1 1 00:00:00,050 --> 00:00:02,220 In this section of the course, we're going to talk about 2 2 00:00:02,220 --> 00:00:05,370 how you can mitigate software vulnerabilities and attacks. 3 3 00:00:05,370 --> 00:00:07,620 Now, we're again going to be working in domain two, 4 4 00:00:07,620 --> 00:00:08,910 vulnerability management, 5 5 00:00:08,910 --> 00:00:11,070 and this time we'll specifically be focusing 6 6 00:00:11,070 --> 00:00:14,940 on objectives 2.2, 2.4, and 2.5. 7 7 00:00:14,940 --> 00:00:17,580 Objective 2.2 states that given a scenario, 8 8 00:00:17,580 --> 00:00:19,170 you must be able to analyze output 9 9 00:00:19,170 --> 00:00:21,030 from vulnerability assessment tools. 10 10 00:00:21,030 --> 00:00:23,250 And we'll be specifically looking at our demonstration 11 11 00:00:23,250 --> 00:00:24,720 of the Metasploit framework 12 12 00:00:24,720 --> 00:00:26,160 that we use in penetration testing 13 13 00:00:26,160 --> 00:00:27,570 and vulnerability assessment 14 14 00:00:27,570 --> 00:00:30,540 as the tool that we're going to be considering the output of. 15 15 00:00:30,540 --> 00:00:32,640 We'll also be looking at objective 2.4, 16 16 00:00:32,640 --> 00:00:34,050 which states that given a scenario, 17 17 00:00:34,050 --> 00:00:35,730 you must be able to recommend controls 18 18 00:00:35,730 --> 00:00:38,460 to mitigate attacks and software vulnerabilities. 19 19 00:00:38,460 --> 00:00:40,950 And we'll also look at objective 2.5, 20 20 00:00:40,950 --> 00:00:42,030 which states that you must be able 21 21 00:00:42,030 --> 00:00:44,640 to explain concepts related to vulnerability response, 22 22 00:00:44,640 --> 00:00:46,380 handling and management. 23 23 00:00:46,380 --> 00:00:48,300 Now first, we're going to begin by describing 24 24 00:00:48,300 --> 00:00:49,950 the software development lifecycle 25 25 00:00:49,950 --> 00:00:52,020 which is known as the SDLC. 26 26 00:00:52,020 --> 00:00:53,910 Then we're going to be going into concepts 27 27 00:00:53,910 --> 00:00:56,040 like privilege escalation and root kits, 28 28 00:00:56,040 --> 00:00:57,810 different types of overflow attacks, 29 29 00:00:57,810 --> 00:01:00,180 race conditions, improper error handling, 30 30 00:01:00,180 --> 00:01:02,220 and other design vulnerabilities. 31 31 00:01:02,220 --> 00:01:04,740 Next, we're going to discuss the various best practices 32 32 00:01:04,740 --> 00:01:06,090 that are used to be able to go forth 33 33 00:01:06,090 --> 00:01:08,130 and correct all these different vulnerabilities 34 34 00:01:08,130 --> 00:01:10,710 on different platforms that you may be working with. 35 35 00:01:10,710 --> 00:01:13,200 After that, we're going to go through a quick demonstration 36 36 00:01:13,200 --> 00:01:14,880 of how to use the Metasploit framework 37 37 00:01:14,880 --> 00:01:17,040 to break into a vulnerable piece of software 38 38 00:01:17,040 --> 00:01:19,770 just like a penetration tester or a attacker might do 39 39 00:01:19,770 --> 00:01:21,510 to a vulnerable piece of software installed 40 40 00:01:21,510 --> 00:01:23,400 on one of your network devices. 41 41 00:01:23,400 --> 00:01:25,230 And finally, we're going to take a short quiz 42 42 00:01:25,230 --> 00:01:27,210 to see what you learned during this section of the course 43 43 00:01:27,210 --> 00:01:29,130 and review each of those quiz questions fully 44 44 00:01:29,130 --> 00:01:29,970 to ensure you can explain 45 45 00:01:29,970 --> 00:01:31,860 why the correct answer was correct. 46 46 00:01:31,860 --> 00:01:34,140 So let's dive into all the different ways 47 47 00:01:34,140 --> 00:01:36,090 to mitigate software vulnerabilities and attacks 48 48 00:01:36,090 --> 00:01:37,590 in this section of the course.