- So welcome to lesson six,
explain common threat vectors and attack surfaces.
In lesson six, one,
we're gonna focus in on operational threat vectors,
but we're gonna start with describing
what do we even mean by a threat vector?
A threat vector, which is also sometimes called
an attack vector, is any potential pathway
or scenario that can be exploited.
The common threat vectors include
malicious emails and phishing attacks,
or weaker stolen passwords, or drive-by download attacks,
or web applications, or out-of-day applications or devices,
or even exploiting trusted relationships.
An attack surface is the sum of all of our threat vectors.
So again, the threat vector is any potential pathway
or scenario that can be exploited,
and the attack surface is the sum of all threat vectors.
So in this lesson, we're gonna focus in
on operational threat vectors.
Now, operational threat vectors manifest
in our day-to-day activities or day-to-day operations,
and they generally related to a lack of internal controls.
Now, examples of operational internal controls
are things like policies and standards,
risk management, training and education,
third-party due diligence,
segregation of duties, and monitoring.
The number of these controls
we have not yet talked about in this course,
but don't fear, we will be talking about them at some point.
Okay, so a reminder, a threat vector
is a potential pathway or scenario that can be exploited.
So let's do a quick survey
of what these different potential pathways or scenarios are,
and then we're gonna dive into each one of them.
So default credentials, weak permissions,
data exfiltrations, open service ports,
unsupported systems and software,
shadow IT, unsecure networks, and vulnerable software.
These are all potential pathways or scenarios
that can be exploited from an operational perspective.
So let's take a look at each one of these,
starting with default credentials.
So what's the issue?
Well, default credentials are the ones
that are initially set up by the vendor,
and many hardware devices and software applications
come and ship with the default or built-in credentials,
and generally, that's gonna be
an administrative username and password.
So if that name, username and password is known,
what can happen?
Well, unauthorized access and compromise,
and it becomes a pathway to pivot to other devices.
Sometimes we're like, well, it's not a system
we really care about securing that much,
but remember that our attackers do a lot of pivoting.
They might come to a less secure system
to get to a more secure system.
And for sure, a quick search on the internet
will usually reveal default credentials
for a specific product,
so we never wanna be using the default credential.
Why might we use it?
Convenience, forgetfulness,
that it's really available and out there,
and sometimes just plain old laziness.
So response, we wanna be changing
or disabling default credentials.
We never wanna be using default credentials.
Next up is weak permissions.
Now, weak permissions are those
that allow for unnecessary access.
That could be to a device, an operating system,
an application, or the cloud.
The impact, well, if we have weak permissions,
we could have unauthorized access,
access violations, privacy violations.
Why do we end up with weak permissions?
Often it's a lack of understanding.
Sometimes it's poor classification.
We haven't classified our data correctly,
or maybe not even at all.
And sometimes it's just overconfidence.
It's like, no, everybody will be fine.
They can go ahead and do that.
I hear that a lot in the fields
where someone says, oh, I wasn't sure
what rights to give them,
and they're always coming back for more,
so I just gave them administrative rights and permissions.
It's like, no, no, no, that's a bad idea.
So our response, we wanna have documented policies
and procedures, we wanna educate management,
we wanna have configuration management,
and we wanna have good standardization.
Next up is data exfiltration.
Now, data exfiltration is the inadvertent,
accidental, or intentional transmission, transfer,
or retrieval of data that's in violation
of a security policy.
So it's something that you're not supposed to send out.
Let's say it's a customer record,
and that customer record has a social security number.
You're never supposed to email that, but you do.
So that would be a form of data exfiltration.
Now, the impact, we can end up with unauthorized disclosure,
a data breach, regulatory compliance violations.
Why does this happen?
Well, it could be incorrect labeling or classification.
Very often, it's user error.
It could be accidental data
that's been included in a document.
I just worked on a case not that long ago
where a spreadsheet, an Excel spreadsheet, got sent out.
It had a lot of very personal information in it,
but all of those columns had been hidden.
So the person who actually emailed it out
looked at it and said, oh, this is fine.
There's nothing in there that would prevent me
from emailing it out through our system.
But in fact, in those hidden columns
was some very, very personal information.
And of course, malicious activity,
like an APT, an Advanced Persistent Threat,
is sometimes will result in data exfiltration.
So our response, good data classification controls.
We'll be talking a lot about classification later on.
DLP, data loss prevention monitoring,
having good firewall rules, user education,
having non-disclosure agreements, and log reviews.
Next is open service ports.
Our issue, our open service ports
are ports that are those in listening mode.
Now, if a port's gonna be in listening mode,
that means it has to have something tied into it
in the system, like an application or a utility.
So the impact could be exposure, potential exploit,
unauthorized access, denial of service,
or even problems with the integrity of device management.
Because one of the really big problems
about having these open service ports that aren't necessary
is that nobody's paying attention to them.
So why might we have these?
Well, poor non-existent configuration management,
not implementing the principle of least functionality,
unrestricted permission to install a device or software.
Our response, configuration management,
and we've talked about that earlier,
ongoing system hardening, which we will be talking about,
account restrictions, which we will be talking about,
and vulnerability scanning to identify these open ports
and associated services.
We have unsupported systems and software.
This is a really significant operational issue.
And there's two components to it.
It could be that we have unsupported systems and software
because we have the unauthorized installation
of devices or software.
So it wasn't authorized,
so no one's paying attention to it,
so we don't have vulnerability management,
we don't have patch management,
we don't have configuration management,
we're not including it in our assessments or in our audits.
Or, and this is a really common one,
more common than it should be,
we could be running systems or software
that have reached their end of life
or their end of support.
End of life means the product is now obsolete
and there's no more features
or functionalities being developed.
End of support means that there's no longer any support,
including vulnerability management,
meaning no more patches.
So the impact, unauthorized access,
exploits, compatibility issues,
downtime, and we can have license violations.
Why does this happen?
Often it's because of a lack of centralized control,
it may be because there's local administrative privileges
on the local workstation,
could be for end of life and absence of refresh policies,
could be budgetary constraints
or just a lack of understanding
of why we should not be using products past end of life
or at very least past end of support.
Response, configuration management,
permissions management,
having refreshed policies and standards,
resource management,
and certainly budget allocation.
Next we come to Shadow IT,
which I mentioned very briefly in an earlier lesson.
Shadow IT is the use of on-premise or cloud-based resources
that bypass the IT department.
So how does that work?
Well, let's say I'm in the HR department
and I really wanna have a new application
for doing performance reviews.
Now, pre-cloud, right,
I would have probably had to go look for one
and then I would have brought the IT in during the demos
and then when I actually bought it,
the IT team would probably set up the server
and manage or co-manage the application.
But now what can I do?
Well, I go out and find a software as a service
or a SaaS application, right,
go out probably port 443
that I have the rights to go out to,
all I have to do is maybe pay my monthly fee
and I never have to involve IT whatsoever.
Well, that's convenient,
but the bad news is all of those various controls
that IT would probably put in place,
I've bypassed and that's a danger of Shadow IT.
So the impact could be the violation of security policies
like authentication or encryption or doing backups.
The causes, well, availability now
of cloud-based software as a service,
the sense that controls are onerous
and or that IT is hard to work with.
So there's a determination to really kind of bypass IT.
Now that could be using cloud
or that could be just setting up their own devices
inside a department and saying,
I'm just not gonna get IT involved
because the controls are gonna be putting on
are just so difficult or IT is so difficult to work with.
The response, user education for the cloud
using what's known as CASBs,
cloud access security brokers,
having firewall rules, having a log review
and having accounting audits.
But user education is probably number one on this list.
And that my friends brings us to a three second challenge
about operational issues.
The unauthorized removal of digital data.
What's the term we use to describe that?
One, two, three.
It's gonna be data exfiltration.
Question two, credentials that are initially set up
by a vendor.
One, two, three.
Those are the default credentials
and we know we always wanna change them
or not use them, disable them.
Question three, a potential pathway that can be exploited.
One, two, three.
That's a threat vector.
Number four, the use of cloud-based applications
and services that bypass the IT department.
One, two, three.
It's what we just talked about.
That's Shadow IT.
And lastly, number five, the sum of all threat vectors.
What do we call the sum of all threat vectors?
One, two, three.
That's our attack surface.
All right, ready to do a security in action.
This one's about operational threat vectors.
You've been asked to make a presentation
about the root cause or causes
of successful operational exploits.
What would you stress?
So we've looked at a whole pantheon
of different operational threat vectors
and you need to make a presentation about the root cause.
So not about the threat vectors themselves necessarily,
but about the root cause
of successful operational exploits.
So what would you stress?
Go ahead and put me on pause, write down some notes
about those root causes
and what you're gonna stress in that presentation
and then come on back.
Well, our operational threat vectors manifest
in our day-to-day activities
and they're generally related
to a lack of internal controls.
So root causes include things like
an insufficient understanding and awareness
at all levels of our organization.
Maybe having a weak security strategy and policy
and having poor auditing practices,
meaning that we're not looking to see what do we have,
right, we don't have those assurance activities
that will tell us that we have the right controls in place.
You know, very often operational threat vectors happen
because folks are so busy doing whatever their job is,
right, they're being a clinician,
they're being an attorney,
they're, you know, being a designer
that they don't think about
some of these operational threat vectors
but it's your job and my job as cybersecurity practitioners
to really keep an eye out on these
and make sure that we have, you know,
a good security posture in our organization
and we don't let these operational threat vectors
kind of open us up to any kind of harm.
And being able to do that, my friends,
is security in action.
That brings you to a pretty big word cloud.
Make sure that you can speak to
all of these different issues,
that you understand why they could potentially
cause problems for an organization
and a good understanding of what we're gonna do about it.
I recognize that a lot of the things I said we could do,
right, in response, we haven't talked about yet
but never fear, we will be talking about
all of them in this course.
All right, when you're ready,
I'll see you at the next lesson.