51 51 00:01:42,240 --> 00:01:43,073 And this is really 52 52 00:01:43,073 --> 00:01:45,720 the simple three-step process we're going to use. 53 53 00:01:45,720 --> 00:01:47,160 Now, vulnerability assessments 54 54 00:01:47,160 --> 00:01:48,780 are typically going to be accomplished, though, 55 55 00:01:48,780 --> 00:01:50,700 using automated tools. 56 56 00:01:50,700 --> 00:01:51,690 The reason for this is 57 57 00:01:51,690 --> 00:01:53,430 it would take a long time for me to go 58 58 00:01:53,430 --> 00:01:56,160 and look at every single computer on my network. 59 59 00:01:56,160 --> 00:01:59,850 The last network I worked on had over 1 million endpoints. 60 60 00:01:59,850 --> 00:02:02,280 There is no way that I'd have enough time in the day 61 61 00:02:02,280 --> 00:02:05,310 to go and look at every single one of those workstations. 62 62 00:02:05,310 --> 00:02:08,640 So instead, we broke up the network into smaller networks, 63 63 00:02:08,640 --> 00:02:09,900 and each of those smaller networks 64 64 00:02:09,900 --> 00:02:11,220 underneath the larger network 65 65 00:02:11,220 --> 00:02:12,150 would have people assigned 66 66 00:02:12,150 --> 00:02:14,310 to scan and report on those areas. 67 67 00:02:14,310 --> 00:02:16,950 And by doing that, we could roll up that information. 68 68 00:02:16,950 --> 00:02:18,060 So at the highest level, 69 69 00:02:18,060 --> 00:02:21,210 we could look over the entire network of 1 million machines 70 70 00:02:21,210 --> 00:02:23,550 and know exactly which machines were patched, 71 71 00:02:23,550 --> 00:02:24,660 and which ones weren't, 72 72 00:02:24,660 --> 00:02:26,100 and which ones met our configurations, 73 73 00:02:26,100 --> 00:02:27,390 and which ones didn't. 74 74 00:02:27,390 --> 00:02:29,790 So we do a lot of that using these automated tools, 75 75 00:02:29,790 --> 00:02:32,550 but automated tools alone are not enough. 76 76 00:02:32,550 --> 00:02:33,570 We need an analyst 77 77 00:02:33,570 --> 00:02:36,180 to help us go through that information as well. 78 78 00:02:36,180 --> 00:02:37,290 The reason for that is, 79 79 00:02:37,290 --> 00:02:39,840 we are going to have so many different things to look at, 80 80 00:02:39,840 --> 00:02:42,720 and we have to figure out what is the priority. 81 81 00:02:42,720 --> 00:02:44,970 Now as we start prioritizing things, 82 82 00:02:44,970 --> 00:02:47,580 we take into account a lot of different things. 83 83 00:02:47,580 --> 00:02:49,380 We're going to look at asset criticality 84 84 00:02:49,380 --> 00:02:50,760 as one of those things. 85 85 00:02:50,760 --> 00:02:52,650 For instance, is the workstation 86 86 00:02:52,650 --> 00:02:54,390 sitting on your desk at work 87 87 00:02:54,390 --> 00:02:57,240 as important as the one sitting on the CEO's desk, 88 88 00:02:57,240 --> 00:02:59,490 or the one sitting on the accountant's desk? 89 89 00:02:59,490 --> 00:03:02,010 Or, the file server down in the server room? 90 90 00:03:02,010 --> 00:03:05,010 All of these assets to a vulnerability scanning machine, 91 91 00:03:05,010 --> 00:03:06,960 just look like another computer, 92 92 00:03:06,960 --> 00:03:07,920 but you as an analyst, 93 93 00:03:07,920 --> 00:03:11,010 need to know which computers are more or less important, 94 94 00:03:11,010 --> 00:03:13,710 which ones process more or less sensitive data, 95 95 00:03:13,710 --> 00:03:15,450 and being able to put all that information in 96 96 00:03:15,450 --> 00:03:17,010 will help you prioritize. 97 97 00:03:17,010 --> 00:03:18,630 Now when everything else is equal 98 98 00:03:18,630 --> 00:03:20,580 and you're looking at 100,000 computers 99 99 00:03:20,580 --> 00:03:23,610 that are all used by assistants across the organization, 100 100 00:03:23,610 --> 00:03:25,020 how do you prioritize those? 101 101 00:03:25,020 --> 00:03:27,390 Well, based on the threats you find 102 102 00:03:27,390 --> 00:03:29,520 and the vulnerabilities found on those systems, 103 103 00:03:29,520 --> 00:03:32,220 certain vulnerabilities are going to be more or less critical, 104 104 00:03:32,220 --> 00:03:34,420 and therefore, we'll prioritize them higher.