1 1 00:00:00,780 --> 00:00:02,640 Remediation issues. 2 2 00:00:02,640 --> 00:00:05,340 In this lesson, we're going to talk about some of the issues 3 3 00:00:05,340 --> 00:00:08,490 you may face when you try to remediate a vulnerability. 4 4 00:00:08,490 --> 00:00:10,620 Now, there are numerous issues that can arise 5 5 00:00:10,620 --> 00:00:12,840 during attempts to remediate a vulnerability, 6 6 00:00:12,840 --> 00:00:14,430 and some of these you can control, 7 7 00:00:14,430 --> 00:00:16,020 and some of them you can't. 8 8 00:00:16,020 --> 00:00:18,300 For instance, you need to ask yourself, 9 9 00:00:18,300 --> 00:00:20,490 is the risk high enough to spend time and money 10 10 00:00:20,490 --> 00:00:22,230 on this particular issue? 11 11 00:00:22,230 --> 00:00:23,400 Again, I've mentioned this before, 12 12 00:00:23,400 --> 00:00:24,840 if it's a $10,000 problem, 13 13 00:00:24,840 --> 00:00:26,970 you're not going to spend a million dollars to fix it. 14 14 00:00:26,970 --> 00:00:28,200 And so it's going to be hard for you 15 15 00:00:28,200 --> 00:00:30,480 to get the budgetary approval to fix that issue, 16 16 00:00:30,480 --> 00:00:32,700 so that way, you wouldn't be able to remediate that issue. 17 17 00:00:32,700 --> 00:00:34,680 Instead, you'd have to accept it. 18 18 00:00:34,680 --> 00:00:35,910 You may ask yourself, 19 19 00:00:35,910 --> 00:00:38,340 can I use a compensating control instead? 20 20 00:00:38,340 --> 00:00:41,310 Well, possibly, depending on what that thing is. 21 21 00:00:41,310 --> 00:00:42,990 For instance, if you have a web server 22 22 00:00:42,990 --> 00:00:44,640 that's vulnerable on port 80, 23 23 00:00:44,640 --> 00:00:46,140 you can't just shut down port 80 24 24 00:00:46,140 --> 00:00:48,030 because you had stopped the function of the web server. 25 25 00:00:48,030 --> 00:00:48,863 And so in that case, 26 26 00:00:48,863 --> 00:00:50,700 a compensating control couldn't be used. 27 27 00:00:50,700 --> 00:00:53,010 But there may be some other control you can put in place. 28 28 00:00:53,010 --> 00:00:53,843 And so these are the things 29 29 00:00:53,843 --> 00:00:55,890 you have to think about as you go forward. 30 30 00:00:55,890 --> 00:00:58,740 Now, what are some of the main places that we have issues? 31 31 00:00:58,740 --> 00:01:00,840 Well, we have issues with legacy systems 32 32 00:01:00,840 --> 00:01:02,280 and proprietary systems. 33 33 00:01:02,280 --> 00:01:04,350 We have issues with organizational governance. 34 34 00:01:04,350 --> 00:01:06,720 We have issues with business process interruption, 35 35 00:01:06,720 --> 00:01:10,410 degrading functionality, and MOU and SLAs. 36 36 00:01:10,410 --> 00:01:13,440 In this lesson, we're going to talk about all of these topics. 37 37 00:01:13,440 --> 00:01:15,720 Now, the first one is legacy systems. 38 38 00:01:15,720 --> 00:01:17,580 What is a legacy system? 39 39 00:01:17,580 --> 00:01:19,440 Well, I like to think about a legacy system 40 40 00:01:19,440 --> 00:01:21,000 as something old. 41 41 00:01:21,000 --> 00:01:23,040 It's a computer system that's no longer supported 42 42 00:01:23,040 --> 00:01:25,500 by its vendor, and so no longer can be provided 43 43 00:01:25,500 --> 00:01:27,360 with security updates and patches. 44 44 00:01:27,360 --> 00:01:29,400 For instance, if you work in a manufacturing plant, 45 45 00:01:29,400 --> 00:01:31,440 there might be some system that is critical 46 46 00:01:31,440 --> 00:01:34,650 to your operations, but it is 20 or 30 years old, 47 47 00:01:34,650 --> 00:01:37,320 and the person who made that is no longer in business. 48 48 00:01:37,320 --> 00:01:39,270 Well, you're not going to get any more security updates 49 49 00:01:39,270 --> 00:01:40,200 or patches for that thing, 50 50 00:01:40,200 --> 00:01:42,210 but it still works and it still runs, 51 51 00:01:42,210 --> 00:01:44,550 and it might cost you millions of dollars to replace it. 52 52 00:01:44,550 --> 00:01:45,840 So what do you do? 53 53 00:01:45,840 --> 00:01:47,250 Well, you don't patch it. 54 54 00:01:47,250 --> 00:01:49,620 Instead, you start finding compensating controls 55 55 00:01:49,620 --> 00:01:52,620 like isolating it onto its own network and things like that 56 56 00:01:52,620 --> 00:01:55,260 to make sure that that system can keep running 57 57 00:01:55,260 --> 00:01:56,940 and keep the business operating. 58 58 00:01:56,940 --> 00:01:58,680 So when we're dealing with legacy systems, 59 59 00:01:58,680 --> 00:01:59,700 we're dealing with these old systems 60 60 00:01:59,700 --> 00:02:01,140 that are no longer supported. 61 61 00:02:01,140 --> 00:02:03,060 On the other hand, we have another category systems 62 62 00:02:03,060 --> 00:02:04,740 that are often not supported well, 63 63 00:02:04,740 --> 00:02:06,690 and these are proprietary systems. 64 64 00:02:06,690 --> 00:02:08,760 Proprietary systems are systems that are owned 65 65 00:02:08,760 --> 00:02:11,670 by its developer or vendor where a lack of vendor support 66 66 00:02:11,670 --> 00:02:13,980 could be an inhibitor to your remediation. 67 67 00:02:13,980 --> 00:02:15,570 Now, what do I mean by this? 68 68 00:02:15,570 --> 00:02:18,750 Well, I have a couple of proprietary systems in my business. 69 69 00:02:18,750 --> 00:02:19,890 This particular software 70 70 00:02:19,890 --> 00:02:22,440 that we have had coded by a developer. 71 71 00:02:22,440 --> 00:02:24,930 Now, we don't actually have the coder on staff. 72 72 00:02:24,930 --> 00:02:26,280 It's a third party company, 73 73 00:02:26,280 --> 00:02:28,890 and so if we need to have updates and security done, 74 74 00:02:28,890 --> 00:02:31,440 we have to contract them again to get them to support it, 75 75 00:02:31,440 --> 00:02:33,900 because we pay them and they fix the system. 76 76 00:02:33,900 --> 00:02:36,210 Now, that's one simple example of a proprietary system, 77 77 00:02:36,210 --> 00:02:37,920 but there's actually larger ones too. 78 78 00:02:37,920 --> 00:02:40,650 For example, if you look at the U.S. Department of Defense, 79 79 00:02:40,650 --> 00:02:43,080 they've got lots of proprietary systems. 80 80 00:02:43,080 --> 00:02:44,070 Not anyone can just go out 81 81 00:02:44,070 --> 00:02:46,890 and buy an F16 or an Abrams tank. 82 82 00:02:46,890 --> 00:02:48,510 These all have different systems that were built 83 83 00:02:48,510 --> 00:02:50,490 specifically for that purpose. 84 84 00:02:50,490 --> 00:02:52,117 And so they can't go to Microsoft and say, 85 85 00:02:52,117 --> 00:02:54,270 "Hey, give me a patch for an Abrams tank." 86 86 00:02:54,270 --> 00:02:56,640 Instead, they have to go back to that original vendor. 87 87 00:02:56,640 --> 00:02:58,110 And depending on the contract they have 88 88 00:02:58,110 --> 00:02:59,100 in place with that vendor, 89 89 00:02:59,100 --> 00:03:01,770 they might get monthly updates or every six month updates 90 90 00:03:01,770 --> 00:03:04,770 or every year updates or as required updates. 91 91 00:03:04,770 --> 00:03:06,900 And so that can actually inhibit your remediation, 92 92 00:03:06,900 --> 00:03:08,880 because if you're on a six-month cycle, 93 93 00:03:08,880 --> 00:03:10,620 and you identify a vulnerability today, 94 94 00:03:10,620 --> 00:03:11,670 it might take six months 95 95 00:03:11,670 --> 00:03:14,040 for them to code you a patch and then send it to you. 96 96 00:03:14,040 --> 00:03:15,450 So these are issues you have to think about 97 97 00:03:15,450 --> 00:03:17,820 when you're dealing with proprietary systems. 98 98 00:03:17,820 --> 00:03:20,940 Another hindrance for you is organizational governance. 99 99 00:03:20,940 --> 00:03:22,740 Organizational governance is the system 100 100 00:03:22,740 --> 00:03:25,320 by which an organization makes and implements decisions 101 101 00:03:25,320 --> 00:03:27,030 in pursuit of its objectives. 102 102 00:03:27,030 --> 00:03:29,100 Now, why would this be a hindrance? 103 103 00:03:29,100 --> 00:03:32,760 Well, because a lot of organizations don't value security. 104 104 00:03:32,760 --> 00:03:34,560 Now, if you work for a cybersecurity company, 105 105 00:03:34,560 --> 00:03:36,270 they probably care about security, 106 106 00:03:36,270 --> 00:03:38,400 but if you work for something like a hospital, 107 107 00:03:38,400 --> 00:03:39,750 they care about security, 108 108 00:03:39,750 --> 00:03:41,460 but that's not their top priority. 109 109 00:03:41,460 --> 00:03:43,290 Their top priority is making sure 110 110 00:03:43,290 --> 00:03:45,210 that patients get the healthcare they need. 111 111 00:03:45,210 --> 00:03:47,580 And so these organizations tend to be run by doctors 112 112 00:03:47,580 --> 00:03:50,460 and hospital administrators, not security professionals. 113 113 00:03:50,460 --> 00:03:53,220 And so organizational governance may put you at bay 114 114 00:03:53,220 --> 00:03:55,680 and say you can't patch those systems right now, 115 115 00:03:55,680 --> 00:03:58,080 because what if you had to patch all the X-ray machines 116 116 00:03:58,080 --> 00:04:00,690 in a hospital and it's going to take them down for two days? 117 117 00:04:00,690 --> 00:04:02,130 They're not going to allow you to do that. 118 118 00:04:02,130 --> 00:04:02,963 They're going to say, 119 119 00:04:02,963 --> 00:04:04,110 we're just going to keep operating 'em, right? 120 120 00:04:04,110 --> 00:04:06,210 And they would have to find out some alternate way 121 121 00:04:06,210 --> 00:04:07,800 to be able to get those things patched, 122 122 00:04:07,800 --> 00:04:09,720 because they can't take 'em all down at once. 123 123 00:04:09,720 --> 00:04:12,060 And so this is the idea of organizational governance. 124 124 00:04:12,060 --> 00:04:14,130 Sometimes, that organizational inertia, 125 125 00:04:14,130 --> 00:04:16,170 that governance that tells you how you're going to do things 126 126 00:04:16,170 --> 00:04:18,660 can really handcuff you as a cybersecurity professional. 127 127 00:04:18,660 --> 00:04:19,800 So keep that in mind. 128 128 00:04:19,800 --> 00:04:21,570 This brings us to another similar concept 129 129 00:04:21,570 --> 00:04:23,610 known as business process interruption. 130 130 00:04:23,610 --> 00:04:26,520 Now, business process interruption is any period of time 131 131 00:04:26,520 --> 00:04:28,800 when an organization's way of doing business operations 132 132 00:04:28,800 --> 00:04:31,710 is interrupted, and this can be caused by an outside force, 133 133 00:04:31,710 --> 00:04:34,590 but it can also be caused by our own security personnel. 134 134 00:04:34,590 --> 00:04:36,510 I mentioned previously, if you're going to install a patch 135 135 00:04:36,510 --> 00:04:38,550 to a server and you have to reboot that server, 136 136 00:04:38,550 --> 00:04:40,440 it might take 10 or 15 or 20 minutes 137 137 00:04:40,440 --> 00:04:42,240 for that server to come back online. 138 138 00:04:42,240 --> 00:04:44,010 During that 10 or 15 or 20 minutes, 139 139 00:04:44,010 --> 00:04:45,930 that server isn't doing its job. 140 140 00:04:45,930 --> 00:04:48,390 You have now interrupted the business process. 141 141 00:04:48,390 --> 00:04:50,040 And so you would have to figure out 142 142 00:04:50,040 --> 00:04:51,810 when is the best time to do this? 143 143 00:04:51,810 --> 00:04:53,430 You may find out at two in the afternoon, 144 144 00:04:53,430 --> 00:04:55,800 this thing needs to be patched right now. 145 145 00:04:55,800 --> 00:04:58,590 But your business doesn't close till 11 at night. 146 146 00:04:58,590 --> 00:04:59,940 What are you going to do? 147 147 00:04:59,940 --> 00:05:01,410 Most likely, you're going to try to put 148 148 00:05:01,410 --> 00:05:02,940 some kind of compensation in place, 149 149 00:05:02,940 --> 00:05:04,560 additional monitoring in place, 150 150 00:05:04,560 --> 00:05:06,300 and wait until the business is closed 151 151 00:05:06,300 --> 00:05:08,430 and then do the update overnight. 152 152 00:05:08,430 --> 00:05:10,650 This is why a lot of security people end up working 153 153 00:05:10,650 --> 00:05:12,690 overnight shifts because we're working 154 154 00:05:12,690 --> 00:05:14,550 while the other people in the business are actually sleeping 155 155 00:05:14,550 --> 00:05:17,040 because what we do could affect their business. 156 156 00:05:17,040 --> 00:05:18,000 Now, this becomes harder 157 157 00:05:18,000 --> 00:05:20,370 when you start dealing with 24/7 operations. 158 158 00:05:20,370 --> 00:05:22,650 Amazon.com never sleeps. 159 159 00:05:22,650 --> 00:05:24,660 Diontraining.com never sleeps. 160 160 00:05:24,660 --> 00:05:26,550 It's available 24 hours a day. 161 161 00:05:26,550 --> 00:05:28,470 So we had to build our systems in place 162 162 00:05:28,470 --> 00:05:30,240 so that we can work through these problems, 163 163 00:05:30,240 --> 00:05:32,580 and we can still do our security patching and updating 164 164 00:05:32,580 --> 00:05:34,800 without interrupting our business processes. 165 165 00:05:34,800 --> 00:05:36,090 Another thing you have to worry about 166 166 00:05:36,090 --> 00:05:37,740 is degrading functionality. 167 167 00:05:37,740 --> 00:05:39,840 Now, degrading functionality is a period of time 168 168 00:05:39,840 --> 00:05:41,970 when the organization systems are not performing 169 169 00:05:41,970 --> 00:05:44,430 at peak functionality, and this could lead 170 170 00:05:44,430 --> 00:05:46,020 to business process interruption. 171 171 00:05:46,020 --> 00:05:48,090 For instance, let's say I have two web servers 172 172 00:05:48,090 --> 00:05:49,500 that are forward-facing to the internet, 173 173 00:05:49,500 --> 00:05:51,270 and then they're behind a load balancer. 174 174 00:05:51,270 --> 00:05:52,920 Can I take one down and patch it 175 175 00:05:52,920 --> 00:05:54,510 while the other one carries a load? 176 176 00:05:54,510 --> 00:05:58,140 Yes, I can, but I'm now going to be in a degraded condition, 177 177 00:05:58,140 --> 00:05:59,970 because I only have half of my capacity 178 178 00:05:59,970 --> 00:06:02,070 while the one is offline being repaired. 179 179 00:06:02,070 --> 00:06:03,150 Then when I bring it online, 180 180 00:06:03,150 --> 00:06:05,580 I can bring the other one offline and do the same thing. 181 181 00:06:05,580 --> 00:06:08,460 That's one way that we do our patching of our systems 182 182 00:06:08,460 --> 00:06:10,170 is that way, we can take one offline, 183 183 00:06:10,170 --> 00:06:11,670 patch it and bring it back on. 184 184 00:06:11,670 --> 00:06:14,250 By doing that, because we have the redundancy built in, 185 185 00:06:14,250 --> 00:06:16,950 we can minimize our business process interruption. 186 186 00:06:16,950 --> 00:06:20,370 But if that one server that was online went offline 187 187 00:06:20,370 --> 00:06:22,440 because of an availability attack at that time, 188 188 00:06:22,440 --> 00:06:23,790 we would then be completely down. 189 189 00:06:23,790 --> 00:06:26,160 So we are operating in degraded functionality. 190 190 00:06:26,160 --> 00:06:27,960 We are only one of two servers up 191 191 00:06:27,960 --> 00:06:29,670 instead of two of two servers up, 192 192 00:06:29,670 --> 00:06:31,260 so we lost our redundancy there. 193 193 00:06:31,260 --> 00:06:33,090 That's the idea of degrading functionality. 194 194 00:06:33,090 --> 00:06:34,440 The next concept we have to talk about 195 195 00:06:34,440 --> 00:06:37,710 is memorandums of understandings or MOUs. 196 196 00:06:37,710 --> 00:06:39,630 An MOU usually is a preliminary 197 197 00:06:39,630 --> 00:06:41,910 or exploratory agreement to express an intent 198 198 00:06:41,910 --> 00:06:44,310 to work together that is not legally binding 199 199 00:06:44,310 --> 00:06:46,410 and does not involve the exchange of money. 200 200 00:06:46,410 --> 00:06:48,810 Essentially, I like to call these handshake deals. 201 201 00:06:48,810 --> 00:06:50,610 They're not contractually binding, 202 202 00:06:50,610 --> 00:06:52,710 but I've used a lot of MOU in my day. 203 203 00:06:52,710 --> 00:06:54,270 For instance, early in my career, 204 204 00:06:54,270 --> 00:06:55,890 I was based out of one building, 205 205 00:06:55,890 --> 00:06:57,480 and I worked with another competitor 206 206 00:06:57,480 --> 00:06:59,280 who happened to be based out of a different building. 207 207 00:06:59,280 --> 00:07:00,750 And we had an MOU 208 208 00:07:00,750 --> 00:07:02,730 that if there was some kind of a major outage, 209 209 00:07:02,730 --> 00:07:05,940 and my facility was down on power and their facility wasn't, 210 210 00:07:05,940 --> 00:07:08,100 we could actually come over to their facility and work. 211 211 00:07:08,100 --> 00:07:09,930 And the same thing that if their facility was down 212 212 00:07:09,930 --> 00:07:12,150 and ours was up, they would come over to us and work. 213 213 00:07:12,150 --> 00:07:14,700 And so we had this friendly competitiveness between us 214 214 00:07:14,700 --> 00:07:15,750 where we actually helped each other, 215 215 00:07:15,750 --> 00:07:17,310 'cause we weren't direct competitors, 216 216 00:07:17,310 --> 00:07:19,170 but we were in the same general business space. 217 217 00:07:19,170 --> 00:07:20,490 And so we had a lot of the same equipment, 218 218 00:07:20,490 --> 00:07:21,480 a lot of the same phone lines, 219 219 00:07:21,480 --> 00:07:22,950 a lot of the same computer systems, 220 220 00:07:22,950 --> 00:07:24,360 and so that worked out well. 221 221 00:07:24,360 --> 00:07:27,030 But there was really nothing to hold either of us to it. 222 222 00:07:27,030 --> 00:07:29,130 If it was really bad day and their power went out 223 223 00:07:29,130 --> 00:07:30,697 and my guys were all busy, I would say, 224 224 00:07:30,697 --> 00:07:32,040 "Sorry, I've got no room for you." 225 225 00:07:32,040 --> 00:07:32,880 There's nothing you can do about it. 226 226 00:07:32,880 --> 00:07:34,350 There was no contract, right? 227 227 00:07:34,350 --> 00:07:35,520 And so that's the idea of an MOU. 228 228 00:07:35,520 --> 00:07:37,980 It's just kind of a gentleman's agreement, if you will, 229 229 00:07:37,980 --> 00:07:39,330 or a handshake deal. 230 230 00:07:39,330 --> 00:07:40,260 Now, on the other side of things, 231 231 00:07:40,260 --> 00:07:42,120 we have a service level agreement, 232 232 00:07:42,120 --> 00:07:43,770 and this is really where you want to get to 233 233 00:07:43,770 --> 00:07:44,603 when you're starting to deal 234 234 00:07:44,603 --> 00:07:46,830 with third party contractors and vendors. 235 235 00:07:46,830 --> 00:07:48,240 This is a contractual agreement 236 236 00:07:48,240 --> 00:07:49,740 that sets out the detailed terms 237 237 00:07:49,740 --> 00:07:52,470 under which an ongoing service will be provided. 238 238 00:07:52,470 --> 00:07:55,590 So if I'm going to buy a proprietary system from somebody, 239 239 00:07:55,590 --> 00:07:57,240 I shouldn't have an MOU that tells me 240 240 00:07:57,240 --> 00:07:58,440 how they're going to support me. 241 241 00:07:58,440 --> 00:07:59,910 I should have an SLA. 242 242 00:07:59,910 --> 00:08:01,320 That SLA should give us terms 243 243 00:08:01,320 --> 00:08:03,240 for what kind of patch support they're going to give us 244 244 00:08:03,240 --> 00:08:04,560 and what kind of forensic support 245 245 00:08:04,560 --> 00:08:07,410 and instant response support and things like that. 246 246 00:08:07,410 --> 00:08:10,590 Anything can be contractually binding inside of this SLA. 247 247 00:08:10,590 --> 00:08:12,240 For instance, I have an SLA 248 248 00:08:12,240 --> 00:08:15,120 with my underlying service provider for our website. 249 249 00:08:15,120 --> 00:08:18,210 They have a 99.99% uptime. 250 250 00:08:18,210 --> 00:08:21,870 Now, if they don't maintain that 99.99% uptime, 251 251 00:08:21,870 --> 00:08:23,700 that means they're actually going to have to refund us money, 252 252 00:08:23,700 --> 00:08:26,370 because they're not meeting their portion of the SLA. 253 253 00:08:26,370 --> 00:08:27,420 That's the idea of an SLA. 254 254 00:08:27,420 --> 00:08:29,430 There are terms and there are consequences 255 255 00:08:29,430 --> 00:08:32,080 if that agreement is broken because it is a contract.