-: Before we dig too deep,
into vulnerability management programs,
let's look at the reasons you may need to establish,
a vulnerability management program.
And the first one, is regulatory requirements.
So, when we talk about regulatory requirements,
we have to understand that,
there's really two types of requirements,
that would cause us,
to create a vulnerability management program.
The first is regulatory requirements,
that's things like laws.
These are things like HIPPA, GLBA, PCI DSS, FISMA,
and other ones.
HIPPA has to do with healthcare industry.
GLBA has to do with the financial industry.
PCI DSS has to do with if you're accepting,
or taking credit cards in your industry.
FISMA has to do with the Federal government.
And there's other ones out there as well.
The second thing that might require you,
to make a vulnerability management program,
is if you have a corporate policy of requirement.
Your company thinks it's a good idea.
And those will be things like,
what targets are we gonna scan,
how often are we gonna do it,
and what other things are we gonna require?
We'll talk more about that in the next lesson.
But for this lesson, let's focus on laws and regulations.
Now because this course,
is covering the objectives of the CSA+ exam,
we are gonna talk about laws in the United States.
If you're outside of the US,
you need to look into what laws apply to your organizations.
But this course, because I'm based in the US,
we are gonna focus on US laws.
So, when we talk about them,
there are laws,
that govern the information storage and processing.
Things like HIPPA,
which is the Healthcare Information Privacy Act,
GLBA, which is Gramm-Leach-Bliley Act,
which has to do with financial institutions,
and insurance companies.
FERPA, is the Federal Education Regulation Protection Act.
And this is to protect students and teachers,
from the universities to collect their data.
These laws and regulations are gonna help dictate,
whether you need a vulnerability management program or not.
Now those all talk about,
how you have to process and store information,
on your systems,
but they don't dictate,
that you have to have a vulnerability management program.
Although it is a great thing to do.
There are two regulations and laws that do require,
that you do have a vulnerability management program.
Specifically, PCI DSS and FISMA.
Now, PCI DSS is not an actual law.
It's an agreement, across the credit card processors,
and merchants out there.
If you wanna accept Visa, MasterCard, American Express,
or Discover, you have to follow PCI DSS rules.
Again, this is not a law that the US government has made,
it's one that the merchant associations,
have made themselves.
This is gonna specify,
the type of security controls your network needs.
And, it has the most specific requirement for,
vulnerability management out of anything out there.
Because it actually tells you that you have to do it,
once a year, externally, and every three months,
every quarter, internally.
THere's some examples from this regulation here,
that says internal and external scans must be conducted.
They talk about the fact that every quarter,
you have to do an internal scan by your personnel,
and anytime you do a major change to your network.
You also can only do these internal scans,
by qualified personnel, and when you do external scans,
that once a year scan, you have to hire,
an outside approved security scanning vendor.
You also are require to remediate,
any high risk vulnerabilities,
and re scan until you get a clean bill of health,
over and over and over.
So it does have a very tight controls.
Now why is that?
Well, because they're afraid of credit card theft, right?
If someone breaches your network,
and steals a bunch of credit card numbers,
Visa, MasterCard, American Express and Discover
are gonna be covering those losses.
So for them to say,
we're gonna allow you to accept our credit cards,
you have to meet this threshold of security.
That's what PCI DSS does.
Now, when we talk about FISMA,
this has to do with the Federal government.
The Federal US government.
Federal Information Security Management Act.
It specifies security controls,
for government information systems.
Now this applies both to agencies and organizations,
that run the systems,
so it's not just the FBI, or Homeland Security,
or the department of the treasury that this applies to,
but if Microsoft is a subcontractor for them,
or Dell, or Hewlett Packard,
or any of the other big companies,
they have to meet those requirements as well,
as part of the contract language.
Systems are classified as either low,
moderate, or high impact.
And then based on what impact they are,
there's gonna be more or less stringent requirements,
for the systems.
So if you have a high impact system,
there's gonna be lot tougher requirements you have to meet.
If it's a low impact system,
you can scan it a lot less frequent.
And there's a lot lower bar that you have to meet,
to be able to be considered secure under FISMA.
Now, if you look at this chart,
this is kind of a small chart, I know.
You don't have to memorize this chart at all,
even if you're studying for the CSA+ exam,
the overall theme here is that if you look at it,
on the left side you have confidentiality,
integrity and availability.
Those three tenants of information security.
And going across the top,
we have low, moderate and high.
Now there's three key words I want you to remember,
when you talk about low impact, moderate impact,
or high impact.
If it's a low impact,
it means it has a limited adverse effect.
If it's a moderate impact,
if means it has a serious adverse effect.
If it's a high impact,
it has a severe or catastrophic adverse effect.
And then you just talk about that,
in regards to confidentiality, integrity,
or availability, right?
That's all this chart is telling you, right?
Limited or low, serious or moderate,
and severe or catastrophic which means high.
That's all they're talking about on this chart.
Now, FISMA does have some requirements.
It says you have to scan systems,
whenever a new threat emerges.
What's a new threat?
Well, if a new open source of vulnerability has come out,
for instance there was a bug in Microsoft Windows,
and there's now a known exploit for it.
That's a new threat.
Use tools and techniques that are interoperable.
This means if you're using Nessus,
or Qualys Guard, or any other scanning tool out there,
they should all be able to talk to each other,
and be able to be used at the same way.
The reason why they do that,
is because the Federal government is very large.
They don't want the FBI using Qualys,
and the treasury department using Nessus,
and those two not talking to each other, right?
They want to make sure the government,
can get benefit from all of these tools.
You need to analyze your scan reports from assessments,
so once you run the scan, you have to analyze them.
And then you should fix those problems right?
That's the idea.
You should remediate your vulnerabilities based on risk.
We'll talk much more about this later,
but going back to the last chart,
if something is a high impact,
you probably want to fix it quicker.
If it's a low impact, you can push it off,
and wait a little while before fixing it.
And then you want to share your findings,
with other agencies to eliminate similar findings,
in other systems.
So, if the FBI has figured out,
that there's a bad thing happening on their network,
there's a vulnerability and they should probably tell,
the Department of Homeland Security,
so they don't have that bad thing on their network, too.
That's the idea.
It's all about interoperability,
making sure our networks are more secure,
and as a government,
we want to have the most secure information security we can,
so that we don't get hacked by advanced nation states,
advanced persistent threats, by script kiddies,
by, you know, hacktivist groups,
or anything else like that.
That's the whole idea in FISMA,
is making our systems more secure.
(electronic music)