In this episode,
we're going to go back into risk management
and discuss how that intersects with vulnerability management.
Vulnerability management along with risk management is kind of the
caveat of what you really do as a cybersecurity analyst,
you're constantly moving back and judging, hey,
how risk is this versus the vulnerabilities that coincide with the
different systems that you usually use risk and vulnerability management,
really make up the core of every cybersecurity analyst.
And we're going to discover that today.
If you remember from our previous lectures,
risk management really corresponds into five main points,
identification of the risk assessment of how dangerous that risk really is
prioritization of how difficult or how contagious or how impactful that risk is
in order to be fixed within your own organization.
Ie should this risk or this problem based off a higher
priority to be fixed versus a lower priority with the mitigation factor
are,
can I mitigate that risk to do a lower priority or have less impact on our company?
And finally, a review of the different risks that are associated with it.
We're not going to go solely into risk management today,
but I wanted to touch back on to it of previous lectures.
So you get a good sense of where we're coming from.
Risk equals threats multiplied by vulnerabilities.
Meaning that if I have zero vulnerabilities, but I have a lot of threats,
there is no risk, meaning I have may have threats.
But again, if there's nothing for,
for them to actually impact or nothing for them to exploit,
then I really don't have any risk on the flip side.
Although much rarer if I have a vulnerability, but there are no threats, then again,
I have no risk.
There's little windows vulnerabilities that we discovered from Windows XP.
Way back in the day, we knew that the vulnerability existed.
But at the time, the technology to exploit those vulnerabilities was near zero,
meaning there really were no threats that
could take advantage of those vulnerabilities.
Meaning there was no,
we saw that in those lower windows systems.
However, if I took a Windows XP machine today
and I have those same vulnerabilities,
we have more than enough technology to exploit those vulnerabilities.
Meaning there is a high risk. If you're using Windows XP,
this comes into play with understanding risk
at its most fundamental level threats,
times vulnerabilities equals risk.
And I've seen other acronyms or further algorithms
that come in and they say threats plus vulnerabilities
equals risk, but that's not really the case.
It really is that multiplication that comes into play because if I have threats,
but I have zero vulnerabilities with the addition factor.
Then I still have a risk and that's just not the case.
I must have both threats and vulnerabilities in order to have risk.
Vulnerability management really starts with the different aspects
of understanding your network as a whole.
I must understand my network and to do that,
I must have an inventory of every machine, whether it's a windows box or an IP
I DS A router, even a switch.
Heck even if I have a hub in my system,
that's part of my intrinsic networking infrastructure.
And I need to be aware of that.
Having a good inventory of your
systems really provides you a detailed understanding
of all the different vulnerabilities that could in fact be on your network.
When I worked with a telecommunications company.
One time,
we had all this equipment rolled out and a lot of
times we didn't know what we actually had in our systems.
So we have these very complex switches and microwave radios.
We had some great telecommunications equipment,
but we had other inventory that we had no idea was there. It just worked.
And unless the technician that was on site,
went there and actually physically put eyes on it,
we had no idea that machinery was there.
This is a very sad and poor way in order
to understand your vulnerabilities associated with your different networks.
Now, the argument was always made.
Oh, well, you have to actually know how to use the equipment,
you had to know what the equipment it was because some of
this equipment in telecom was literally 30 or 40 years old.
So most people would look at it and have no idea what they were looking at.
But that's not real security. That's obscurity through obscurity.
And if we're doing security through obscurity, that's not real security,
it's just make believe.
So you must have that inventory,
you must understand everything that's in your network
and have a detailed list of it.
You should have serial numbers,
makes models and what the machine actually does or
how it interacts with the rest of your network
to do that. We do a lot of scanning.
Now, scanning is usually done in one, sometimes two different ways.
There's openvas
and there's
NSIS.
Open
boss really provides us that open source way of scanning our different
uh networks and understand the different
vulnerabilities that are associated with it.
And
NSIS is more of the commercial grade aspect of doing the same thing
here. You can see a screenshot of oven
boss where it's provided detailed information of what's
on our system or what's on our network.
On this screenshot,
you can see the different criticalities that are
associated with the different vulnerabilities that it found.
This is a plain and simple vulnerability management
at its core level and your systems,
your infrastructure should be scanned in this way every day.
Within this. We can identify prioritization
when going through the prioritization,
you can see that it goes through and it provides us the most critical levels
at the very top with maybe the lower levels of the product within this.
You can see different aspects of the different vulnerabilities associated with
each machine or each IP address within our different network.
This provides us not only an inventory of every IP address associated with our
network but also different vulnerabilities that could
be linked to those specific IP addresses.
When we talk about priority,
you need to understand where it comes into play with your specific network.
Meaning if I have a vulnerability that it's
a Linux vulnerability on a Windows machine,
that's obviously a false positive.
Meaning that the positivity of the vulnerability doesn't actually exist.
We have to go through and concentrate on the false negatives, false positives,
even the true positives and true negatives
to truly understand what's going on with our network.
This is almost a full time job by itself and should be carefully looked at on a
case by case basis based on the different
IP addresses and structures within your internal network.
Prioritization really comes into play with understanding what
really takes priority in our own network.
You can have a very complex highly
critical system vulnerability associated with your network
and the system to be telling you, hey, knee jerk reaction,
let's give it a very high priority.
However,
you may know through experience and understanding
of your systems and network that,
that vulnerability really doesn't need a such a high critical level.
It can actually be dropped down a couple of places.
And the prioritization could be resubmitted based
on that new algorithm that you utilize.
This is part of prioritization where we put logic versus common sense
plus intuition.
This really comes into play with understanding your own network.
And that makes your prioritization based on logic versus intuition or gut feeling,
you know, the system and networks.
If I just wanted somebody to look at it and
give me a knee jerk reaction every time and say,
hey,
this needs a critical input.
The machine said, so I don't need human beings for that.
I just need a machine that runs a script to do that.
Your job as an analyst is to understand those little idiosyncrasies that
communications or A I machine learning will never get.
This is why human beings will always rate higher than machines.
When it comes to true cybersecurity.
Patch management really makes up one of those core fundamentals that we associate
with our network scanning and our
core vulnerabilities within a management scheme.
You should be patching your Windows machines almost on a weekly basis
whenever Microsoft comes out with a new patch. However, it's not as simple as that.
And we discussed in further episodes,
patch management really comes into play with understanding the pa
patches that are coming into our different networks,
how they correspond with our core operating systems.
And how they correspond with our existing software.
And then we run it through a sandbox environment before we push that patch forward.
Patch management goes into a very detailed uh
uh change management program that we need to be aware of.
But you need to also understand that that patch
management is very much a heart of vulnerability management.
We also need to understand configuration management.
Configuration management comes into play with if I've got a new piece of equipment,
am I configuring it properly?
Did I remove the dead set username and password that came with it?
Those default username and passwords?
They're heck and we know that because there's been some
major telecom and cellular providers that have installed new routers,
they forgot to change the default username and passwords
and they've suffered data breaches because of it.
Three in less than two years of memory served directly.
We also need to monitor our networks
and understand where everything's come into play.
That's where a scene comes in.
And it really kind of gives us a aspect of our
network as a whole and how it cross analyzes will apply
an IP address to another one piece of equipment over another
and gives us that really holistic view of our entire network.
If we can't fix something, we need to mitigate it,
we can mitigate through different hardware and software ramifications,
we can go through and say, hey, if this vulnerability is there and I can't patch it.
I can't fix it. How can I mitigate it?
Mitigation should be at the top of our list when it comes
to different vulnerabilities that we can't have a direct fix for.
And finally, documentation.
We want to document everything.
If you're an O CD person that loves documenting everything
that you touch, this is probably the best job for you.
We literally have to document as much as we possibly can.
I want you to imagine yourself in a small office with lots of equipment.
A lot of heck going on and you've got just things going on left, right and sideways.
You've got multiple machines, multiple loners, not enough manpower.
You really are trying to put out fires one after another.
And part of that is documentation
because with proper documentation,
I can figure out what another technician did even if they
were gone for six months or a year or even yesterday.
This is the problem that we see a lot as
a cybersecurity analyst is a lack lack of documentation,
meaning that they'll write down everything they did.
They don't document, hey, the IP address that associated with this.
I did this. If I did this,
then I need to document it.
Documentation really is one of the most profound things
that you can do as a cybersecurity analyst.
And as you go higher and higher in your career field,
you need to document more and more we need to document in detail.
Now, I could beat this horse dead until it was dead 100 times.
But documentation, documentation,
documentation is one of those things that you need to do as a cybersecurity analyst.
Throughout this episode, we talked about risk management very briefly.
Uh But we also talked more importantly
about how it intersects with vulnerability management.
Vulnerability management is really at the core
of what a cybersecurity analyst does.
We find vulnerabilities and we attempt to fix them?
If we can't fix them, we mitigate them. If we can't mitigate them,
then we've got some problems.
This is where your job as a cybersecurity analyst really
comes into play where the meet meets the keyboard.
And I don't mean that figuratively you are really going to be pounding that
keyboard a lot in your job as a cybersecurity analyst for CYS A,
what do you really need to know?
You need to understand everything that
we discussed about vulnerability management?
You need to understand if I've got different vulnerability levels,
why do I have those vulnerability levels?
Where do they come into play? How can I fix those?
How do I take those ramifications versus impact versus
threat versus risk and put them into one bundle
if you need to,
I would rewatch this video several times if you don't
clearly understand it when it comes to vulnerability management.
Cys A takes it very seriously. This video was somewhat short and
that's all it really needed to be.
But you need to understand the core concepts of vulnerability management.
When it comes to your exam,
you should expect to see questions about the CBS S score and how that
intersects maybe even a prioritization list for
a different drag and drop scenario.
Expect scenario based questions talking about
the different vulnerabilities and what you
could do based on something that may happen in your network.
For instance, it wouldn't be out of the question to see something where, oh, well,
you can't patch the machine because you're using
old legacy software.
How would you uh or what would be the most appropriate
action for you as a cybersecurity analyst to solve this problem?
Obviously, we don't want to mitigate it as much as possible.
Don't expect to see a lot of technical questions that come into play.
You're not gonna see questions like,
oh, well, you know, it's legacy software.
So you need to add an I DS and a firewall and a router.
But do expect to see questions that are high level.
Talking about what factors you should go into. Should I mitigate it?
Should I maybe do risk transference?
What could you do as a cybersecurity analyst to
solve that specific problem at a high level?