1 1 00:00:00,600 --> 00:00:02,700 Design vulnerabilities. 2 2 00:00:02,700 --> 00:00:04,260 In this lesson, we're going to talk 3 3 00:00:04,260 --> 00:00:06,510 about some software design vulnerabilities 4 4 00:00:06,510 --> 00:00:08,910 and what are some things you can do to overcome them. 5 5 00:00:08,910 --> 00:00:10,530 Now, when it comes to vulnerabilities, 6 6 00:00:10,530 --> 00:00:12,240 vulnerabilities often arise 7 7 00:00:12,240 --> 00:00:14,820 from the general design of your software code. 8 8 00:00:14,820 --> 00:00:17,250 And so if you do bad software code design, 9 9 00:00:17,250 --> 00:00:19,350 you're going to have a lot more vulnerabilities. 10 10 00:00:19,350 --> 00:00:22,620 So in this lesson, we're going to focus on three main types. 11 11 00:00:22,620 --> 00:00:25,350 We have insecure components, insufficient logging 12 12 00:00:25,350 --> 00:00:28,650 and monitoring, and weak or default configurations. 13 13 00:00:28,650 --> 00:00:31,440 Now, when we talk about insecure components, what is this? 14 14 00:00:31,440 --> 00:00:33,210 Well, it's really any code that's used 15 15 00:00:33,210 --> 00:00:36,540 or invoked outside of the main program development process. 16 16 00:00:36,540 --> 00:00:37,980 So when you're dealing with this 17 17 00:00:37,980 --> 00:00:39,900 and you start dealing with insecure components, 18 18 00:00:39,900 --> 00:00:42,240 this can come from a lot of different areas. 19 19 00:00:42,240 --> 00:00:44,760 For instance, it could come from code reuse. 20 20 00:00:44,760 --> 00:00:46,110 Now, this is where you take one block 21 21 00:00:46,110 --> 00:00:47,640 of code from somewhere else in the program 22 22 00:00:47,640 --> 00:00:49,680 just copy and paste it and use it again. 23 23 00:00:49,680 --> 00:00:50,940 Or you take it from one application 24 24 00:00:50,940 --> 00:00:52,650 and put it into another application. 25 25 00:00:52,650 --> 00:00:55,110 A lot of times people go onto Stack Exchange and they'll go 26 26 00:00:55,110 --> 00:00:57,720 and copy people's code and put it into their own. 27 27 00:00:57,720 --> 00:00:59,670 Now, there's nothing wrong with doing that initially 28 28 00:00:59,670 --> 00:01:01,920 but if you're ever using code and you don't know 29 29 00:01:01,920 --> 00:01:03,510 if it's secure or not, you could be bringing 30 30 00:01:03,510 --> 00:01:05,970 in vulnerabilities into your program by doing that. 31 31 00:01:05,970 --> 00:01:08,670 And so this is why we consider it an insecure component. 32 32 00:01:08,670 --> 00:01:11,550 Another thing we might use is a third party library. 33 33 00:01:11,550 --> 00:01:14,040 Anytime you bring in a library to do some function for you, 34 34 00:01:14,040 --> 00:01:16,830 you are importing that code into your program. 35 35 00:01:16,830 --> 00:01:18,840 And so you might bring in a dynamic link library 36 36 00:01:18,840 --> 00:01:20,610 in Windows or a shared object library 37 37 00:01:20,610 --> 00:01:22,710 in Linux, and that might give you the ability to 38 38 00:01:22,710 --> 00:01:25,140 do network connections or do cryptography. 39 39 00:01:25,140 --> 00:01:27,030 But if those things were not secure, 40 40 00:01:27,030 --> 00:01:29,970 you now brought that insecurity into your program. 41 41 00:01:29,970 --> 00:01:32,460 And the third thing is software development toolkits. 42 42 00:01:32,460 --> 00:01:35,070 Again, SDKs are really helpful as a programmer 43 43 00:01:35,070 --> 00:01:36,000 because I don't have to go 44 44 00:01:36,000 --> 00:01:38,640 and create all those pre-built functions, but 45 45 00:01:38,640 --> 00:01:40,500 if the person who built those pre-built functions 46 46 00:01:40,500 --> 00:01:41,760 didn't do a good job, 47 47 00:01:41,760 --> 00:01:43,860 you're bringing in those vulnerabilities as well. 48 48 00:01:43,860 --> 00:01:45,690 And the other issue with these three areas is 49 49 00:01:45,690 --> 00:01:48,240 especially with STKs and third party libraries 50 50 00:01:48,240 --> 00:01:50,640 is sometimes they built it thinking it was good 51 51 00:01:50,640 --> 00:01:53,340 and then six months later, there's a vulnerability to it. 52 52 00:01:53,340 --> 00:01:54,660 If you're using an old version 53 53 00:01:54,660 --> 00:01:57,150 of a library or an old version of an SDK, 54 54 00:01:57,150 --> 00:01:59,490 you aren't using the latest and greatest patched one 55 55 00:01:59,490 --> 00:02:01,920 and therefore you're missing those security fixes 56 56 00:02:01,920 --> 00:02:04,890 and you're bringing in those insecurities into your program. 57 57 00:02:04,890 --> 00:02:06,030 The second area we want to talk 58 58 00:02:06,030 --> 00:02:08,550 about is insufficient logging and monitoring. 59 59 00:02:08,550 --> 00:02:11,070 Now, this is any program that does not properly record 60 60 00:02:11,070 --> 00:02:13,830 or log detailed enough information for an analyst to 61 61 00:02:13,830 --> 00:02:16,590 perform their job when there's an incident that happens. 62 62 00:02:16,590 --> 00:02:19,350 So if I create a program and I don't have any kind 63 63 00:02:19,350 --> 00:02:21,990 of logging and monitoring, well, that's not going to be very 64 64 00:02:21,990 --> 00:02:23,400 good for my analysts who have to deal 65 65 00:02:23,400 --> 00:02:24,630 with the incident response later. 66 66 00:02:24,630 --> 00:02:27,060 So we want to make sure we're always setting up our logging 67 67 00:02:27,060 --> 00:02:29,430 and our monitoring to support our use case. 68 68 00:02:29,430 --> 00:02:32,220 And that way we can answer the who, the what, the when, 69 69 00:02:32,220 --> 00:02:35,310 the where, and the how, when things go wrong. 70 70 00:02:35,310 --> 00:02:36,840 Now, what is your use case? 71 71 00:02:36,840 --> 00:02:39,060 Well, that's up to you and your organization. 72 72 00:02:39,060 --> 00:02:41,160 You're going to determine how much logging you want, 73 73 00:02:41,160 --> 00:02:43,920 how long you want to store it for, and all those details 74 74 00:02:43,920 --> 00:02:46,800 like we talked about back in our logging lessons. 75 75 00:02:46,800 --> 00:02:48,540 The third area we want to talk about is weak 76 76 00:02:48,540 --> 00:02:50,280 or default configurations. 77 77 00:02:50,280 --> 00:02:52,890 Now, this is any program that uses ineffective credentials 78 78 00:02:52,890 --> 00:02:55,230 or configurations, or one in which the defaults 79 79 00:02:55,230 --> 00:02:57,420 have not been changed for security. 80 80 00:02:57,420 --> 00:03:00,000 When you're dealing with weak or default configurations, 81 81 00:03:00,000 --> 00:03:02,430 there are lots of these things out there in the marketplace 82 82 00:03:02,430 --> 00:03:05,580 and they are running amuck in a lot of people's networks. 83 83 00:03:05,580 --> 00:03:08,070 Now, many applications choose simply to run 84 84 00:03:08,070 --> 00:03:09,420 as route or local admin. 85 85 00:03:09,420 --> 00:03:11,280 That's their default configuration. 86 86 00:03:11,280 --> 00:03:12,270 You need to ask yourself 87 87 00:03:12,270 --> 00:03:14,130 does this program really need to be root? 88 88 00:03:14,130 --> 00:03:16,320 Does this program really need to be an admin? 89 89 00:03:16,320 --> 00:03:18,120 And if not, don't let it run that way 90 90 00:03:18,120 --> 00:03:20,700 because you want to use lease privileges. 91 91 00:03:20,700 --> 00:03:22,680 Also, sometimes you have some of these programs 92 92 00:03:22,680 --> 00:03:24,990 and by default, their permissions are really vague. 93 93 00:03:24,990 --> 00:03:27,780 They're really permissive, and so they allow a lot of files 94 94 00:03:27,780 --> 00:03:30,570 and directories to be read and right and executed to 95 95 00:03:30,570 --> 00:03:33,000 and this would be a weak configuration. 96 96 00:03:33,000 --> 00:03:34,920 Another place I see this all the time is when 97 97 00:03:34,920 --> 00:03:36,750 you're using hardware appliances where you're 98 98 00:03:36,750 --> 00:03:38,700 using some kind of software that has a password 99 99 00:03:38,700 --> 00:03:40,050 and username already built in 100 100 00:03:40,050 --> 00:03:42,300 and it's often something like administrator administrator 101 101 00:03:42,300 --> 00:03:44,700 or admin admin or route route. 102 102 00:03:44,700 --> 00:03:46,800 This is a week or default configuration 103 103 00:03:46,800 --> 00:03:48,180 that should be changed immediately 104 104 00:03:48,180 --> 00:03:50,100 once you install it into the environment. 105 105 00:03:50,100 --> 00:03:51,930 Now, what's the best practice to prevent some 106 106 00:03:51,930 --> 00:03:52,980 of these weaknesses? 107 107 00:03:52,980 --> 00:03:55,626 Well, the biggest one is to utilize scripted installations 108 108 00:03:55,626 --> 00:03:57,900 and baseline configuration templates to 109 109 00:03:57,900 --> 00:04:00,120 secure your applications during install. 110 110 00:04:00,120 --> 00:04:02,460 So if I'm going to install some program, 111 111 00:04:02,460 --> 00:04:04,410 there should be a security configuration template 112 112 00:04:04,410 --> 00:04:06,660 or a scripted installation that actually goes through 113 113 00:04:06,660 --> 00:04:08,730 and makes those things more secure. 114 114 00:04:08,730 --> 00:04:10,950 This would be something that your organization does itself 115 115 00:04:10,950 --> 00:04:13,050 or something provided by the manufacturer.