- Welcome to lesson 16, Deep Dive Quiz.
The lesson 16 was all about explaining various activities
that are associated with vulnerability management.
We had two lessons, 16.1, vulnerability identification,
and 16.2, which was vulnerability response and remediation.
So let's do a five-question quiz together.
Are you ready?
Make sure you have pen or pencil and paper,
can put me on pause as often as you need to
so you answer the questions.
All right, let's start our quiz.
Which site would you access to get information
about the common vulnerability scoring system or the CVSS?
Nvd.nist.gov, owasp.org,
cve.org, or aicpa.org.
Where are you gonna go?
We wanna get information
about the common vulnerability scoring system, the CVSS.
Put me on pause for a moment if you need to
while I think about it.
Well, the CVSS is maintained by NIST
and it's part of the NVD,
the National Vulnerability Database.
So we're gonna go to nvd.nist.gov.
OWASP great place to visit, right?
OWASP is a nonprofit organization that developers
and coders and webmasters
and technical folks all contribute
to, really with the goal of making web applications
and mobile applications more survivable,
more robust, more secure.
cve.org, that's where we're gonna go and find those CVEs.
Another great place to go.
And the AICPA
is the American Institute of Certified Public Accountants.
Probably not relevant to our question here.
So nvd.nist.gov.
Like it.
All right, let's try it, and that's correct.
Time from when an exploit becomes active
to when the number of vulnerable systems is insignificant.
It's this end-of-life, EOL, a zero-day, time-to-fix,
or the window of vulnerabilities.
So this is a time from when the exploit
is out there and being active
to when there's just very few systems to exploit
because they've been patched.
What is that timeframe called?
End-of-life, zero-day,
time-to-fix or window of vulnerability.
Put me on pause if you want.
Well, I'm gonna choose window of vulnerability, right?
End-of-life is the end of life.
It's when a device
or a software or subscription becomes obsolete, right?
Zero-day is when we have a vulnerability
that there's been no time for the developer
to issue a patch yet.
Time-to-fix, T2F is a made-up term really.
Window of vulnerability is what we're looking for here.
You agree?
Let's check, and that is correct.
All right, we're gonna match decision states here.
On the right-hand side, we have true negative,
true positive, false positive, and false negatives.
On the left-hand side,
we have normal activity is incorrectly identified,
abnormal activity is incorrectly identified,
normal activity is correctly identified,
and abnormal activity is correctly identified.
So let's start with normal activity.
So everything's okay, is incorrectly identified.
You wanna put me on pause, go ahead and do that.
All right, let's try this.
Normal activity is incorrectly identified
as being abnormal or problematic,
that would be a false positive.
Abnormal activity is incorrectly identified.
Again, the keyword here is incorrectly, right?
Incorrectly identified.
That's gonna be a false negative.
Normal activity is correctly identified.
That's cool, that's a true positive.
An abnormal activity is correctly identified,
that's a true negative, right?
So we have normal activity
is incorrectly identified, false positive.
Abnormal activity is incorrectly identified,
a false negative.
Normal activity is correctly identified,
a true positive.
And normal activities correctly identified,
a true negative.
Agree?
Let's check it out.
And that is correct.
Okay, our fourth question.
While conducting an authorized penetration test,
a colleague identifies a significant vulnerability
in a very popular social media app.
What would you recommend they do with this information?
Nothing.
Why cause trouble, right?
Notify CERT CC.
Report it to the app publisher
and also check to see if they have a VRP or a bug bounty.
Maybe there's a reward.
Or make an immediate full public disclosure.
What are you gonna recommend?
Well, I'm gonna recommend that the first thing
they do is they report it to the app publisher.
And why not check to see
if there's a vulnerability reward program or a bug bounty?
Why not get the reward if it's there?
But the first thing you wanna do is you wanna go
to the publisher or to the manufacturer
if it happened to be in a device.
Doing nothing, well then everybody else
is still at risk and you have knowledge,
it could really help them.
Notify CERT CC, when would you do that?
Well, let's say you report it
to the app publisher once, twice, three times.
Make the emails get lost, you try to call them as well.
You don't hear from them.
That's the time to notify CERT CC.
Make an immediate full public disclosure.
Again, you really wanna give the publisher the ability
to you know, understand the vulnerability and issue a patch
because when you make an immediate full public disclosure,
you're also making a disclosure
to our adversaries, and you're saying,
"Okay here's something that you could exploit.
Go at it."
So you don't wanna do that either.
So I'm gonna say, report it to the app publisher
and check to see if they have a VRP.
And that's correct.
All right, we are going to match
the patch update classification here.
On the left-hand side, we have security updates
update rollup, driver update, and feature packs.
On the right-hand side,
we have a cumulative set of updates and fixes,
update files that regulate a device,
provide new functionality
or fixes security related vulnerabilities.
So I wanna be able to match
these four different classifications of patches.
Definitely put me on pause for a moment
if you wanna match those up.
Okay, a security update.
Well, as we go through here,
hmm, a security update is really what fixes
security-related vulnerabilities.
And remember, there's classifications within that.
You might see critical, high severity,
medium severity, low severity.
Update files that regulate a device.
Well, what are the files that regulate a device?
Well, that's a driver.
So that's gonna be a driver update.
Provides new functionality.
Oh, that must be some new features.
So let's look at feature pack.
And lastly, an update rollup.
So putting a bunch of updates together,
that's gonna be a cumulative set of updates and fixes.
So security update fixes, security related vulnerabilities.
And update rollup is a cumulative set of updates and fixes.
Our driver update, updates of files that regulate a device.
And feature packs provide new functionality.
Is that what you had?
Do you agree?
Let's check.
And that is correct.
Awesome, another great job.
Up next, we're gonna go
into lesson 17 to explain security alerting
and monitoring concepts and tools.
Another one of my favorite topics.
I'll see you there.