Instructors: Common identifiers. 2 2
In this lesson, we are going to talk about 3 3
some specific common identifiers 4 4
that we can use when we're talking 5 5
about specific vulnerabilities. 6 6
Now, there are many different scanning tools out there. 7 7
But they all use the same ways 8 8
to identify these same vulnerabilities. 9 9
This allows us to have a consistent method 10 10
as we look across different tools. 11 11
So regardless of whether you're using Nessus 12 12
or Qualys or OpenVAS, 13 13
they're all going to be able to report 14 14
on the same vulnerabilities 15 15
and identify those using the same methods. 16 16
Now when I talk about this, 17 17
there are really six main things that we're going to use 18 18
to commonly identify vulnerabilities 19 19
on the different platforms that we're going to look at. 20 20
These include things like the common vulnerabilities 21 21
and exposures or CVEs, the National Vulnerability Database 22 22
or NVD, the Common Weakness Enumeration or CWE. 23 23
The Common Attack Pattern Enumeration and Classification 24 24
or CAPEC, the Common Platform Enumeration, the CPE 25 25
and the Common Configuration Enumeration or CCE. 26 26
In this lesson, we're going to dive into each one of these. 27 27
First CVEs or common vulnerabilities and exposures. 28 28
This is a commonly used scheme 29 29
for identifying vulnerabilities that was developed 30 30
by MITRE and adopted by NIST. 31 31
Now because this was one of the first ones 32 32
that was really widely accepted, 33 33
this goes back a long way in history. 34 34
And so when you look up CVEs, you can find a long history 35 35
of all the different CVEs that were out there. 36 36
Now when we talk about a CVE, 37 37
each vulnerability is going to have a unique identifier known 38 38
as a CVE and the format looks like this. 39 39
CVE, dash, the year, dash, the number. 40 40
So for example if I wanted to pull up this CVE, 41 41
I can go to the website and I can look at it. 42 42
And this one is identified as CVE-2017-0144. 43 43
This tells me this common vulnerability was identified 44 44
first in 2017 and it was the 144 vulnerability identified 45 45
for this manufacturer. 46 46
Now if I look in the description of this, 47 47
I can see that this was for Microsoft Windows 48 48
and it associated with SMB vulnerabilities. 49 49
If I actually dig into this and read more, 50 50
you can see there's a description, there's references. 51 51
If I scroll down the page, 52 52
it would tell you what things can exploit it 53 53
and what you can do to fix it. 54 54
Now this CVE is actually a really well-known one. 55 55
If you've been in cybersecurity for a while, 56 56
you might have heard of it. 57 57
It's actually known as EternalBlue. 58 58
Well, technically EternalBlue is the tool 59 59
we use to exploit this vulnerability. 60 60
But this is the vulnerability 61 61
that's being exploited by EternalBlue. 62 62
Now, why is EternalBlue so important? 63 63
Well, because it was used by WannaCry, 64 64
the ransomware that took hold in 2017 65 65
and spread all over the internet. 66 66
The WannaCry ransomware and EternalBlue both exploited 67 67
this same vulnerability, CVE-2017-0144 68 68
and that's how these CVEs works. 69 69
You can start figuring out what exploit goes with what CVE. 70 70
And when you're detecting things, 71 71
what mitigations you can find are being detected. 72 72
And when you're trying to detect these vulnerabilities, 73 73
which CVEs those are associated with because 74 74
if you know the CVE, you can look it up. 75 75
You can find out what patches exist 76 76
and how you can mitigate it. 77 77
Now the next one we're going to talk about is NVD, 78 78
which is the National Vulnerability Database. 79 79
This is a superset of the CVE database 80 80
so it contains all that information 81 81
from the CVE database that's maintained by NIST. 82 82
And then it also adds additional information 83 83
such as some analysis, some criticality metrics 84 84
like CVSS scores, which we'll talk about later. 85 85
And any appropriate fix information 86 86
or instructions for remediating these issues. 87 87
So NVD takes all that CVE information and adds more to it. 88 88
Now the next one we're going to talk about is CAPEC, 89 89
which is the Common Attack Pattern Enumeration 90 90
and Classification. 91 91
This is a knowledge base maintained 92 92
by MITRE that classifies specific attack patterns focused 93 93
on application security and exploit techniques. 94 94
Now at first glance this might sound a lot 95 95
like the MITRE ATT&CK framework that we've talked 96 96
about previously but there is a big difference. 97 97
When we're talking about the attack framework, 98 98
that's a tool for understanding adversary behaviors 99 99
within a network intrusion. 100 100
But when we're talking about 101 101
the Common Attack Pattern Enumeration 102 102
and Classification tool, we're talking about 103 103
the attack patterns focused on 104 104
the application security itself. 105 105
So we're looking more at the technical details, 106 106
not the person like we are when we're dealing with attack. 107 107
The next one we want to talk about is CPE, 108 108
which is the Common Platform Enumeration. 109 109
This is a scheme for identifying hardware devices, 110 110
operating systems and applications. 111 111
When you're dealing with CPE, 112 112
it's going to be shown in the format that looks like this. 113 113
CPE colon slash part, colon vendor, colon product 114 114
colon version, colon update, colon edition, colon language. 115 115
Ha, notice, this is all essentially a key pair 116 116
that we can use to be able to identify the CPE 117 117
with that particular piece of hardware. 118 118
Now the one piece in here that is something 119 119
that should be noted is 120 120
that most of these are pretty self-explanatory, right? 121 121
Like the part, the vendor, the product, the version, 122 122
the update, the edition and the language. 123 123
But there is this one part that is called part 124 124
that you may wonder what is that really referring to? 125 125
Well, that first thing part will actually have either an O 126 126
if it's an operating system, A if it's an application 127 127
or H if it's a piece of hardware. 128 128
And this is the three main categories that we would support. 129 129
So for example if I was looking at Windows, 130 130
I might be looking at CPE, colon, O for operating system, 131 131
colon, Microsoft for vendor, colon, Windows for product, 132 132
colon 10 for version and so on as you go through. 133 133
This will allow us to uniquely identify 134 134
that particular Windows variant inside 135 135
the Microsoft operating system, 136 136
inside of that family as a unique CPE. 137 137
The next one we're going to talk about is CCE 138 138
and this is our final one. 139 139
CCE is our Common Configuration Enumeration. 140 140
This is a scheme 141 141
for provisioning secure configuration checks 142 142
across multiple sources. 143 143
Now essentially CCE is a collection 144 144
of configuration best practice statements. 145 145
It allows us to have these 146 146
and go through those with an automated tool. 147 147
The CCE is going to provide us with unique identifiers 148 148
for the different system configuration issues. 149 149
This way we can can very quickly and rapidly 150 150
and accurately get a correlation of the configuration data 151 151
across multiple information sources and tools 152 152
because we're all speaking the same language. 153 153
Just like I mentioned in a previous lesson 154 154
where a lot of our checklists used to be manual processes. 155 155
An assessment administrator had to go look 156 156
at different tools and check all this information manually. 157 157
Well, this is another way to make things easier 158 158
and allows us to automate. 159 159
Because if we're all talking the same language 160 160
and using the same identifiers, 161 161
we can correlate all that data across all the systems 162 162
to give us a better picture of what we're doing.