1 00:00:00,000 --> 00:00:01,770 In this lesson, we're going to discuss 2 00:00:01,770 --> 00:00:03,960 operating system vulnerabilities. 3 00:00:03,960 --> 00:00:06,030 Operating systems are pivotal in the functioning 4 00:00:06,030 --> 00:00:07,950 and protection of our digital devices 5 00:00:07,950 --> 00:00:09,690 because they bridge the gap between hardware 6 00:00:09,690 --> 00:00:10,800 and software to ensure 7 00:00:10,800 --> 00:00:13,110 that seamless interactions are going to occur. 8 00:00:13,110 --> 00:00:15,510 However, vulnerabilities within operating systems 9 00:00:15,510 --> 00:00:18,360 can pose significant security threats to our systems. 10 00:00:18,360 --> 00:00:20,880 These vulnerabilities include unpatched systems, 11 00:00:20,880 --> 00:00:23,370 zero-day vulnerabilities, misconfigurations, 12 00:00:23,370 --> 00:00:25,920 data exfiltration, and malicious updates. 13 00:00:25,920 --> 00:00:28,200 So let's explore some of the vulnerabilities, 14 00:00:28,200 --> 00:00:30,600 their implications, and the measures that we can adopt 15 00:00:30,600 --> 00:00:32,430 to better secure our systems. 16 00:00:32,430 --> 00:00:34,710 First, we have unpatched systems. 17 00:00:34,710 --> 00:00:37,050 Unpatched systems refer to those operating systems 18 00:00:37,050 --> 00:00:37,980 that have not been updated 19 00:00:37,980 --> 00:00:40,290 with the latest security patches or fixes. 20 00:00:40,290 --> 00:00:42,540 These systems are highly susceptible to attack 21 00:00:42,540 --> 00:00:43,890 because they contain vulnerabilities 22 00:00:43,890 --> 00:00:46,170 that might have been addressed in newer updates. 23 00:00:46,170 --> 00:00:48,180 Since these unpatched systems are missing patches 24 00:00:48,180 --> 00:00:50,100 that protect us from known vulnerabilities, 25 00:00:50,100 --> 00:00:51,600 these systems are going to be considered 26 00:00:51,600 --> 00:00:53,610 to be put at significant risk of an attack 27 00:00:53,610 --> 00:00:55,530 because known vulnerabilities can be matched 28 00:00:55,530 --> 00:00:56,760 with existing exploits 29 00:00:56,760 --> 00:00:59,730 to execute a given attack against those systems. 30 00:00:59,730 --> 00:01:01,860 To overcome an unpatched system vulnerability, 31 00:01:01,860 --> 00:01:03,210 the easiest thing you can do 32 00:01:03,210 --> 00:01:05,640 is to ensure your operating system is up to date. 33 00:01:05,640 --> 00:01:07,830 By regularly updating and patching your systems, 34 00:01:07,830 --> 00:01:09,300 you can very effectively protect 35 00:01:09,300 --> 00:01:10,830 your devices from an attack. 36 00:01:10,830 --> 00:01:13,140 So you should ensure that you have scheduled your systems 37 00:01:13,140 --> 00:01:14,700 to perform automatic updates, 38 00:01:14,700 --> 00:01:17,010 or that you periodically check your systems 39 00:01:17,010 --> 00:01:18,990 to ensure the latest patches have been applied 40 00:01:18,990 --> 00:01:21,210 in order to keep your system secure. 41 00:01:21,210 --> 00:01:23,940 Second, we have zero-day vulnerabilities. 42 00:01:23,940 --> 00:01:26,490 Now, zero days represent vulnerabilities in software 43 00:01:26,490 --> 00:01:28,830 or hardware that are unknown to the developer 44 00:01:28,830 --> 00:01:31,440 and in essence, they're newly discovered vulnerabilities 45 00:01:31,440 --> 00:01:33,900 that have not yet been publicly disclosed yet. 46 00:01:33,900 --> 00:01:36,210 Now, since the developer isn't aware of the issue yet, 47 00:01:36,210 --> 00:01:38,340 they have zero days to fix that issue, 48 00:01:38,340 --> 00:01:40,740 which is where the term zero-day comes from. 49 00:01:40,740 --> 00:01:43,020 Now, to protect against zero-day vulnerabilities, 50 00:01:43,020 --> 00:01:44,580 you should implement security solutions 51 00:01:44,580 --> 00:01:47,010 like a host-based intrusion prevention system, 52 00:01:47,010 --> 00:01:48,660 known as an IPS. 53 00:01:48,660 --> 00:01:51,270 This allows you to detect and block suspicious activities 54 00:01:51,270 --> 00:01:53,160 that may occur on a given system. 55 00:01:53,160 --> 00:01:54,990 Additionally, you should try to maintain a good 56 00:01:54,990 --> 00:01:57,510 security posture through practices like frequent system 57 00:01:57,510 --> 00:01:59,700 and software updates, even if they don't address 58 00:01:59,700 --> 00:02:01,860 an unknown vulnerability, like a zero-day, 59 00:02:01,860 --> 00:02:03,990 because it can still provide additional protection 60 00:02:03,990 --> 00:02:05,250 as a form of defense in depth 61 00:02:05,250 --> 00:02:08,039 against potential zero-day exploits in the future. 62 00:02:08,039 --> 00:02:10,259 Third, we have misconfigurations. 63 00:02:10,259 --> 00:02:12,480 Now, misconfigurations in an operating system 64 00:02:12,480 --> 00:02:14,040 are going to occur when the system settings 65 00:02:14,040 --> 00:02:15,510 are not properly configured, 66 00:02:15,510 --> 00:02:18,240 and this leaves your system vulnerable to exploitation. 67 00:02:18,240 --> 00:02:19,890 These configurations could be due 68 00:02:19,890 --> 00:02:22,050 to default settings that are not being changed, 69 00:02:22,050 --> 00:02:24,240 unnecessary services being left enabled, 70 00:02:24,240 --> 00:02:27,210 or security features being accidentally turned off. 71 00:02:27,210 --> 00:02:29,850 To safeguard against risk associated with misconfigurations, 72 00:02:29,850 --> 00:02:31,980 configuration management tools should be employed 73 00:02:31,980 --> 00:02:34,050 across your organizational network. 74 00:02:34,050 --> 00:02:36,180 These configuration management tools can help us 75 00:02:36,180 --> 00:02:38,940 in standardizing and automating the configuration process 76 00:02:38,940 --> 00:02:40,950 to ensure consistency and the elimination 77 00:02:40,950 --> 00:02:43,290 of human errors inside of your systems. 78 00:02:43,290 --> 00:02:44,910 You should also conduct periodic audits 79 00:02:44,910 --> 00:02:47,490 and reviews of your system configurations to identify 80 00:02:47,490 --> 00:02:49,170 and mitigate potential vulnerabilities 81 00:02:49,170 --> 00:02:51,540 that you can find inside of those systems. 82 00:02:51,540 --> 00:02:53,763 Now, fourth, we have data exfiltration. 83 00:02:53,763 --> 00:02:56,820 Data exfiltration refers to unauthorized data transfers 84 00:02:56,820 --> 00:02:59,880 from within an organization to an external location. 85 00:02:59,880 --> 00:03:01,770 Data exfiltration commonly occurs 86 00:03:01,770 --> 00:03:04,230 when an operating system's vulnerability is exploited 87 00:03:04,230 --> 00:03:05,940 and the attacker attempts to steal your data 88 00:03:05,940 --> 00:03:07,470 without your awareness. 89 00:03:07,470 --> 00:03:09,510 Now, protecting against data exfiltration 90 00:03:09,510 --> 00:03:11,220 involves multiple layers of defense 91 00:03:11,220 --> 00:03:12,540 including the use of encryption 92 00:03:12,540 --> 00:03:14,460 and endpoint protection tools. 93 00:03:14,460 --> 00:03:16,560 Encryption of your data at rest will help to ensure 94 00:03:16,560 --> 00:03:18,990 that even if the data is accessed by an attacker, 95 00:03:18,990 --> 00:03:22,290 that data will remain unreadable and unusable to them. 96 00:03:22,290 --> 00:03:24,840 Also, you can implement endpoint protection tools 97 00:03:24,840 --> 00:03:26,280 on your systems to help monitor 98 00:03:26,280 --> 00:03:29,400 and restrict unauthorized data transfers on those devices. 99 00:03:29,400 --> 00:03:32,130 If you also implement a host-based firewall, for example, 100 00:03:32,130 --> 00:03:33,870 you can then use this to control the inbound 101 00:03:33,870 --> 00:03:36,030 and outbound traffic on a given system 102 00:03:36,030 --> 00:03:37,860 to ensure that your data isn't leaving your system 103 00:03:37,860 --> 00:03:39,870 without proper authorization. 104 00:03:39,870 --> 00:03:42,000 Fifth, we have malicious updates. 105 00:03:42,000 --> 00:03:43,740 Now, normally, we're going to see an update 106 00:03:43,740 --> 00:03:45,810 or a patch as a good thing for our security. 107 00:03:45,810 --> 00:03:48,030 But there are some cases where an attacker's been able 108 00:03:48,030 --> 00:03:49,640 to craft a malicious update to a well-known 109 00:03:49,640 --> 00:03:52,560 and trusted program in order to compromise the systems 110 00:03:52,560 --> 00:03:54,390 of the programs and users. 111 00:03:54,390 --> 00:03:56,850 With a malicious update, the update will masquerade 112 00:03:56,850 --> 00:03:58,830 as a legitimate security update or patch, 113 00:03:58,830 --> 00:04:00,570 but it actually contains some malicious code 114 00:04:00,570 --> 00:04:03,090 inside of it that effectively will inject malware 115 00:04:03,090 --> 00:04:06,480 or an exploit into your system when the update is installed. 116 00:04:06,480 --> 00:04:08,370 Now, to guard against the malicious update, 117 00:04:08,370 --> 00:04:10,590 it's crucial that you only source your updates 118 00:04:10,590 --> 00:04:13,050 from trusted vendors and official channels. 119 00:04:13,050 --> 00:04:15,570 Application allow listing will also be maintained 120 00:04:15,570 --> 00:04:18,089 to ensure that only recognized and safe applications 121 00:04:18,089 --> 00:04:20,640 are permitted to be run on your given system. 122 00:04:20,640 --> 00:04:23,520 Additionally, always verify the authenticity of updates 123 00:04:23,520 --> 00:04:25,320 through a digital signature or a hash 124 00:04:25,320 --> 00:04:27,900 before you install the update on your system. 125 00:04:27,900 --> 00:04:29,700 So remember, while the vulnerabilities 126 00:04:29,700 --> 00:04:32,130 in operating systems can be varied and sophisticated 127 00:04:32,130 --> 00:04:34,950 including unpatched systems, zero-day vulnerabilities, 128 00:04:34,950 --> 00:04:37,170 misconfigurations, data exfiltration, 129 00:04:37,170 --> 00:04:39,510 and malicious updates, your protective measures 130 00:04:39,510 --> 00:04:40,890 don't always have to be complex 131 00:04:40,890 --> 00:04:42,660 in order for them to be effective. 132 00:04:42,660 --> 00:04:44,550 From patching regularly to encryption 133 00:04:44,550 --> 00:04:46,770 to configuration management, we have the ability 134 00:04:46,770 --> 00:04:48,330 to significantly enhance the security 135 00:04:48,330 --> 00:04:49,920 of our devices and our data 136 00:04:49,920 --> 00:04:52,270 by using some common defense in depth measures.