- Welcome to Lesson 7,
Explain Various Types of Vulnerabilities.
In Lesson 7.1, we're gonna start off
with a Vulnerability Primer,
really just getting an understanding
of what a vulnerability is,
and how we manage vulnerabilities.
And then in the next lesson,
we'll dive deeper into specific types of vulnerabilities.
A vulnerability, which I know we've defined multiple times,
but we're gonna do it one more time, is a weakness, right?
It's a weakness in hardware, and software,
and people or processes can also be a a weakness
in infrastructure or a building.
Now, vulnerability in and of itself
doesn't pose the imminent danger.
Rather, the fact that the vulnerability
is the gateway to an exploit.
The fact that we have a vulnerability is the gateway
for our threat actor to exploit us.
Now, there are different types of vulnerabilities,
there are network vulnerabilities,
operating system vulnerabilities, process vulnerabilities,
and people-oriented vulnerabilities.
Network vulnerabilities are weaknesses
within organization's hardware or software infrastructure.
Operating system vulnerabilities are code weaknesses,
sometimes we refer to them as bugs which can be exploited,
and, or could be operating system misconfigurations.
Process vulnerabilities occur
when there is a security exposure
within a particular process.
And human vulnerabilities are the result of human error,
inattention, unintentional, or accidental actions,
or from an organization's perspective,
it could be the result of inadequate vetting,
training, and oversight.
Now, we need to know about vulnerabilities,
and we trust the organizations that we do business with
that they will in fact let us know
when the hardware, or the software,
or device we're using has vulnerabilities.
And the process of disclosing vulnerabilities
is referred to as ethical disclosure.
Ethical disclosure is a practice of publishing information
related to a vulnerability or a finding.
Now, the purpose of vulnerability disclosure
is to inform others of potential risks,
so that they can make informed decisions,
and take appropriate action,
and there's really two different ways
to approach ethical disclosure,
full disclosure and responsible disclosure.
Full disclosure is making all details public
without regard to harm that may be caused to others,
including exploited by adversaries,
where responsible disclosure
is making just enough information known
so informed decisions can be made
while not releasing details
that could be useful to an adversary.
But there's really a fine line between the two,
because when you're doing responsible disclosure,
which at first sounds like,
well, that must be the way to go,
what if you aren't releasing all the details
or enough details I should say.
Enough details so that someone
really can make a good decision.
So fine line,
a lot of discussion in the industry
about full disclosure versus responsible disclosure.
Now, vulnerability management
is the process of identifying vulnerabilities,
assessing vulnerabilities,
reporting non-vulnerabilities, prioritizing vulnerabilities,
and then ultimately mitigating vulnerabilities.
The goal of vulnerability management
is to reduce the risk of our security breaches,
and minimize the potential impact of any vulnerabilities
that have been identified.
The vulnerability management is not a set and forget,
it is absolutely an ongoing process
that requires continuous monitoring
and updating as new vulnerabilities are discovered
or new threats emerge.
And those are both happening all the time.
New vulnerabilities are continually being discovered,
and new threats or potential dangers are emerging.
Now, there is a particular type of vulnerability
that we need to be aware of
known as a zero-day vulnerability.
A zero-day vulnerability is a flaw
in hardware or software that's been discovered,
but a fix is not yet available.
Now, a zero-day exploit is a method
that really weaponizes that discovered vulnerability.
And very often,
that vulnerability is not gonna be discovered
by the good guys,
it has been discovered by the bad guys,
and we don't even know that that vulnerability is out there,
but they can develop their exploits.
So the term zero-day really implies
that there's no time between when the vulnerability
is known to developers,
and when it's exploited by the adversaries,
because it's probably already being exploited.
The time from when an exploit first becomes active
to when the number of vulnerable systems shrink
to a really insignificant number
is known as the Window of Vulnerability.
Now, what would make that shrink?
Well, it would be once our developer
or manufacturer can release a patch,
but zero-day vulnerabilities are very, very dangerous.
And oftentimes while we're waiting
for a patch to be released,
we have to make some really serious decisions,
like shutting the system down,
or what other compensating controls we can put in place.
So let's look at a timeline for a zero-day vulnerability.
The weakness or the vulnerability is discovered.
More often than not,
it's gonna be discovered by our adversaries.
Now, it could be discovered by a security researcher,
or maybe a part of a, you know, a bug bounty program.
But generally speaking, it's really our adversaries
who are discovering these weaknesses.
The adversary or the attacker will create the exploit code.
We still don't know that it's happening.
The exploit code becomes available.
So it may be that the attacker sells it,
or maybe puts it out there in the dark web
or decides to use it themselves.
And then they've been exploiting us.
So now that exploit, it's in the wild, right?
It's out there happening, is identified, right?
We know that we're being attacked,
and so that exploit is identified,
but there's still no fix available.
So that's when we're going to have
to make some tough decisions
about do we keep our system active?
Should we shut it down, right?
Or are there compensating controls
generally in a temporary basis
that we can implement to help protect our systems?
And then ultimately,
the developer will release a patch or a fix,
or the manufacturer release a patch or fix,
and we can then repair our system,
so that we are no longer vulnerable to that zero-day attack.
And that, my friends, brings us to a 3-Second Challenge.
You know how to do it.
Five questions, three seconds each, let's do it.
A weakness in a hardware, software, people or processes.
One, two, three.
That is a vulnerability.
Number two, an exploit that's know,
but does not yet have a fix.
One, two, three.
That's gonna be our zero-day.
Number three,
the time from when an exploit first becomes active
to when the number of vulnerable systems shrink
to an insignificant number.
One, two, three.
that's gonna be the Window of Vulnerability.
Number four, the practice of publishing information
related to a vulnerability to assist others.
One, two, three.
That is ethical disclosure.
And lastly, number five,
the process of taking advantage of a vulnerability.
That's known as a?
One, two, three.
That's exploitation or an exploit.
Let's do a Security-in-Action
so you can apply your knowledge
about a zero-day vulnerability.
Your organization has just learned
that one of your applications has a zero-day vulnerability.
A patch is not yet available,
and publication day is still to be determined.
So here's the question for you.
In the meantime, are there any steps you can take
to mitigate the impact of the vulnerability?
So there's a zero-day vulnerability, it impacts you.
We assume it's probably pretty serious.
A patch isn't available yet,
and we don't know when a patch is coming.
So anything we can do to mitigate the impact
of that vulnerability.
Go ahead and put me on pause, jot down some notes,
and then come back, and we'll do the response together.
First thing we wanna do
is we wanna notify relevant stakeholders.
So anybody who's potentially impacted by this,
we wanna put them on notice.
Then we wanna determine the severity of the vulnerability,
and we're gonna prioritize our response
based on the risk and the potential damage.
It may be really, really significant, it may not be,
but we need to really do our analysis to determine that.
And then we can implement temporary measures
to mitigate the vulnerabilities.
So for example,
we may decide to isolate the affected system or service,
maybe disable any unnecessary features or services,
or we might wanna implement temporary compensating controls.
And then up until the time we get that patch,
we're gonna continuously, really laser-focused,
monitor the system for any suspicious activity
that could indicate an attack
or exploitation of the vulnerability.
Doing that, my friends, is Security-in-Action.
There's your word cloud, there's a lot there,
make sure that you can really speak
to all of these terms before you go on.
If you're struggling with any of them, go back,
they're all in the lesson.
When you're ready, I'll see you the next lesson.