-: Threats and vulnerabilities. 2 2
In this lesson, we're going to talk 3 3
about threats and vulnerabilities. 4 4
After all, where threats and vulnerabilities intersect 5 5
is where risk exists within our enterprise networks. 6 6
So if we can understand the different threats 7 7
and vulnerabilities we may have in our networks, 8 8
we can then add protection mechanisms 9 9
to help mitigate that risk. 10 10
Often, I hear people use the words threats 11 11
and vulnerability interchangeably, 12 12
but they're technically not the same thing. 13 13
A threat is a person or an event that has the potential 14 14
for impacting a valuable resource in a negative manner. 15 15
So a hacker will be a threat 16 16
since they want to steal your data, but so is a hurricane, 17 17
because it could cause a power outage 18 18
that takes down your valuable network. 19 19
Now, a vulnerability on the other, 20 20
is a quality or characteristic within a given resource 21 21
or it's environment that might allow the threat 22 22
to be realized. 23 23
Now essentially, a vulnerability is any weakness 24 24
in the system design, implementation, 25 25
source code or lack of preventive mechanisms 26 26
that would prevent a threat from occurring. 27 27
So for example, if you're not running the latest version 28 28
of Microsoft Windows on your servers, 29 29
that is considered a vulnerability. 30 30
If you have a battery back up for your network 31 31
that only lasts 15 min 32 32
and you don't have any back up generators, 33 33
that again, is a vulnerability, 34 34
because if you loose power, 35 35
after 15 minutes, the entire network is going to crash on you. 36 36
Now, it's only going to be when combine a threat 37 37
with a vulnerability that we actually get risk 38 38
that's being realized and now something bad will occur. 39 39
This is an important distinction, 40 40
because if I have device, like a switch or a router 41 41
and it has a vulnerability, but there's no threats 42 42
that would ever go after that vulnerability, 43 43
then guess what? 44 44
There's not really a risk there. 45 45
On the other hand, if I have an asset 46 46
that doesn't have any vulnerabilities, 47 47
then it doesn't matter if I have dedicated threat 48 48
trying to attack me, because they won't ever be able 49 49
to cause any harm to my network, 50 50
because there's absolutely not vulnerabilities 51 51
for them to exploit. 52 52
Now, in the real world, 53 53
there's almost always some kind of threat 54 54
and some kind of vulnerability out there 55 55
that we're going to be facing, 56 56
so we almost always have risk. 57 57
The amount of risk though, 58 58
is really going to be determined by how big of a threat 59 59
or how major of a vulnerability we actually have. 60 60
So let's dive into threats and vulnerabilities 61 61
a bit deeper here. 62 62
First, let's cover threats. 63 63
Threats come in two basic varieties. 64 64
We have internal threats and external threats. 65 65
Now, an internal threat is any threat 66 66
that originates from within the organization itself. 67 67
Normally, these are conducted by a current 68 68
or former employee, a contractor 69 69
or a business partner who's going to cause damage 70 70
to your systems or steal your data. 71 71
When we're dealing with internal threats, 72 72
these can be caused by people 73 73
who intend to do us harm or those who do it accidentally. 74 74
For example, if you have insider threat, 75 75
this could be a person who uses their authorized access 76 76
to get onto your network and harm your organization. 77 77
Maybe you had an employee who just got passed over 78 78
for a promotion and now they're pretty upset. 79 79
So they decide to download 80 80
your entire client contact database 81 81
to their thumb drive and take it home with them, 82 82
that way, if they decide to quit next week, 83 83
they can start calling up all of your clients 84 84
and bring them over to a new company 85 85
that will end up hiring them. 86 86
On the other hand, you may also have an end user 87 87
who unknowingly causes damage to your systems, 88 88
for example, we may have a sales person 89 89
who opens up an email that contains malware 90 90
and this starts infecting your systems and your servers. 91 91
Now, that person, they weren't being malicious, 92 92
they didn't do this on purpose. 93 93
They just opened an email and they didn't think 94 94
that it would cause any problems. 95 95
This is an unwitting or unknowing internal threat. 96 96
Now, in addition to internal threats, 97 97
we also have external threats. 98 98
External threats could be people, like a hacker, 99 99
or it can be an event or environmental condition, 100 100
for example, if I was going to have a wildfire near my office, 101 101
that would be an environmental threat against my facility 102 102
and the network that it contains, 103 103
or maybe I'm working as the IT director 104 104
for a large oil company 105 105
and I have a lot of angry hacktivists 106 106
who want to take down my network, 107 107
because they don't agree with our company's policies 108 108
concerning drilling within the Alaskan wilderness. 109 109
This would also be considered an external threat, 110 110
because it's something external to my organization, 111 111
these hacktivists or hacker who are trying to break in. 112 112
Now next, we need to talk a little more 113 113
about the types of vulnerabilities 114 114
that we can have in our organizations and its networks. 115 115
Remember, a vulnerability is any weakness 116 116
in the system design, implementation, 117 117
software code or a lack of preventive measure 118 118
in your systems. 119 119
Now, these can take the form of environmental, 120 120
physical, operational or technical vulnerabilities. 121 121
When we talk about environmental vulnerabilities, 122 122
these are focused on undesirable conditions or weaknesses 123 123
that are in the general area surrounding your building 124 124
where you're going to operate your networks. 125 125
So for example, my company is based out of Puerto Rico, 126 126
so we have he ever-present threat of hurricanes 127 127
and earthquakes that could exploit a vulnerability 128 128
and how we provide services to our office, 129 129
including our power, water, heating and air-conditioning. 130 130
So to mitigate this, we actually have four sources of power 131 131
at our facility, including solar power, 132 132
a full building battery back-up, 133 133
a diesel generator and of course, 134 134
our local power grid from the electric company. 135 135
Physical vulnerabilities are focused 136 136
on undesirable conditions or weaknesses 137 137
in the buildings where you operate your networks. 138 138
Now, some examples of physical vulnerabilities, 139 139
might be things like unlocked doors, 140 140
unmonitored hallways, misconfigured sprinkler systems 141 141
or cables that are running across the floor. 142 142
These things could lead to a threat actor 143 143
being able to get into your building 144 144
and stealing all your data or a fire could break out 145 145
and cause massive amounts of damage, 146 146
or maybe somebody will trip over a misplaced cable 147 147
and that will cause damage to themselves or to your network. 148 148
Operational vulnerabilities are focused on how the network 149 149
and its systems are being run 150 150
from a policy and procedure perspective. 151 151
These vulnerabilities or weaknesses usually result 152 152
from either poorly worded or unenforceable policies 153 153
within your organization. 154 154
This can allow a threat actor to exploit weaknesses 155 155
in these policies to their own advantage. 156 156
Now, technical vulnerabilities 157 157
are system-specific conditions 158 158
that create a weakness in our security. 159 159
This includes misconfigurations, 160 160
outdated hardware, malicious software 161 161
and other technical weaknesses 162 162
in the implementation or operation of our networks 163 163
and its devices. 164 164
When it comes to technical vulnerabilities 165 165
that focus on network or system exploitation, 166 166
we normally are going to classify these as a CVE 167 167
or a zero-day vulnerability. 168 168
Now, CVE or the common vulnerabilities and exposures 169 169
are going to be a list of publicly disclosed 170 170
computer security weaknesses or flaws. 171 171
Basically, it's an official list 172 172
of all the known technical vulnerabilities 173 173
for each and every piece of software 174 174
that's publicly available. 175 175
When you look up a CVE, for example, 176 176
you might see something like CVE-2017-0144 177 177
and then you can look at that 178 178
and read all about that vulnerability, 179 179
what it is, what software it affects 180 180
and a list of references, so you can learn more about it. 181 181
Now, in the case of CVE-2017-0144, 182 182
this was the 144th vulnerability 183 183
that was disclosed in the year 2017. 184 184
This particular CVE was actually a really serious one 185 185
and it was one that was exploited by the WannaCry ransomware 186 186
that spread rapidly across the globe. 187 187
Due to its widespread exploitation, 188 188
it also received a codename 189 189
and became knows as EternalBlue. 190 190
Now, EternalBlue affected Windows Vista, 191 191
Windows 7, Windows 8, Windows 10 192 192
on desktop and laptop computers 193 193
and then also, Windows server 2008, 194 194
2012 and 2016 on servers. 195 195
This vulnerability allowed an attacker 196 196
to be able to remotely execute arbitrate code 197 197
via well-crafted packets over the network 198 198
that could lead to a remote code execution vulnerability. 199 199
Now, for the network plus exam, 200 200
you don't need to know specifics of the EternalBlue exploit, 201 201
but you should be aware of what a CVE is 202 202
and the kind of information it can give you 203 203
as a network administrator. 204 204
So while CVEs provide us with a list 205 205
of all the known vulnerabilities, 206 206
there's also a lot of unknown vulnerabilities 207 207
that may be out there too. 208 208
These are known as zero-day vulnerabilities. 209 209
Now, a zero-day vulnerability is any weakness 210 210
in the system design, implementation, 211 211
software code or a lack of preventive mechanisms 212 212
within a given system or network 213 213
that is unknown at the time of publication. 214 214
Now, basically a zero-day vulnerability 215 215
is a new vulnerability that not everyone is aware of. 216 216
Once cybersecurity professionals become aware 217 217
of this vulnerability, they're going to report it 218 218
and a CVE will be created for that zero-day, 219 219
making it no longer a zero-day 220 220
and now it's going to be called a CVE. 221 221
So remember, CVEs are a list of known vulnerabilities, 222 222
while a zero-day is a brand new vulnerability 223 223
that no one else has discovered or reported yet. 224 224
Finally, let's talk about how a vulnerability is attacked. 225 225
After all, a vulnerability is just a weakness, 226 226
but until it's attacked or exploited, 227 227
as we like to call it in the cybersecurity world, 228 228
it's just sitting there 229 229
and it's really not hurting anyone. 230 230
When you take advantage of a vulnerability 231 231
as a threat actor, this is called, 232 232
exploiting the vulnerability. 233 233
We do this using an exploit. 234 234
Now, an exploit is a piece of software code 235 235
that takes advantage of a security flaw 236 236
or vulnerability within a system or network. 237 237
Because CVEs are known vulnerabilities, 238 238
most of them have a matching exploit. 239 239
This is because when a new vulnerability 240 240
is discovered and reported, 241 241
a patch is created by the software's creators. 242 242
For example, if a new zero-day vulnerability was discovered 243 243
in Windows 10, then Microsoft will create a software patch 244 244
to fix this vulnerability and they will release 245 245
that software patch and a CVE to the public 246 246
so we can all know about it. 247 247
Now at the same time, attackers are going to reverse engineer 248 248
that software patch and research the CVE 249 249
to determine what vulnerability 250 250
that patch is trying to solve. 251 251
Then they can create some code 252 252
that will take advantage of that vulnerability 253 253
if a system isn't properly patched and updated. 254 254
Since many people don't patch their systems right away 255 255
using the latest security patches, 256 256
this means, there's a period of time 257 257
where a lot of Windows systems may still be vulnerable 258 258
and so, we can actually use this exploit 259 259
to attack those vulnerable systems 260 260
for weeks or months after the release of a patch. 261 261
So now the attackers have a working exploit 262 262
for this vulnerability and they can find 263 263
any unpatched Windows 10 machines out there 264 264
and exploit them by running their new software code 265 265
against those unpatched systems. 266 266
This exploit code is often incorporated 267 267
into malware and this allows it to propagate 268 268
and run intricate scripts against vulnerable computers, 269 269
therefore, increasing the damage 270 270
that these attackers can do with this exploit. 271 271
To prevent this, you need to ensure 272 272
your systems remain up to date 273 273
and patched with the latest security releases 274 274
and ensure that your systems 275 275
have an up-to-date anti-malware 276 276
or anti-virus software installed to protect them 277 277
from these known vulnerabilities.