1 1 00:00:00,240 --> 00:00:01,920 Back in your Security+ studies, 2 2 00:00:01,920 --> 00:00:04,440 you learned a lot about the different types of threats 3 3 00:00:04,440 --> 00:00:06,090 that occur to the safety and security 4 4 00:00:06,090 --> 00:00:07,890 of our networks and our systems. 5 5 00:00:07,890 --> 00:00:09,780 In this lesson, we're going to talk about 6 6 00:00:09,780 --> 00:00:12,360 the two highest levels of threat classification categories 7 7 00:00:12,360 --> 00:00:13,200 that we have. 8 8 00:00:13,200 --> 00:00:16,770 These are known as known threats and unknown threats. 9 9 00:00:16,770 --> 00:00:18,600 Now, known threats are any threat 10 10 00:00:18,600 --> 00:00:20,850 that can be identified using basic signature 11 11 00:00:20,850 --> 00:00:22,320 or pattern matching. 12 12 00:00:22,320 --> 00:00:25,560 These are things like malware and documented exploits. 13 13 00:00:25,560 --> 00:00:26,790 When I talk about malware, 14 14 00:00:26,790 --> 00:00:28,470 I'm talking about any software 15 15 00:00:28,470 --> 00:00:30,600 that intentionally is designed to cause damage 16 16 00:00:30,600 --> 00:00:34,350 to a computer, a server, a client, or a computer network. 17 17 00:00:34,350 --> 00:00:36,600 These are things like viruses, and rootkits, 18 18 00:00:36,600 --> 00:00:38,640 and Trojans, and botnets, 19 19 00:00:38,640 --> 00:00:41,700 all the things you talked about back in Security+. 20 20 00:00:41,700 --> 00:00:44,910 Now, these are very straightforward to identify and scan for 21 21 00:00:44,910 --> 00:00:47,790 because we have a matching signature in our database 22 22 00:00:47,790 --> 00:00:49,410 that can help us detect it. 23 23 00:00:49,410 --> 00:00:52,290 This brings us to the idea of a documented exploit. 24 24 00:00:52,290 --> 00:00:55,080 Now a documented exploit is a piece of software, 25 25 00:00:55,080 --> 00:00:57,060 data, or a sequence of commands 26 26 00:00:57,060 --> 00:00:58,830 that takes advantage of a vulnerability 27 27 00:00:58,830 --> 00:01:00,660 to cause unintended behavior, 28 28 00:01:00,660 --> 00:01:03,780 or to gain unauthorized access to sensitive data. 29 29 00:01:03,780 --> 00:01:05,790 If we're using a vulnerability scanner, 30 30 00:01:05,790 --> 00:01:08,490 we can look for certain things in our environments 31 31 00:01:08,490 --> 00:01:11,400 that we know have documented exploits against them, 32 32 00:01:11,400 --> 00:01:13,350 and therefore we can detect those things, 33 33 00:01:13,350 --> 00:01:15,420 making them a known threat. 34 34 00:01:15,420 --> 00:01:18,300 These are very static and we deal with known threats, 35 35 00:01:18,300 --> 00:01:20,010 these are things that are easily detected 36 36 00:01:20,010 --> 00:01:24,240 using signatures, hash values, or other things like that. 37 37 00:01:24,240 --> 00:01:25,770 Now, the next thing we want to talk about 38 38 00:01:25,770 --> 00:01:28,440 is the other category, which is unknown threats. 39 39 00:01:28,440 --> 00:01:30,390 And this is a more dangerous area for us 40 40 00:01:30,390 --> 00:01:32,100 as cybersecurity analysts. 41 41 00:01:32,100 --> 00:01:35,250 An unknown threat is any threat that cannot be identified 42 42 00:01:35,250 --> 00:01:37,920 using basic signature or pattern matching. 43 43 00:01:37,920 --> 00:01:39,480 Now, when we talk about unknown threats, 44 44 00:01:39,480 --> 00:01:41,610 there are lots of these things out there. 45 45 00:01:41,610 --> 00:01:45,420 We have zero-day exploits, we have obfuscated malware code, 46 46 00:01:45,420 --> 00:01:48,630 we have behavior-based detection, we have recycled threats, 47 47 00:01:48,630 --> 00:01:52,140 we have known unknowns, and we have unknown unknowns. 48 48 00:01:52,140 --> 00:01:53,340 We're going to talk about each of those 49 49 00:01:53,340 --> 00:01:55,110 through the rest of this lesson. 50 50 00:01:55,110 --> 00:01:58,530 A zero-day exploit is any unknown exploit in the wild 51 51 00:01:58,530 --> 00:02:01,830 that exposes a vulnerability in the software or hardware, 52 52 00:02:01,830 --> 00:02:04,170 and it can create complicated problems for us 53 53 00:02:04,170 --> 00:02:07,320 well before anyone realizes that something is wrong. 54 54 00:02:07,320 --> 00:02:09,840 When we are dealing with a zero-day vulnerability, 55 55 00:02:09,840 --> 00:02:11,880 this is something that somebody found out in the wild 56 56 00:02:11,880 --> 00:02:13,950 and they said, "Ah, I found a new way 57 57 00:02:13,950 --> 00:02:15,630 to break in on something." 58 58 00:02:15,630 --> 00:02:18,810 And we don't have a way to detect that or to stop it yet. 59 59 00:02:18,810 --> 00:02:21,660 And so it is a zero-day because the attack happens 60 60 00:02:21,660 --> 00:02:24,780 on day zero, the first day it was discovered. 61 61 00:02:24,780 --> 00:02:26,430 And this becomes a big problem, 62 62 00:02:26,430 --> 00:02:28,050 and is one of the most dangerous areas 63 63 00:02:28,050 --> 00:02:30,450 for us as cybersecurity analysts. 64 64 00:02:30,450 --> 00:02:31,860 The next area we want to talk about 65 65 00:02:31,860 --> 00:02:33,990 is Obfuscated Malware Code. 66 66 00:02:33,990 --> 00:02:36,570 This is malicious code whose execution 67 67 00:02:36,570 --> 00:02:38,550 the malware author has attempted to hide 68 68 00:02:38,550 --> 00:02:41,400 through various techniques such as compression, 69 69 00:02:41,400 --> 00:02:45,000 encryption, or encoding to severely limit our attempts 70 70 00:02:45,000 --> 00:02:47,430 to statically analyze that malware. 71 71 00:02:47,430 --> 00:02:48,360 Now, when you do this, 72 72 00:02:48,360 --> 00:02:50,040 you're essentially scrambling the code 73 73 00:02:50,040 --> 00:02:51,420 or changing it slightly, 74 74 00:02:51,420 --> 00:02:54,120 and if you keep doing this randomly at different intervals 75 75 00:02:54,120 --> 00:02:56,010 you're going to be able to take a known threat 76 76 00:02:56,010 --> 00:02:57,360 and essentially make it unknown, 77 77 00:02:57,360 --> 00:02:59,970 because you continually are scrambling that code 78 78 00:02:59,970 --> 00:03:01,950 making those signatures inaccurate 79 79 00:03:01,950 --> 00:03:04,020 and they won't detect it anymore. 80 80 00:03:04,020 --> 00:03:05,160 The next thing we want to talk about 81 81 00:03:05,160 --> 00:03:07,020 is behavior-based detection. 82 82 00:03:07,020 --> 00:03:09,300 Now, behavior-based detection is really important 83 83 00:03:09,300 --> 00:03:12,510 when we're trying to get unknown threats and discover them. 84 84 00:03:12,510 --> 00:03:14,610 The reason is we can't use a signature 85 85 00:03:14,610 --> 00:03:17,730 because they're unknown, but using behavior-based detection 86 86 00:03:17,730 --> 00:03:19,650 this is a malware detection method 87 87 00:03:19,650 --> 00:03:22,620 that evaluates an object based on its intended actions 88 88 00:03:22,620 --> 00:03:25,380 before it can actually execute that behavior. 89 89 00:03:25,380 --> 00:03:27,990 For example, if you send me a piece of email 90 90 00:03:27,990 --> 00:03:29,460 with an attachment in it, 91 91 00:03:29,460 --> 00:03:32,280 that attachment may be opened in a sandbox first, 92 92 00:03:32,280 --> 00:03:34,080 evaluated based on its behavior, 93 93 00:03:34,080 --> 00:03:36,720 see if it's malicious or not, and if it isn't malicious 94 94 00:03:36,720 --> 00:03:39,780 then be sent into my inbox, and if it is malicious, 95 95 00:03:39,780 --> 00:03:41,970 it can be sent out and be destroyed. 96 96 00:03:41,970 --> 00:03:44,310 That's the idea of a behavior-based detection. 97 97 00:03:44,310 --> 00:03:46,230 When we're looking at behavior-based detection, 98 98 00:03:46,230 --> 00:03:48,240 we're going to be doing things heuristically. 99 99 00:03:48,240 --> 00:03:49,680 We're looking at all the different things 100 100 00:03:49,680 --> 00:03:51,900 that are around this, what ports are being opened, 101 101 00:03:51,900 --> 00:03:53,940 what calls are being made in the software, 102 102 00:03:53,940 --> 00:03:55,560 and based on that, we can determine 103 103 00:03:55,560 --> 00:03:57,210 if it's good or if it's bad, 104 104 00:03:57,210 --> 00:03:59,310 and whether we should allow it or not. 105 105 00:03:59,310 --> 00:04:00,600 Now the next one we're going to talk about 106 106 00:04:00,600 --> 00:04:02,610 is what's known as a recycled threat. 107 107 00:04:02,610 --> 00:04:04,740 Now, recycled threat refers to the process 108 108 00:04:04,740 --> 00:04:08,100 of combining and modifying parts of existing exploit code 109 109 00:04:08,100 --> 00:04:11,010 to create new threats that are not as easily identified 110 110 00:04:11,010 --> 00:04:12,480 by automated scanning. 111 111 00:04:12,480 --> 00:04:14,580 Again, if we take different pieces and parts 112 112 00:04:14,580 --> 00:04:17,190 of different malware code and we put them together, 113 113 00:04:17,190 --> 00:04:19,950 we can now bypass the signature-based detection 114 114 00:04:19,950 --> 00:04:22,650 of a known threat because it is now something new. 115 115 00:04:22,650 --> 00:04:24,450 We've recycled it, we've changed it, 116 116 00:04:24,450 --> 00:04:26,370 and now we might be able to get it through that system 117 117 00:04:26,370 --> 00:04:28,980 and pass the anti-malware scans. 118 118 00:04:28,980 --> 00:04:30,120 The next two we're going to talk about 119 119 00:04:30,120 --> 00:04:32,790 is known unknowns and unknown unknowns. 120 120 00:04:32,790 --> 00:04:35,520 Now known unknowns is a classification of malware 121 121 00:04:35,520 --> 00:04:37,590 that contains obfuscated techniques 122 122 00:04:37,590 --> 00:04:39,903 to circumvent signature matching and detection. 123 123 00:04:39,903 --> 00:04:42,240 When we talk about unknown unknowns, 124 124 00:04:42,240 --> 00:04:43,800 this is a classification of malware 125 125 00:04:43,800 --> 00:04:46,800 that contains completely new attack vectors and exploits. 126 126 00:04:46,800 --> 00:04:49,110 Now, these both come from this chart, 127 127 00:04:49,110 --> 00:04:51,780 and you'll see here I have four quadrants on the screen 128 128 00:04:51,780 --> 00:04:54,480 I have the unknown knowns, the known knowns, 129 129 00:04:54,480 --> 00:04:57,480 the unknown unknowns, and the known unknowns. 130 130 00:04:57,480 --> 00:04:58,920 Now when I deal with all of these 131 131 00:04:58,920 --> 00:05:00,090 and we start looking at them, 132 132 00:05:00,090 --> 00:05:02,430 each one is going to tell us something different. 133 133 00:05:02,430 --> 00:05:04,650 And when we take our malware that we're looking at, 134 134 00:05:04,650 --> 00:05:06,930 we can put it in one of these four categories. 135 135 00:05:06,930 --> 00:05:09,480 For instance, if we start in the upper right corner 136 136 00:05:09,480 --> 00:05:11,490 we have the known knowns. 137 137 00:05:11,490 --> 00:05:13,350 These are things that we are certain of. 138 138 00:05:13,350 --> 00:05:16,290 We have a piece of malware, we have a good signature for it, 139 139 00:05:16,290 --> 00:05:18,270 and therefore it is a known threat. 140 140 00:05:18,270 --> 00:05:21,030 We know what it is, and when it comes into our system 141 141 00:05:21,030 --> 00:05:23,340 we immediately can stop it, we can block it, 142 142 00:05:23,340 --> 00:05:25,200 we can alert on it, whatever we need to do 143 143 00:05:25,200 --> 00:05:27,750 because we are certain, we are clear and transparent 144 144 00:05:27,750 --> 00:05:29,880 this is a bad thing. 145 145 00:05:29,880 --> 00:05:31,800 Now, the next one we have is what's known 146 146 00:05:31,800 --> 00:05:34,980 as an unknown known, this is on the top left. 147 147 00:05:34,980 --> 00:05:38,010 Now, an unknown known is something that is known 148 148 00:05:38,010 --> 00:05:40,920 to other people, but it may not be known to you. 149 149 00:05:40,920 --> 00:05:43,470 For example, there might be a signature out there 150 150 00:05:43,470 --> 00:05:45,180 inside the McAfee firewall, 151 151 00:05:45,180 --> 00:05:47,550 but there's not one inside your firewall. 152 152 00:05:47,550 --> 00:05:50,280 And so McAfee knows about it and they can stop it, 153 153 00:05:50,280 --> 00:05:53,160 it's a known thing, but to you it's unknown. 154 154 00:05:53,160 --> 00:05:56,730 And that's what an unknown known is, that top left corner. 155 155 00:05:56,730 --> 00:05:58,650 Now the two we really have to be concerned with 156 156 00:05:58,650 --> 00:06:00,330 is the bottom of this chart, 157 157 00:06:00,330 --> 00:06:03,990 and this is our known unknowns and our unknown unknowns. 158 158 00:06:03,990 --> 00:06:06,060 When we deal with a known unknown, 159 159 00:06:06,060 --> 00:06:08,790 this is where this is something that is an unknown thing, 160 160 00:06:08,790 --> 00:06:10,560 we don't have a signature for it. 161 161 00:06:10,560 --> 00:06:12,510 All the things here on the bottom where they are 162 162 00:06:12,510 --> 00:06:15,390 something unknown means we don't have a signature. 163 163 00:06:15,390 --> 00:06:16,980 Now if it's a known unknown, 164 164 00:06:16,980 --> 00:06:19,140 these are things that we can't predict 165 165 00:06:19,140 --> 00:06:20,430 so we need to start doing research 166 166 00:06:20,430 --> 00:06:23,670 to start reducing the uncertainty we have around this thing. 167 167 00:06:23,670 --> 00:06:26,880 This unknown has to become known at some point, 168 168 00:06:26,880 --> 00:06:28,800 and so what we do is we know that it's bad 169 169 00:06:28,800 --> 00:06:30,120 that's the known part of it, 170 170 00:06:30,120 --> 00:06:32,670 but we don't know any signatures that are related with it 171 171 00:06:32,670 --> 00:06:34,500 so we don't have an easy way to block it. 172 172 00:06:34,500 --> 00:06:35,820 And this is generally where you're going to see 173 173 00:06:35,820 --> 00:06:38,340 a lot of your behavior-based analysis being done. 174 174 00:06:38,340 --> 00:06:40,620 And then we have our unknown unknowns. 175 175 00:06:40,620 --> 00:06:42,270 Now when you do a unknowns unknowns, 176 176 00:06:42,270 --> 00:06:43,860 these are things that we don't know 177 177 00:06:43,860 --> 00:06:46,140 and we just don't have any way to know about it yet. 178 178 00:06:46,140 --> 00:06:47,760 And so we have to experiment more and more, 179 179 00:06:47,760 --> 00:06:49,020 and we have to do a lot more research, 180 180 00:06:49,020 --> 00:06:51,090 and try to figure these things out. 181 181 00:06:51,090 --> 00:06:53,160 For example, if there is a zero-day, 182 182 00:06:53,160 --> 00:06:54,450 we've never seen it before, 183 183 00:06:54,450 --> 00:06:56,250 and it's doing something that we never thought 184 184 00:06:56,250 --> 00:06:59,310 was malicious behavior, this is an unknown unknown. 185 185 00:06:59,310 --> 00:07:00,750 And eventually we might find out, 186 186 00:07:00,750 --> 00:07:03,360 oh, that thing they're doing with these 20 steps, 187 187 00:07:03,360 --> 00:07:05,400 when you put all those together, that is a bad thing. 188 188 00:07:05,400 --> 00:07:07,650 And so then it becomes a known unknown, 189 189 00:07:07,650 --> 00:07:09,090 and eventually if we can create a signature, 190 190 00:07:09,090 --> 00:07:11,010 we can make it a known known. 191 191 00:07:11,010 --> 00:07:11,850 And so that's the idea here, 192 192 00:07:11,850 --> 00:07:14,010 when we start dealing with these threat classifications. 193 193 00:07:14,010 --> 00:07:16,050 For the exam, no one is going to ask you 194 194 00:07:16,050 --> 00:07:18,630 to put a threat into one of these categories, 195 195 00:07:18,630 --> 00:07:19,860 but in the real world 196 196 00:07:19,860 --> 00:07:21,780 this is a good way to think about things 197 197 00:07:21,780 --> 00:07:23,880 as you start bucketing pieces of malware 198 198 00:07:23,880 --> 00:07:26,460 and different behavior you're seeing within your network. 199 199 00:07:26,460 --> 00:07:28,260 And all of this is based on a concept known 200 200 00:07:28,260 --> 00:07:29,760 as the Johari Window. 201 201 00:07:29,760 --> 00:07:32,520 In the Johari Window, you have four quadrants again. 202 202 00:07:32,520 --> 00:07:35,550 We have open, blind, hidden, and unknown, 203 203 00:07:35,550 --> 00:07:39,870 and our whole goal is to try to get things known more by us. 204 204 00:07:39,870 --> 00:07:41,640 And so if it's something that is known to ourself 205 205 00:07:41,640 --> 00:07:43,290 and known to others, that's open. 206 206 00:07:43,290 --> 00:07:45,960 For instance, we all know that two plus two equals four, 207 207 00:07:45,960 --> 00:07:48,990 that is an open piece of knowledge that everybody knows. 208 208 00:07:48,990 --> 00:07:51,360 Now there are some things that are known to yourself 209 209 00:07:51,360 --> 00:07:54,090 but they're not known to others, and we call these hidden. 210 210 00:07:54,090 --> 00:07:56,310 For instance, I know a lot about cybersecurity 211 211 00:07:56,310 --> 00:07:57,990 and you may not know as much as I do, 212 212 00:07:57,990 --> 00:08:00,180 but if there's things that are known to me 213 213 00:08:00,180 --> 00:08:03,570 but not known to you, well, if I tell you about them 214 214 00:08:03,570 --> 00:08:05,760 it's going to move you from this hidden area 215 215 00:08:05,760 --> 00:08:08,670 up into the open area where you start learning about it too, 216 216 00:08:08,670 --> 00:08:11,070 and now it's known to me and you. 217 217 00:08:11,070 --> 00:08:12,540 When we start dealing with other things, 218 218 00:08:12,540 --> 00:08:15,720 there might be things that you know, but I don't know, 219 219 00:08:15,720 --> 00:08:17,790 and so I am blind to those things. 220 220 00:08:17,790 --> 00:08:20,220 For me to know about those things that I'm blind to, 221 221 00:08:20,220 --> 00:08:21,570 you have to tell me. 222 222 00:08:21,570 --> 00:08:22,770 And so if you tell me about it 223 223 00:08:22,770 --> 00:08:25,530 it's going to take me from blind into open. 224 224 00:08:25,530 --> 00:08:27,120 And then if we have an unknown, 225 225 00:08:27,120 --> 00:08:29,280 that means you don't know it and I don't know it, 226 226 00:08:29,280 --> 00:08:31,560 so it's not known to others and it's not known to me. 227 227 00:08:31,560 --> 00:08:32,940 And so in that area, we have to, 228 228 00:08:32,940 --> 00:08:34,860 one of us has to eventually discover it, 229 229 00:08:34,860 --> 00:08:36,780 and once we do, we can then tell the other 230 230 00:08:36,780 --> 00:08:38,670 and we can get ourself back up to open. 231 231 00:08:38,670 --> 00:08:40,980 The goal here is we always want to try to get to open 232 232 00:08:40,980 --> 00:08:43,740 if we can, and that's the idea here with malware. 233 233 00:08:43,740 --> 00:08:45,330 If we have something that is unknown 234 234 00:08:45,330 --> 00:08:47,400 but a security researcher learns about it, 235 235 00:08:47,400 --> 00:08:49,710 they can tell others about it, and when they do, 236 236 00:08:49,710 --> 00:08:52,470 that helps bring us into either the hidden or the blind, 237 237 00:08:52,470 --> 00:08:54,930 and then from hidden or blind over to open. 238 238 00:08:54,930 --> 00:08:57,090 Once we all know about it, it becomes open, 239 239 00:08:57,090 --> 00:08:59,790 it becomes very easy to know this as a known threat 240 240 00:08:59,790 --> 00:09:01,290 and it's something that we can build a signature 241 241 00:09:01,290 --> 00:09:03,093 or automation to block that attack.