1 00:00:00,090 --> 00:00:01,830 In this lesson, we're going to take a look 2 00:00:01,830 --> 00:00:03,960 at a vulnerability scan report. 3 00:00:03,960 --> 00:00:05,490 Now, a vulnerability scan report 4 00:00:05,490 --> 00:00:07,890 is going to be produced by the system automatically 5 00:00:07,890 --> 00:00:10,530 once you've finish doing your vulnerability scan. 6 00:00:10,530 --> 00:00:12,420 Now generally, you're not just going to take this scan 7 00:00:12,420 --> 00:00:13,770 and turn it into your boss though. 8 00:00:13,770 --> 00:00:15,720 You need to actually do some analysis on it 9 00:00:15,720 --> 00:00:17,850 to determine are these things right? 10 00:00:17,850 --> 00:00:19,500 Whenever you do a vulnerability scan, 11 00:00:19,500 --> 00:00:22,080 for each of these vulnerabilities, you need to look at them 12 00:00:22,080 --> 00:00:24,330 and determine if they were detected by the scanner, 13 00:00:24,330 --> 00:00:26,070 do they really exist in your system? 14 00:00:26,070 --> 00:00:28,200 Because just because the scanner says they're there, 15 00:00:28,200 --> 00:00:29,730 doesn't mean they're actually there. 16 00:00:29,730 --> 00:00:31,830 Sometimes we'll have false positives. 17 00:00:31,830 --> 00:00:33,630 For example, I've run scans 18 00:00:33,630 --> 00:00:35,820 and I'll get things saying that I'm vulnerable to an exploit 19 00:00:35,820 --> 00:00:37,710 because I'm missing a critical Windows patch 20 00:00:37,710 --> 00:00:40,260 even though I'm running a Mac or a Linux system. 21 00:00:40,260 --> 00:00:42,120 So that's one of the reasons why it's so important 22 00:00:42,120 --> 00:00:44,070 to go through your vulnerability scan reports 23 00:00:44,070 --> 00:00:46,200 and look at each identified vulnerability, 24 00:00:46,200 --> 00:00:47,880 determine does it exist on your system? 25 00:00:47,880 --> 00:00:49,950 And if it does, how severe is it 26 00:00:49,950 --> 00:00:52,110 and how critical is it for you to get it fixed? 27 00:00:52,110 --> 00:00:54,360 Then you create your plan of action and milestones 28 00:00:54,360 --> 00:00:56,430 and you start remediating those things. 29 00:00:56,430 --> 00:00:58,680 Now, when you look at a vulnerability scan report, 30 00:00:58,680 --> 00:01:00,240 generally it's going to take a format 31 00:01:00,240 --> 00:01:01,590 that's similar to this. 32 00:01:01,590 --> 00:01:04,290 Most tools will have a more graphical-type format 33 00:01:04,290 --> 00:01:06,540 where they'll use color coding to show you what is critical, 34 00:01:06,540 --> 00:01:09,210 high, medium, low, or informational. 35 00:01:09,210 --> 00:01:10,560 But at the end of the day, 36 00:01:10,560 --> 00:01:12,360 what we're looking at is the information, 37 00:01:12,360 --> 00:01:13,920 not the format here. 38 00:01:13,920 --> 00:01:15,510 The same information that's on this report 39 00:01:15,510 --> 00:01:17,220 will be on most other scanning tools 40 00:01:17,220 --> 00:01:20,400 regardless of if you're using Nessus, OpenVAS, QualysGuard, 41 00:01:20,400 --> 00:01:22,560 or any of the other vulnerability scanners out there. 42 00:01:22,560 --> 00:01:23,580 It really doesn't matter. 43 00:01:23,580 --> 00:01:24,720 They're all going to have basically 44 00:01:24,720 --> 00:01:26,400 the same types of information. 45 00:01:26,400 --> 00:01:27,630 Now, in general, you're going to have 46 00:01:27,630 --> 00:01:28,980 your vulnerability scan report 47 00:01:28,980 --> 00:01:30,510 start out with the report ID, 48 00:01:30,510 --> 00:01:32,040 the scan date and time, 49 00:01:32,040 --> 00:01:34,770 what system or version of software and definitions 50 00:01:34,770 --> 00:01:36,300 were used to conduct that scan, 51 00:01:36,300 --> 00:01:39,030 and then the name of the person who ran those scans. 52 00:01:39,030 --> 00:01:40,590 Then you'll have a short summary 53 00:01:40,590 --> 00:01:42,780 that's usually going to be called an executive summary. 54 00:01:42,780 --> 00:01:44,130 If you're running a vulnerability scan 55 00:01:44,130 --> 00:01:45,540 across a large network 56 00:01:45,540 --> 00:01:47,700 that has hundreds or thousands of hosts, 57 00:01:47,700 --> 00:01:49,980 you may end up having hundreds or thousands 58 00:01:49,980 --> 00:01:52,200 or even hundreds of thousands of vulnerabilities, 59 00:01:52,200 --> 00:01:53,310 and none of your executives 60 00:01:53,310 --> 00:01:55,170 want to look through that level of detail. 61 00:01:55,170 --> 00:01:56,880 So instead, you're going to summarize it 62 00:01:56,880 --> 00:01:59,490 as a cybersecurity analyst or cybersecurity professional 63 00:01:59,490 --> 00:02:02,580 to tell them what kind of themes and trends you're seeing. 64 00:02:02,580 --> 00:02:05,550 For example, if you were scanning a network of 100 computers 65 00:02:05,550 --> 00:02:07,260 and 50 of them are missing a patch 66 00:02:07,260 --> 00:02:08,880 that was released five years ago, 67 00:02:08,880 --> 00:02:10,830 that tells you you have a patch management problem 68 00:02:10,830 --> 00:02:12,000 in that organization, 69 00:02:12,000 --> 00:02:14,850 and you need to highlight that inside the executive summary. 70 00:02:14,850 --> 00:02:15,990 Next, you're going to have 71 00:02:15,990 --> 00:02:17,460 all of your vulnerabilities listed, 72 00:02:17,460 --> 00:02:18,960 and generally they're going to list these 73 00:02:18,960 --> 00:02:21,900 from critical to high to medium to low, 74 00:02:21,900 --> 00:02:23,580 and then to informational. 75 00:02:23,580 --> 00:02:26,130 Or you can also run these based on hosts. 76 00:02:26,130 --> 00:02:28,380 So you can actually run the scan across 100 machines 77 00:02:28,380 --> 00:02:29,610 and then have the report show you 78 00:02:29,610 --> 00:02:31,260 which is the most vulnerable host. 79 00:02:31,260 --> 00:02:33,630 Maybe you had one host that's missing 50 patches, 80 00:02:33,630 --> 00:02:35,880 and you have other hosts that are missing only one patch. 81 00:02:35,880 --> 00:02:37,380 So we would have the most critical 82 00:02:37,380 --> 00:02:39,120 or most vulnerable host at the top 83 00:02:39,120 --> 00:02:40,590 and then work our way down the list 84 00:02:40,590 --> 00:02:42,750 to help us with our prioritization efforts. 85 00:02:42,750 --> 00:02:44,040 Now, as we go through this report, 86 00:02:44,040 --> 00:02:44,873 we're going to take a look 87 00:02:44,873 --> 00:02:46,170 at these different vulnerabilities 88 00:02:46,170 --> 00:02:47,670 and discuss them a little bit. 89 00:02:47,670 --> 00:02:48,570 Now, when you look at this, 90 00:02:48,570 --> 00:02:50,940 this is a very generic-style report. 91 00:02:50,940 --> 00:02:52,710 Under the high-severity vulnerabilities, 92 00:02:52,710 --> 00:02:55,320 the first thing we're going to see is our vulnerability ID, 93 00:02:55,320 --> 00:02:57,420 and you'll notice it starts with CVE. 94 00:02:57,420 --> 00:02:59,790 That is a common vulnerability and exposure. 95 00:02:59,790 --> 00:03:03,480 Then dash 2021, which was the year it was released, 96 00:03:03,480 --> 00:03:06,060 and then dash 34523, 97 00:03:06,060 --> 00:03:11,060 which was the 34523rd vulnerability released in 2021. 98 00:03:11,070 --> 00:03:14,063 The name of this vulnerability is CVE-2021-34523. 99 00:03:16,560 --> 00:03:18,750 But to make it easier for us to understand what it is, 100 00:03:18,750 --> 00:03:20,040 there's also a description. 101 00:03:20,040 --> 00:03:21,630 This is a Microsoft Exchange Server 102 00:03:21,630 --> 00:03:23,880 Remote Code Execution Vulnerability. 103 00:03:23,880 --> 00:03:28,500 The affected system was the ExchangeServer01.domain.local, 104 00:03:28,500 --> 00:03:31,200 and the impact is it allows an authenticated attacker 105 00:03:31,200 --> 00:03:33,390 to perform a remote code execution. 106 00:03:33,390 --> 00:03:35,070 Now, this CVSS score, 107 00:03:35,070 --> 00:03:37,470 or the common vulnerability scoring system score, 108 00:03:37,470 --> 00:03:39,600 is actually listed as a 9.1, 109 00:03:39,600 --> 00:03:42,750 which is a very high score because the top score is a 10 110 00:03:42,750 --> 00:03:44,580 and the lowest score is a zero. 111 00:03:44,580 --> 00:03:47,010 The remediation that they recommend is to apply the update 112 00:03:47,010 --> 00:03:51,870 provided by Microsoft in the security bulletin MS21-087. 113 00:03:51,870 --> 00:03:55,020 So what this is telling me is we have a known vulnerability 114 00:03:55,020 --> 00:03:56,910 on our Microsoft Exchange Server. 115 00:03:56,910 --> 00:03:57,930 That's the bad news, 116 00:03:57,930 --> 00:03:59,970 but the good news is there's an easy fix. 117 00:03:59,970 --> 00:04:01,500 We can install this update, 118 00:04:01,500 --> 00:04:05,010 which is a hotfix called MS21-087. 119 00:04:05,010 --> 00:04:06,780 So if we go to Microsoft's website, 120 00:04:06,780 --> 00:04:09,090 we download it and we install it on the Exchange Server, 121 00:04:09,090 --> 00:04:10,560 this will solve this issue. 122 00:04:10,560 --> 00:04:13,140 So we can do that, and then we could rescan the system 123 00:04:13,140 --> 00:04:14,940 and we should see that vulnerability go away 124 00:04:14,940 --> 00:04:17,250 because we've now patched that vulnerability. 125 00:04:17,250 --> 00:04:22,079 The next vulnerability we have is CVE-2022-21882, 126 00:04:22,079 --> 00:04:25,020 and this is a Windows Remote Desktop Protocol, or RDP, 127 00:04:25,020 --> 00:04:26,700 Remote Code Execution. 128 00:04:26,700 --> 00:04:29,340 The affected system is a desktop number 152 129 00:04:29,340 --> 00:04:30,990 and desktop 178. 130 00:04:30,990 --> 00:04:32,220 This particular vulnerability 131 00:04:32,220 --> 00:04:35,220 will allow an unauthenticated attacker to connect via RDP 132 00:04:35,220 --> 00:04:37,080 and execute arbitrary code. 133 00:04:37,080 --> 00:04:38,460 The remediation is to install 134 00:04:38,460 --> 00:04:39,870 the latest Windows security update 135 00:04:39,870 --> 00:04:42,720 and disable RDP if it's not required. 136 00:04:42,720 --> 00:04:44,070 Now, in this case, we actually have 137 00:04:44,070 --> 00:04:45,720 two different recommendations here. 138 00:04:45,720 --> 00:04:47,250 One is to install a security patch, 139 00:04:47,250 --> 00:04:49,800 and the second one is to disable RDP. 140 00:04:49,800 --> 00:04:52,140 So if these computers don't need RDP, 141 00:04:52,140 --> 00:04:53,820 we don't even need to worry about the security patch 142 00:04:53,820 --> 00:04:55,350 because we can just disable RDP 143 00:04:55,350 --> 00:04:57,780 and therefore it's no longer going to be applicable to us. 144 00:04:57,780 --> 00:04:59,370 But if we actually need to allow RDP 145 00:04:59,370 --> 00:05:00,540 to remain open and available 146 00:05:00,540 --> 00:05:02,190 because our service desk likes to connect it 147 00:05:02,190 --> 00:05:04,890 to these desktops to be able to remotely support them, 148 00:05:04,890 --> 00:05:07,290 then we're going to have to update that security patch 149 00:05:07,290 --> 00:05:09,480 to make sure that it is no longer vulnerable. 150 00:05:09,480 --> 00:05:10,500 The other thing I want to point out 151 00:05:10,500 --> 00:05:12,090 between these two vulnerabilities 152 00:05:12,090 --> 00:05:13,650 is the first one we talked about 153 00:05:13,650 --> 00:05:15,960 said that it allowed an authenticated attacker, 154 00:05:15,960 --> 00:05:18,090 which means that person has to be an insider threat 155 00:05:18,090 --> 00:05:21,150 or have access to credentials for your organization. 156 00:05:21,150 --> 00:05:23,790 But the second one is an unauthenticated attacker, 157 00:05:23,790 --> 00:05:26,040 which means anybody, whether they're logged in or not, 158 00:05:26,040 --> 00:05:28,860 would be able to connect over RDP with this vulnerability 159 00:05:28,860 --> 00:05:30,360 if they're throwing the right exploit. 160 00:05:30,360 --> 00:05:32,250 And that's why this is actually more severe. 161 00:05:32,250 --> 00:05:35,400 Now, if it's more severe, why is the CVSS score lower? 162 00:05:35,400 --> 00:05:37,590 Well, it's because of what it's impacting. 163 00:05:37,590 --> 00:05:40,620 When you're dealing with RDP specifically on these desktops, 164 00:05:40,620 --> 00:05:42,690 we are only dealing with a single workstation. 165 00:05:42,690 --> 00:05:44,280 But when we're dealing with an Exchange Server, 166 00:05:44,280 --> 00:05:45,870 it's serving everybody's email 167 00:05:45,870 --> 00:05:47,430 across the entire organization, 168 00:05:47,430 --> 00:05:49,440 so it is going to have a higher CVSS score, 169 00:05:49,440 --> 00:05:50,700 and the way it attacks 170 00:05:50,700 --> 00:05:53,310 and the ability you have once that attack is successful 171 00:05:53,310 --> 00:05:54,630 will be more impactful, 172 00:05:54,630 --> 00:05:57,450 and that's another reason why the CVSS score is higher. 173 00:05:57,450 --> 00:06:00,060 The next one we have is a medium-severity vulnerability 174 00:06:00,060 --> 00:06:04,560 that's called CVE-2021-25646, 175 00:06:04,560 --> 00:06:07,320 and this is an Apache Druid Remote Code Execution. 176 00:06:07,320 --> 00:06:08,610 Here, the affected system 177 00:06:08,610 --> 00:06:10,620 is our analytics server number three, 178 00:06:10,620 --> 00:06:13,170 and the attacker can send a specifically crafted request 179 00:06:13,170 --> 00:06:15,150 to execute arbitrary code. 180 00:06:15,150 --> 00:06:17,310 Now, because it is a specifically crafted request 181 00:06:17,310 --> 00:06:18,810 and it's harder to execute, 182 00:06:18,810 --> 00:06:21,690 it's only going to have a CVSS score of 6.5. 183 00:06:21,690 --> 00:06:24,270 The remediation to solve this vulnerability is pretty easy. 184 00:06:24,270 --> 00:06:26,430 We're going to install the latest version of Apache Druid 185 00:06:26,430 --> 00:06:28,050 to address the vulnerability. 186 00:06:28,050 --> 00:06:29,190 Now, unfortunately, 187 00:06:29,190 --> 00:06:31,350 if there was no updated version available yet, 188 00:06:31,350 --> 00:06:32,550 we wouldn't be able to do that. 189 00:06:32,550 --> 00:06:34,740 Or maybe we're running this on an older server 190 00:06:34,740 --> 00:06:36,480 that can't support the latest version. 191 00:06:36,480 --> 00:06:37,950 In those cases, we'd have to come up 192 00:06:37,950 --> 00:06:40,620 with compensating controls or other mitigations 193 00:06:40,620 --> 00:06:41,970 to be able to address this vulnerability 194 00:06:41,970 --> 00:06:44,460 instead of just updating it to the latest version. 195 00:06:44,460 --> 00:06:45,990 Now, when you're analyzing these things 196 00:06:45,990 --> 00:06:47,550 as a cybersecurity professional, 197 00:06:47,550 --> 00:06:48,390 it's important to be able 198 00:06:48,390 --> 00:06:51,570 to look up those CVEs on the CVE website. 199 00:06:51,570 --> 00:06:55,530 If you go to cve.org and type in that CVE number, 200 00:06:55,530 --> 00:06:57,540 you'll be able to get pages of information 201 00:06:57,540 --> 00:06:59,790 about these vulnerabilities, how they work, 202 00:06:59,790 --> 00:07:00,720 how they're exploited, 203 00:07:00,720 --> 00:07:03,480 and different mitigations you can use to overcome them. 204 00:07:03,480 --> 00:07:05,250 So keep that in mind as well. 205 00:07:05,250 --> 00:07:06,510 If we move on to our second page, 206 00:07:06,510 --> 00:07:08,640 we'll see we have two more vulnerabilities to look at. 207 00:07:08,640 --> 00:07:10,020 The first one is number four, 208 00:07:10,020 --> 00:07:14,970 which is vulnerability CVE-2022-22965, 209 00:07:14,970 --> 00:07:16,890 which is the Spring Framework RCE 210 00:07:16,890 --> 00:07:19,620 via Data Binding on JDK 9+. 211 00:07:19,620 --> 00:07:22,170 The affected system here is our web application server, 212 00:07:22,170 --> 00:07:24,450 and it allows the attackers to use crafted data 213 00:07:24,450 --> 00:07:27,330 to bind expressions to execute arbitrary code. 214 00:07:27,330 --> 00:07:30,000 Here we have a CVSS score of 5.3. 215 00:07:30,000 --> 00:07:30,960 This is why it's a medium, 216 00:07:30,960 --> 00:07:32,670 because it's a lower priority for us 217 00:07:32,670 --> 00:07:34,080 and a lower criticality. 218 00:07:34,080 --> 00:07:36,990 The reason is, this allows you to execute arbitrary code, 219 00:07:36,990 --> 00:07:39,180 but it is not a remote code execution, 220 00:07:39,180 --> 00:07:40,013 which means they have to be 221 00:07:40,013 --> 00:07:41,430 physically present on the network 222 00:07:41,430 --> 00:07:42,720 to be able to access this 223 00:07:42,720 --> 00:07:44,490 and be able to send this crafted packet. 224 00:07:44,490 --> 00:07:46,530 So in this case, we would remediate this 225 00:07:46,530 --> 00:07:48,660 by simply updating the Spring Framework version 226 00:07:48,660 --> 00:07:50,940 to one that has fixed this vulnerability. 227 00:07:50,940 --> 00:07:52,380 The last vulnerability we have 228 00:07:52,380 --> 00:07:56,910 is vulnerability CVE-2021-44228. 229 00:07:56,910 --> 00:07:57,900 And the description here 230 00:07:57,900 --> 00:08:01,530 is an Apache Log4j Remote Code Execution Vulnerability, 231 00:08:01,530 --> 00:08:03,390 which is known as Log4Shell. 232 00:08:03,390 --> 00:08:06,210 This affects our legacy server, which is an older server. 233 00:08:06,210 --> 00:08:07,590 It is a remote code execution 234 00:08:07,590 --> 00:08:09,990 in an application that uses Log4j, 235 00:08:09,990 --> 00:08:12,480 so it only affects very few applications 236 00:08:12,480 --> 00:08:14,670 and only the ones using Log4j, 237 00:08:14,670 --> 00:08:17,160 and this makes it have a much lower CVSS score, 238 00:08:17,160 --> 00:08:18,780 and it's down to a 3.7, 239 00:08:18,780 --> 00:08:20,250 and you'll see in parentheses 240 00:08:20,250 --> 00:08:22,320 it was mitigated by network controls, 241 00:08:22,320 --> 00:08:23,940 which means we might have things in place 242 00:08:23,940 --> 00:08:26,310 that are blocking people from accessing the server 243 00:08:26,310 --> 00:08:28,200 and it's in an isolated area of our network. 244 00:08:28,200 --> 00:08:31,200 And that reason makes it a much lower CVSS score, 245 00:08:31,200 --> 00:08:33,720 because it is not as important or not as critical 246 00:08:33,720 --> 00:08:35,520 at a high or medium level 247 00:08:35,520 --> 00:08:38,070 because it is in this network isolated state. 248 00:08:38,070 --> 00:08:39,780 To be able to remediate this CVE, 249 00:08:39,780 --> 00:08:44,340 you're going to update to Log4j version 2.15.0 or higher, 250 00:08:44,340 --> 00:08:46,260 and that will solve this vulnerability. 251 00:08:46,260 --> 00:08:48,270 Now, after that, you'll have some additional findings. 252 00:08:48,270 --> 00:08:50,130 This may be all of your informational findings. 253 00:08:50,130 --> 00:08:52,230 In this case, we had a minor vulnerability 254 00:08:52,230 --> 00:08:54,690 related to some outdated SSL certificates, 255 00:08:54,690 --> 00:08:56,430 unused services running on several machines, 256 00:08:56,430 --> 00:08:58,230 and misconfigured server headers. 257 00:08:58,230 --> 00:08:59,460 In our real scanning report, 258 00:08:59,460 --> 00:09:00,930 if you went to a detailed report, 259 00:09:00,930 --> 00:09:02,250 we would see all of those listed out 260 00:09:02,250 --> 00:09:04,440 with which machines, which IP addresses, 261 00:09:04,440 --> 00:09:05,700 and which pieces of software 262 00:09:05,700 --> 00:09:08,160 were being misconfigured on these different servers. 263 00:09:08,160 --> 00:09:11,070 But because this is a summary report, we're not seeing that. 264 00:09:11,070 --> 00:09:12,990 And then finally, we have some recommendations, 265 00:09:12,990 --> 00:09:14,430 which includes prioritized patching 266 00:09:14,430 --> 00:09:16,530 of high-severity vulnerabilities immediately, 267 00:09:16,530 --> 00:09:18,300 reviewing your medium-severity issues 268 00:09:18,300 --> 00:09:20,520 and scheduling patching in the next maintenance window, 269 00:09:20,520 --> 00:09:22,320 and then addressing low-severity issues 270 00:09:22,320 --> 00:09:25,680 per your standard patch cycle or when your resources allow. 271 00:09:25,680 --> 00:09:28,230 Our conclusion is going to summarize the actions we've taken 272 00:09:28,230 --> 00:09:29,910 and what recommendations we have. 273 00:09:29,910 --> 00:09:30,900 In this case, it's going to say 274 00:09:30,900 --> 00:09:32,100 the identified vulnerabilities 275 00:09:32,100 --> 00:09:33,990 pose varying levels of risk to our network. 276 00:09:33,990 --> 00:09:36,780 The high and medium-severity issues require prompt action, 277 00:09:36,780 --> 00:09:38,970 and continued vigilance and regular scanning are recommended 278 00:09:38,970 --> 00:09:40,830 to maintain the security posture. 279 00:09:40,830 --> 00:09:42,210 This is the idea of what a basic 280 00:09:42,210 --> 00:09:43,800 vulnerability scan report looks like. 281 00:09:43,800 --> 00:09:46,950 And I will tell you, this one is a very simplified version. 282 00:09:46,950 --> 00:09:48,870 You saw this was only on two pages 283 00:09:48,870 --> 00:09:50,520 and it was covering an entire network. 284 00:09:50,520 --> 00:09:52,410 But normally when I run this across an entire network, 285 00:09:52,410 --> 00:09:55,680 I will have 50, 100, or even 500 pages of data 286 00:09:55,680 --> 00:09:56,640 coming back to me 287 00:09:56,640 --> 00:09:59,130 with all the details of every vulnerability, 288 00:09:59,130 --> 00:10:00,930 all the criticalities, all the impacts, 289 00:10:00,930 --> 00:10:03,000 and all the remediation actions that we can take 290 00:10:03,000 --> 00:10:04,950 to improve the security of our network. 291 00:10:04,950 --> 00:10:06,270 The bottom line here is when you're dealing 292 00:10:06,270 --> 00:10:07,770 with a vulnerability scan report, 293 00:10:07,770 --> 00:10:09,480 you need to take the time to look at it 294 00:10:09,480 --> 00:10:11,460 and not just accept what they told you 295 00:10:11,460 --> 00:10:12,900 was high, medium, and low, 296 00:10:12,900 --> 00:10:14,880 because what that automatic tool tells you 297 00:10:14,880 --> 00:10:16,680 is what is known in the common database 298 00:10:16,680 --> 00:10:19,860 based on the CVE posture or CVSS score. 299 00:10:19,860 --> 00:10:22,440 The problem with that is you may have mitigations in place 300 00:10:22,440 --> 00:10:24,180 that these systems don't realize, 301 00:10:24,180 --> 00:10:26,520 and because of that, you have to take that into account 302 00:10:26,520 --> 00:10:28,140 and then mitigate these things. 303 00:10:28,140 --> 00:10:30,360 For example, if I go back to the first page 304 00:10:30,360 --> 00:10:33,150 and we had that high vulnerability for the Exchange Server, 305 00:10:33,150 --> 00:10:34,800 well, if I know that the Exchange Server 306 00:10:34,800 --> 00:10:36,300 is actually being decommissioned tomorrow 307 00:10:36,300 --> 00:10:38,640 because we're going from Exchange Server 2016 308 00:10:38,640 --> 00:10:40,350 to a modern Exchange Server, 309 00:10:40,350 --> 00:10:41,790 that would tell us that that vulnerability 310 00:10:41,790 --> 00:10:42,990 is going to go away anyway, 311 00:10:42,990 --> 00:10:44,280 so we probably don't have to remediate it 312 00:10:44,280 --> 00:10:45,240 here on the scan report, 313 00:10:45,240 --> 00:10:47,520 and it's not nearly as high or critical for us 314 00:10:47,520 --> 00:10:49,470 as it would be if we're going to be stuck with this server 315 00:10:49,470 --> 00:10:51,300 for another six months or a year. 316 00:10:51,300 --> 00:10:52,170 And so these are the things 317 00:10:52,170 --> 00:10:54,540 that you have to know your organization and your network 318 00:10:54,540 --> 00:10:55,590 to understand the impact 319 00:10:55,590 --> 00:10:57,330 and the prioritization that needs to occur 320 00:10:57,330 --> 00:10:58,860 for those vulnerabilities that you find 321 00:10:58,860 --> 00:11:00,960 inside of your vulnerability scan reports.