1 00:00:00,000 --> 00:00:00,990 In this lesson, 2 00:00:00,990 --> 00:00:04,080 we're going to discuss Validating Vulnerability Remediation. 3 00:00:04,080 --> 00:00:05,760 Now, when we identify a vulnerability 4 00:00:05,760 --> 00:00:08,430 during a vulnerability scan or a penetration test, 5 00:00:08,430 --> 00:00:11,070 it's important that the vulnerability gets remediated. 6 00:00:11,070 --> 00:00:13,590 If the vulnerability is caused by missing a software update 7 00:00:13,590 --> 00:00:14,820 or a security patch, 8 00:00:14,820 --> 00:00:16,320 then the remediation is simple, 9 00:00:16,320 --> 00:00:18,630 we need to just install that related hotfix 10 00:00:18,630 --> 00:00:20,730 or security patch onto the system. 11 00:00:20,730 --> 00:00:21,690 Now, if the vulnerability 12 00:00:21,690 --> 00:00:23,700 is associated with a misconfiguration of the device, 13 00:00:23,700 --> 00:00:24,960 then that remediation would be 14 00:00:24,960 --> 00:00:26,850 to properly configure that device. 15 00:00:26,850 --> 00:00:28,500 Either way, our system administrators 16 00:00:28,500 --> 00:00:30,150 have been notified of the vulnerability 17 00:00:30,150 --> 00:00:32,040 and given instructions on how to remediate it, 18 00:00:32,040 --> 00:00:33,300 such as installing that patch 19 00:00:33,300 --> 00:00:34,800 or reconfiguring a device, 20 00:00:34,800 --> 00:00:36,720 but now we as cybersecurity analysts 21 00:00:36,720 --> 00:00:38,310 need to validate that vulnerability 22 00:00:38,310 --> 00:00:40,200 has actually been remediated. 23 00:00:40,200 --> 00:00:42,420 This is done by conducting rescans, audits, 24 00:00:42,420 --> 00:00:44,010 and verification of your systems 25 00:00:44,010 --> 00:00:46,500 to validate that the vulnerability has been remediated 26 00:00:46,500 --> 00:00:49,410 and is no longer going to be exploited by an attacker. 27 00:00:49,410 --> 00:00:52,860 Now, first, we have the process of rescanning our devices. 28 00:00:52,860 --> 00:00:54,390 After the initial vulnerability scan 29 00:00:54,390 --> 00:00:56,730 and subsequent remediation efforts have been completed, 30 00:00:56,730 --> 00:00:58,230 it's important that you take the time 31 00:00:58,230 --> 00:01:00,870 to conduct a rescan of your targeted system. 32 00:01:00,870 --> 00:01:02,580 This rescan will serve as a form 33 00:01:02,580 --> 00:01:03,930 of double-checking your work, 34 00:01:03,930 --> 00:01:05,880 and it ensures the system is no longer vulnerable 35 00:01:05,880 --> 00:01:08,010 to that specific vulnerability. 36 00:01:08,010 --> 00:01:09,630 When you're conducting rescanning, 37 00:01:09,630 --> 00:01:11,010 this is going to help you to identify 38 00:01:11,010 --> 00:01:12,510 if any vulnerabilities remain 39 00:01:12,510 --> 00:01:14,400 that are unaddressed in the system. 40 00:01:14,400 --> 00:01:16,410 Another benefit of conducting rescans 41 00:01:16,410 --> 00:01:18,450 is that we can determine if any new vulnerabilities 42 00:01:18,450 --> 00:01:20,490 have emerged since our initial scan. 43 00:01:20,490 --> 00:01:21,660 And this new vulnerability 44 00:01:21,660 --> 00:01:22,980 may also need to be mitigated 45 00:01:22,980 --> 00:01:24,630 by installing a new security patch 46 00:01:24,630 --> 00:01:26,370 or reconfiguring your system. 47 00:01:26,370 --> 00:01:28,230 But probably one of the most important reasons 48 00:01:28,230 --> 00:01:29,460 for rescanning your system 49 00:01:29,460 --> 00:01:31,260 after you've applied a new security patch 50 00:01:31,260 --> 00:01:32,490 is to validate that the patch 51 00:01:32,490 --> 00:01:34,020 actually did solve the vulnerability 52 00:01:34,020 --> 00:01:36,750 that you initially identified during your scans. 53 00:01:36,750 --> 00:01:38,820 Now, over my career, I have had several cases 54 00:01:38,820 --> 00:01:40,950 where a Microsoft patch has been released 55 00:01:40,950 --> 00:01:42,720 and that hotfix or security patch 56 00:01:42,720 --> 00:01:44,550 was actually released for one vulnerability, 57 00:01:44,550 --> 00:01:47,100 but when we installed it inside of our testing environment, 58 00:01:47,100 --> 00:01:48,660 we found out that it actually 59 00:01:48,660 --> 00:01:50,550 did not fix that vulnerability. 60 00:01:50,550 --> 00:01:52,740 Other times, we found that when we installed a patch, 61 00:01:52,740 --> 00:01:54,750 it fixed the identified vulnerability, 62 00:01:54,750 --> 00:01:57,060 but then it introduced two or three new vulnerabilities 63 00:01:57,060 --> 00:01:58,680 into our system as well. 64 00:01:58,680 --> 00:02:00,330 So rescanning can also ensure 65 00:02:00,330 --> 00:02:02,070 that the patch was properly installed 66 00:02:02,070 --> 00:02:03,660 and that it's effectively mitigating 67 00:02:03,660 --> 00:02:04,860 the original vulnerability, 68 00:02:04,860 --> 00:02:05,970 as well as not introducing 69 00:02:05,970 --> 00:02:08,370 any new vulnerabilities into your systems. 70 00:02:08,370 --> 00:02:09,750 Now, when it comes to rescanning, 71 00:02:09,750 --> 00:02:11,670 I recommend that you schedule your rescans 72 00:02:11,670 --> 00:02:13,410 to be conducted automatically. 73 00:02:13,410 --> 00:02:15,810 Also, I recommend that you use a comprehensive scan 74 00:02:15,810 --> 00:02:17,190 when you're conducting your rescan 75 00:02:17,190 --> 00:02:18,180 to make sure you're validating 76 00:02:18,180 --> 00:02:19,740 not just the one vulnerability, 77 00:02:19,740 --> 00:02:21,750 but all vulnerabilities on your system 78 00:02:21,750 --> 00:02:24,150 so you know what the exact security posture is. 79 00:02:24,150 --> 00:02:26,220 And finally, you need to make sure you rescan 80 00:02:26,220 --> 00:02:28,470 under the same conditions as your initial scan, 81 00:02:28,470 --> 00:02:30,780 because that way, you're comparing apples to apples 82 00:02:30,780 --> 00:02:32,550 or oranges to oranges. 83 00:02:32,550 --> 00:02:35,490 Second, we have to conduct an audit of your devices. 84 00:02:35,490 --> 00:02:37,110 Now auditing refers to the process 85 00:02:37,110 --> 00:02:38,760 of systematically reviewing logs, 86 00:02:38,760 --> 00:02:40,350 configurations, and patches 87 00:02:40,350 --> 00:02:41,340 to ensure that they're aligned 88 00:02:41,340 --> 00:02:43,260 with the established security standards and policies 89 00:02:43,260 --> 00:02:45,060 that you have in your organization. 90 00:02:45,060 --> 00:02:47,700 These audits can be conducted to validate your configuration 91 00:02:47,700 --> 00:02:48,960 or your patch status, 92 00:02:48,960 --> 00:02:50,030 and configuration auditing 93 00:02:50,030 --> 00:02:52,050 is going to involve checking the system's setup 94 00:02:52,050 --> 00:02:53,700 to ensure that there are no misconfigurations 95 00:02:53,700 --> 00:02:56,250 or deviations from the security baseline. 96 00:02:56,250 --> 00:02:58,590 Additionally, we can conduct patch auditing, 97 00:02:58,590 --> 00:02:59,970 which ensures that all of our patches 98 00:02:59,970 --> 00:03:01,170 were properly applied 99 00:03:01,170 --> 00:03:02,520 and that they were implemented to solve 100 00:03:02,520 --> 00:03:04,560 all of our known vulnerabilities. 101 00:03:04,560 --> 00:03:05,820 When it comes to auditing, 102 00:03:05,820 --> 00:03:08,220 it's going to be important to maintain the proper documentation 103 00:03:08,220 --> 00:03:10,950 and detailed records of the identified vulnerabilities, 104 00:03:10,950 --> 00:03:13,110 the applied patches, and the system changes 105 00:03:13,110 --> 00:03:14,460 to prove that you've actually mitigated 106 00:03:14,460 --> 00:03:17,160 these vulnerabilities and their associated threats. 107 00:03:17,160 --> 00:03:19,170 You can also leverage automated auditing tools 108 00:03:19,170 --> 00:03:20,850 to conduct the auditing process, 109 00:03:20,850 --> 00:03:22,740 such as a configuration management solution, 110 00:03:22,740 --> 00:03:25,740 which can drastically speed up the auditing process for you. 111 00:03:25,740 --> 00:03:28,050 Your audits should also include compliance checks 112 00:03:28,050 --> 00:03:30,240 that are being used to ensure your system is in compliance 113 00:03:30,240 --> 00:03:33,030 with any applicable industry regulations or standards, 114 00:03:33,030 --> 00:03:37,380 including things like GDPR, HIPPA, GLBA, or SOX. 115 00:03:37,380 --> 00:03:40,440 Third, we have to conduct a verification of our devices. 116 00:03:40,440 --> 00:03:42,060 Verification is the final checkpoint 117 00:03:42,060 --> 00:03:44,970 in validating our vulnerability remediation process. 118 00:03:44,970 --> 00:03:47,280 Verification is going to involve testing the system 119 00:03:47,280 --> 00:03:49,500 to confirm that the patches and configuration changes 120 00:03:49,500 --> 00:03:51,090 have the desired effect. 121 00:03:51,090 --> 00:03:52,620 These verifications can be performed 122 00:03:52,620 --> 00:03:54,300 by conducting a penetration test, 123 00:03:54,300 --> 00:03:55,860 conducting user verification, 124 00:03:55,860 --> 00:03:57,570 or using feedback loops. 125 00:03:57,570 --> 00:03:59,130 A targeted penetration test 126 00:03:59,130 --> 00:04:01,230 can be used during the verification process 127 00:04:01,230 --> 00:04:02,700 to simulate an attack vector 128 00:04:02,700 --> 00:04:04,050 to verify that the vulnerabilities 129 00:04:04,050 --> 00:04:06,120 have been properly addressed and remediated 130 00:04:06,120 --> 00:04:07,890 and that they're no longer able to be exploited 131 00:04:07,890 --> 00:04:10,050 using that specific attack vector. 132 00:04:10,050 --> 00:04:11,970 Additionally, because your system administrators 133 00:04:11,970 --> 00:04:14,580 might install a security patch to solve one vulnerability, 134 00:04:14,580 --> 00:04:15,780 they can inadvertently disrupt 135 00:04:15,780 --> 00:04:17,550 normal operating functions too. 136 00:04:17,550 --> 00:04:19,860 And so it's important to conduct user verification 137 00:04:19,860 --> 00:04:21,750 to ensure that all of your applications and services 138 00:04:21,750 --> 00:04:23,250 are still functioning correctly 139 00:04:23,250 --> 00:04:25,650 after the remediations have been completed. 140 00:04:25,650 --> 00:04:27,690 Also, you can establish feedback loops 141 00:04:27,690 --> 00:04:29,850 and other mechanisms with your users and staff 142 00:04:29,850 --> 00:04:31,740 to quickly identify and address any issues 143 00:04:31,740 --> 00:04:33,990 post-remediation that may have occurred. 144 00:04:33,990 --> 00:04:35,760 Now, when it comes to verification, 145 00:04:35,760 --> 00:04:38,340 you should perform holistic testing, continuous monitoring, 146 00:04:38,340 --> 00:04:40,560 and sometimes, you may even want to engage 147 00:04:40,560 --> 00:04:41,730 an external auditor 148 00:04:41,730 --> 00:04:44,070 to help complete your verification process. 149 00:04:44,070 --> 00:04:45,600 When it comes to verification, 150 00:04:45,600 --> 00:04:46,740 you should not only verify 151 00:04:46,740 --> 00:04:48,180 that the vulnerabilities have been resolved 152 00:04:48,180 --> 00:04:49,800 by your remediation actions, 153 00:04:49,800 --> 00:04:51,030 but you also need to take the time 154 00:04:51,030 --> 00:04:52,770 to evaluate the entire system 155 00:04:52,770 --> 00:04:54,000 to ensure it has remained stable 156 00:04:54,000 --> 00:04:56,310 and functional for all of your end users. 157 00:04:56,310 --> 00:04:58,050 The best vulnerability management programs 158 00:04:58,050 --> 00:05:00,240 also use a process of continuous monitoring 159 00:05:00,240 --> 00:05:01,530 to quickly detect and respond 160 00:05:01,530 --> 00:05:03,930 to any anomalies that may occur in the future. 161 00:05:03,930 --> 00:05:06,000 Finally, if you need to ensure that you're in compliance 162 00:05:06,000 --> 00:05:08,220 with industry best practices or regulations, 163 00:05:08,220 --> 00:05:10,530 you can engage the services of an external auditor 164 00:05:10,530 --> 00:05:11,850 to provide a fresh pair of eyes 165 00:05:11,850 --> 00:05:13,440 to help catch anything that you might've missed 166 00:05:13,440 --> 00:05:16,110 during your own auditing and verification process. 167 00:05:16,110 --> 00:05:17,700 By using an external auditor, 168 00:05:17,700 --> 00:05:19,620 you will have a purely objective evaluation 169 00:05:19,620 --> 00:05:20,880 of your remediation efforts, 170 00:05:20,880 --> 00:05:22,350 and this can be really helpful. 171 00:05:22,350 --> 00:05:24,780 So remember, validating vulnerability remediation 172 00:05:24,780 --> 00:05:27,510 is not just about checking off boxes on your checklist, 173 00:05:27,510 --> 00:05:29,040 but it's also about ensuring that your systems 174 00:05:29,040 --> 00:05:30,600 are actually going to be more secure 175 00:05:30,600 --> 00:05:33,360 than they were before you performed remediation actions. 176 00:05:33,360 --> 00:05:35,340 By systematically rescanning, auditing, 177 00:05:35,340 --> 00:05:37,260 and verifying your remediation efforts, 178 00:05:37,260 --> 00:05:39,060 you can strengthen your security posture 179 00:05:39,060 --> 00:05:41,370 while ensuring that your organization remains compliant 180 00:05:41,370 --> 00:05:42,843 and operationally efficient.