In this lesson, we'll be learning about
analyzing vulnerabilities.
Analyzing vulnerabilities is a critical step
that we must perform
to help strengthen our cybersecurity defenses.
As we move through this lesson,
we're going to explore the various concepts
related to analyzing vulnerabilities,
including confirming the vulnerabilities exist,
prioritizing the vulnerabilities,
classifying the vulnerabilities,
the organizational impact of those vulnerabilities,
the exposure factor of the vulnerabilities,
and how all of this compares to the risk tolerance
in your organization.
Now, first, let's start out with vulnerability confirmation.
When you run a vulnerability scan of your network,
numerous vulnerabilities are going to be detected.
Now, some of these vulnerabilities are going to be real,
and some of these are really not an issue for us.
So a part of our vulnerability management process
is that we have to analyze each alert or finding
to determine if it's a true positive,
false positive,
true negative,
or false negative.
Now, a true positive occurs
when there is a real and exploitable vulnerability
that has been correctly identified
by your vulnerability scanner.
Basically, our systems say that we're vulnerable
and we analyze the finding,
and we agree the vulnerability
does exist inside of our system.
For example, if we perform a vulnerability scan on a system
and it detects or missing a critical security patch
like Microsoft 17-010,
and we look at that system
and we agree that patch was never installed,
this is known as a true positive.
Because that system is indeed vulnerable to attacks
against this known vulnerability
because the patch to mitigate that has not been installed.
Now, a false positive is going to occur
when the system incorrectly states
that a vulnerability exists on the system,
but that vulnerability actually doesn't exist.
For example, I've had cases
where I've scanned a Linux system
and the vulnerability scanning report comes back
stating that the system is missing
a critical Windows security patch
and is therefore vulnerable.
But because I'm using a Linux machine or server,
it's actually not vulnerable to any Windows-based exploit.
So this would be considered a false positive
because Windows patches are not going to be required
on a Linux-based system.
Now, a true negative, on the other hand,
is going to occur when the system correctly identifies
that there is no vulnerability present on the system.
For example, if I scan my laptop
and it states I have correctly installed
all the security patches and updates from my system,
it is reporting a true negative
because it's stating that my system is secure
from known vulnerabilities
inside of the scanning engine's database,
and that is actually the true state
because I am not vulnerable.
Now, a false negative
is actually one of the most serious findings you can have.
With a false negative,
the vulnerability scanner
does not detect a known vulnerability on the system,
even though that vulnerability
does actually exist on the system.
Now, the reason I consider this to be the most dangerous
is because you think you are well-protected and secure
because your scans are not detecting a known vulnerability,
but those vulnerabilities are still there on your system.
This often occurs
because you forgot to update the scanner's rules
or definitions.
So the scanner is unaware of a newer exploit
that's available
that is now attacking a known vulnerability.
Second, we need to prioritize our vulnerabilities.
Now, when we're prioritizing our vulnerabilities,
we need to rank our identified vulnerabilities
in the order of their severity
and potential impact on the organization
to ensure that we can allocate resources
that address the most critical security threats first.
Several factors are going to come into play
during this process,
including the ease of exploitation,
the magnitude of potential damage,
and the importance of the affected system
to the organization's operations.
For example,
if a vulnerability is found
in a mission-critical application
that could lead to significant data breaches,
if it was exploited,
this is probably going to be prioritized a lot higher
than a minor flaw in a less significant system.
Now, to assist in this process,
security professionals often employ a scoring system
like the Common Vulnerability Scoring System, or CVSS.
Now, the Common Vulnerability Scoring System
is going to provide us with a standardized framework
for assessing the severity of a vulnerability,
and then assign a score based on metrics
such as the attack vector being used,
the impact, and the exploitability of that vulnerability.
By utilizing a CVSS score
and considering our organizational context,
our security teams
can systematically prioritize our vulnerabilities
to ensure that our efforts are being focused
where they're needed most,
and that the risk is being effectively managed.
Third, we need to classify our vulnerabilities.
Now, classification involves
categorizing the identified vulnerabilities
based on factors like the type of threat,
the potential impact on the organization,
and the systems or data that may be affected.
By doing so,
organizations can better understand
the nature of the vulnerabilities
and align the remediation efforts accordingly.
For example,
vulnerabilities might be classified into categories
like software flaws,
configuration errors,
or security policy gaps.
Within each of these categories,
we can further sub-classify these things
like buffer overflows,
privilege escalation,
or insecure default settings.
Another way for us to gain information
about our vulnerabilities
that we can use to aid in the classification
of our vulnerabilities
is something known as a CVE,
or a Common Vulnerabilities and Exposures.
Now, the Common Vulnerabilities and Exposures system
is going to contain a large database
of every known vulnerability in the world.
Each vulnerability will be assigned a specific CVE number,
and this can be used to look up the relevant information
about that vulnerability at the website
cve.mitre.org.
Now, this CVE database serves as a valuable reference
for cybersecurity professionals
to provide us with a detailed description,
potential impact,
and references to solutions or workarounds
for each vulnerability that's been identified.
By cross-referencing your detective vulnerabilities
with the CVE database,
organizations can gain deeper insights
into the nature and characteristics of the threats
that they're facing.
They can make more informed decisions
during the vulnerability management process.
Also, by using the CVEs
to help classify your vulnerabilities,
you're going to be able to systematically
evaluate your security posture
in order to make informed decisions
about prioritizing and addressing your vulnerabilities.
By having a clear classification system,
security teams can streamline their workflows
and ensure they're dealing with these vulnerabilities
in a strategic and organized manner.
Fourth, we have the organizational impact
of the vulnerabilities.
Now, it's important to understand
the potential impact on your organization
in order to properly prioritize your remediation efforts.
The vulnerabilities impact can be assessed
in terms of its confidentiality,
integrity, or availability
of your different data and services
that are going to be affected.
A vulnerability that could lead to the exposure
of sensitive customer data, for example,
would have a significant impact
on your organization's reputation
and could even result in regulatory fines
being imposed upon your company.
Similarly, a vulnerability
that affects the availability of a critical service
would've serious consequences
for your business continuity plans.
So you may give that a higher prioritization level
based on this increased impact to your overall business.
The vulnerabilities impact on your organization
can also be assessed based on the industry
that the organization is operating within.
For example,
vulnerabilities in a healthcare organization
could risk patient data and safety
while vulnerabilities at a financial institution
could lead to monetary losses
and increase scrutiny by regulators.
And in both of these cases,
you would prioritize those vulnerabilities higher up
than you might for something at a small local store.
Now, by considering the specifics
around your organization and your industry,
your cybersecurity team can better understand
how a vulnerability might affect your day-to-day operations,
your legal compliance,
and overall level of customer trust.
Fifth, we have exposure factor
of the vulnerability to consider.
Now, the exposure factor or EF
is used as a quantifiable metric
to help a cybersecurity professional
understand the exact percentage of an asset
that is likely to be damaged or affected
if a particular vulnerability is going to be exploited.
At its core,
the exposure factor is an estimation of the amount of loss
that a vulnerability might cause to your organization.
For example,
if a critical database contains sensitive customer data
and it was compromised,
the exposure factor would be considered pretty high,
as a large portion or potentially the entire database
and that asset could be put at risk.
On the other hand,
if the vulnerability only exposes non-critical information,
the exposure factor there
would actually be assigned much lower
because it's affecting a much less significant portion
of our business or that asset.
Now, organizations need to understand the exposure factor
because it's used heavily
when you're conducting a qualitative risk management
inside your organization.
By evaluating the exposure factor
along with other variables
like the threat likelihood and the asset value,
your organization will truly be able to understand
the potential impact
of a successful exploit in mathematical terms,
so they can properly allocate time, money,
and other resources to mitigating the vulnerabilities,
which pose the greatest risk
to your operations and your objectives.
And sixth, we need to understand
our organization's risk tolerance
as we analyze vulnerabilities.
Risk tolerance refers to the level of risk
that an organization is willing to accept
in the pursuit of its objectives
before action is deemed necessary to mitigate that risk.
By understanding our organization's risk tolerance,
we can ensure that we align our organization's approach
to vulnerability management
with its broader risk management strategy.
After all,
some organizations might be more risk-averse
and will prioritize more stringent security measures
that require dedicating a lot more resources
to address even the most minor vulnerabilities.
While other organizations may have a higher risk tolerance,
so they're going to be more willing
to accept a certain level of exposure
while they're focusing
on more pressing aspects of their business.
Basically, if your organization has a low risk tolerance,
even vulnerabilities with a minor or moderate impact
will need to be remediated more quickly.
Conversely, if you work for an organization
with a higher risk tolerance,
your organization might decide
to simply monitor certain vulnerabilities
while they're focusing their remediation efforts and money
to secure more severe vulnerabilities
or those with a higher likelihood
of being exploited by a threat actor.
In either case,
aligning your vulnerability management practices
with the organization's risk tolerance
is going to ensure that your security efforts
are going to remain consistent
with your overall business strategies and objectives.
So remember,
analyzing vulnerabilities is a critical step
that we have to perform
to strengthen our cybersecurity defenses.
Confirming vulnerabilities
involves determining the accuracy
of an identified potential security weakness
by verifying whether it's a true positive,
false positive,
true negative, or false negative.
Prioritizing vulnerabilities
entails assessing and ranking security vulnerabilities
based on several factors,
including their severity, potential impact,
and likelihood of exploitation,
so your organization can properly allocate resources
to remediate your vulnerabilities more effectively.
Classifying vulnerabilities
means that we're going to categorize
identified security weaknesses into different groups
based on their characteristics,
like the type of threat,
the affected system,
and the potential impact
to streamline our management and response efforts.
The exposure factor is going to refer to the percentage of loss
that an organization will experience
if a specific vulnerability
was exploited on a given resource.
And your organization's risk tolerance
is going to refer to the level of risk
that an organization is willing to accept or mitigate
in pursuit of its objectives and operations.
By systematically analyzing, confirming,
classifying, and prioritizing vulnerabilities,
understanding the exposure factor,
and aligning these processes
with the organization's risk tolerance,
we're going to be better able to equip ourself
to build a more secure, resilient,
and responsive cybersecurity infrastructure.