-: Vulnerability management.
A vulnerability assessment seeks to identify issues
in a network, application, database, or other IT systems
prior to it being inadvertently or purposely used
to compromise a system.
Vulnerability assessments are a formalized process
that define, identify, and classify the security holes
in an enterprise network architecture.
It's also used to forecast the effectiveness
of proposed countermeasures
as part of your overall risk analysis process.
Now once these countermeasures are put in place,
a follow-up vulnerability assessment
can help you to determine
how effective your countermeasures truly are
in protecting that network from attack.
The management and oversight of this process
is known as vulnerability management.
Vulnerability management is the practice
of finding and mitigating the vulnerabilities
in your computers in your networks.
This is a very cyclical process.
Sometimes you'll hear this referred to as scan, patch, scan
because you need to scan the network
for vulnerabilities to identify them,
then you're going to prioritize all these vulnerabilities,
you're going to fix them and patch them,
and then you're going to scan again,
and you're going to keep doing this
until hopefully one day, you have no vulnerabilities left.
Good luck with that.
It's never going to happen, but that's the idea.
Now when you develop this process within your organization,
you have to figure out what the goal
of your vulnerability assessment is going to be
because this is going to help you design
a specific type of vulnerability assessment
that you're going to utilize
and help you scope the overall assessment.
There are three main questions
that you need to think about
before you're going to design a vulnerability assessment.
First, what is the value of the information
that could be discovered through the system compromise?
Second, what is the specific threat
that your system is facing?
And third, what mitigation strategies could be deployed
to address the issues that are found?
Let's consider the first question.
What is the value of information that could be discovered
through a compromise of the system?
This is going to help me decide how much resources
and what kind of resources I'm going to allocate
to identifying and fixing possible issues.
Let me give you a couple examples.
If you're a Coca-Cola
and you have a certain file server in your network
that contains your proprietary formula
for the best soft drink ever made,
you'd want to dedicate a lot of resources
to protecting that server.
Now if you had another server
that had all of your public affairs,
things like your commercials for the past 10 years,
you might not care about protecting that nearly as much
because those are already out in the public domain.
Next let's consider the question of the specific threats
that are applicable to your system.
Each type of computer is vulnerable to different attacks.
A Linux web server running Apache
has different vulnerabilities on it
than a Microsoft Windows-based web server
running Internet Information Services.
Both of these servers have very different vulnerabilities
than a Cisco router or switch.
As you can see here,
the differences in their operating system, configurations,
and operational use case is going to make them prone
to different vulnerabilities,
and different threats are going to attack them.
Now the final question is what mitigation strategies
or security controls could we deploy
to address the issues that we find?
Well, let's look at another example.
If you decide to perform a vulnerability scan
of every client on the network
and you found the same vulnerability on every single client,
what mitigation strategy could you use to fix it?
If it was me, I'd probably want to make sure
that my patch server is working correctly,
and I'd want to make sure that I'm pushing out a patch
to every client from this centralized patch server
to make sure that everyone gets the updated security fix.
Now what if there's no patch available yet?
Well, then we have to look at the exploit
that the vulnerability is going after.
Let's say that this vulnerability was being exploited
because somebody is going over Port 445,
what's that port again?
That's right.
It's the SMB service for file sharing.
Well, you could then mitigate this
by blocking that port at your network boundary's firewall
as a compensating control.
It's still going to have a vulnerability for people inside,
but you're going to stop the attackers
from the outside of getting in.
That's the idea here as you start figuring out
how you're going to solve your vulnerabilities.
Now the point is you're going to have many different choices
for mitigation, but your strategy is going to help you
determine how you're going to solve these problems
because you only have different things.
If I'm more worried about inside threat,
stopping it at the network firewall isn't going to help,
but if I'm worried about outside threats, it would.
So by answering these three questions,
you're going to be able to better scope
your vulnerability assessments to be more targeted
and better address the issues you identify
during your vulnerability assessments.
So how is a vulnerability assessment even conducted?
Well, most commonly, a vulnerability management program
will be used inside of an organization
and they'll choose what software you're going to use.
Generally, the software will be centrally managed
and perform these vulnerability assessments and scans.
Common choices for scanning include things like Nessus,
Qualysguard, and AlienVault software.
Luckily though, you don't have to be familiar
with any of these tools in detail
for the Security+ Exam.
Now when you use these programs,
analysts are able to scan the network based on the scope
and they can determine the priority
they're going to use when they find issues,
such as missing patches and misconfigurations.
These are then reported up
through the organizational process
to your system administrators
who will then patch and reconfigure them.
Once these are corrected by the system admins,
you then want to go back and re-scan the network
to determine if the issue was really resolved.
Did that security patch really patch the vulnerability
you thought it was going to?
It's important to note that vulnerability assessments
are just a snapshot in time.
For example, if I scan today
and a new vulnerability is discovered tomorrow,
then I'm not protected against it, I never looked for it.
So if your organization is doing a monthly scan
and a patch cycle that way,
your network may have an issue
that you're not even aware of
for up to an entire month until the next scan.
And if the issue is identified
and the system administrator installed the patch improperly,
it could take you another month
before it's discovered in the next periodic scan.
So determining how frequently you want to do these scans
is really important to your security.
Now to summarize the vulnerability management process
in just five steps,
here's the basic concepts you need to know.
Step one, define the desired state of security.
Your organization should determine exactly
how safe it wants to be and that determines how much money,
time and resources are going to be spent
to dedicate to the vulnerability management program.
After all, you're not going to be able to stop every threat
and you can't protect yourself from everything equally.
Step two, create a baseline.
You need to understand what normal is
and what the current state of your systems is.
Back in step one, we're going to determine where we want to be,
what our goal is.
Here in step two, we need to determine
where we currently are in terms of security.
This brings us to step three,
prioritize the vulnerabilities.
You might run your first scan of the network
and find 150 different issues.
If you're the only security analyst,
which one should you fix first?
Well, this is why it's important
to prioritize your strategy.
I recommend fixing servers first over work stations
and more critical issues like a remote code execution
over more trivial vulnerability
like an ability to conduct a null session connection.
This is because servers hold lots of critical information,
and critical vulnerabilities should always be addressed
before lower risk items.
Step four, you want to mitigate vulnerabilities.
This is where you're actually going to install
all those different controls, install those patches,
do your change configurations
to make your systems more secure.
In step three, we prioritize,
in step four, we actually put those things into place.
And that brings us to step five,
monitor the network and systems and conduct future scans.
You now have a bunch of issues
you hopefully fixed or mitigated all of those issues,
and now we want to watch and ensure nothing bad happens.
Or maybe some of those things
are going to take months to fix
because you need more money
to buy a new server or a new operating system.
If that's the case, you need to monitor those servers
until you get them patched and fixed.
Your job is not done with just scanning.
You need to scan and follow through,
and then start scanning again.
Remember, scan, patch, scan over and over and over again.
Our work is never done
because new vulnerabilities are discovered every single day.
The good news about that
is it means you're going to have great job security
because we always are going to have a job
for people doing vulnerability assessment.
(electronic music)