house
[Music]
okay everyone we're gonna go ahead and
get started thank you so much for coming
to the talks title of the talk today is
click here to end the world navigating
the vulnerability half cycle so just a
quick intro my name is Jonathan Rogers I
work as a cyber security analyst and
awareness specialist if you care about
my social they're up there please
connect with me
so the just a quick overview of the
agenda today we're going to first talk
about what a vulnerability half cycle is
and how we get there we're going to talk
about an example about a time when I got
stuck in that hop cycle then we'll talk
about where to start
how do we assess vulnerabilities and
assess the threat they could cause how
do we translate that to risk for our
business and for our organization we'll
talk about some helpful resources on
this topic
so when I started in cyber security as a
noob trying to figure out this whole
cyber security thing and trying to
transition into cyber security I had
some thoughts and the thoughts I had was
number one I know attackers are going to
attack
I thought number two I'm gonna have to
deal with some alerts
number three we're gonna make some
improvements hopefully security gets
better that should be the goal of any
security program
gold any security program key we should
mature the security culture in our
organization
and then I thought I'll have to deal
with some vulnerabilities
but not too many
that was a cute thought
because the fact was
I learned I was wrong
I had to deal with a lot more
vulnerabilities on a daily basis tonight
really thought I'd have to deal with
and I was in this Mad Dash all the time
there was a new vulnerability oh crap
new vulnerability oh crap and I'm trying
to figure out all the time what do I do
now
I'm a numbers guy I like to know
statistics is this just me being an
idiot thinking everything's the world
ending or are there a lot of
vulnerabilities happening out there well
let's look at some numbers around
vulnerabilities
first of all Mania reported for last
year there were 55 exploited zero days
that number was down from 2021 but it's
still triple of what it was
in 2020.
Coalition which is a cyber security
insurance company they
did what cyber security insurance
companies do tried to protect their
bottom line they estimated for 2023 that
there was going to be a total of 1900
cves per and I'm sorry I didn't type
that out correctly it should be per
month in 2023
if you go to cvedetails.com right now
and look at what the total is for 2023
as of today I'll look this number up it
is
6994. you divide that by three because
we're still in March that comes out to
over two thousand so we are above that
1900 Mark right now so the numbers show
we as Security Professionals are dealing
with a lot of vulnerabilities on a
regular basis
now the question though
what do I do and how do I deal and
really I'm a visual guy I can visualize
things and how this happens when we get
vulnerabilities a lot of time you get
alert like this oh there's a
vulnerability oh crap there's another
one Microsoft what the crap are you
doing
oh there's another Fortinet
vulnerability oh God crap crap crap crap
and now I've got to investigate these
try to figure out what's going on
I've got people freaking out because
they've seen the news that the hackers
are going to break in and destroy
everything what do we do
and they're reaching out to me so now I
have to figure out what do I do with
this vulnerability
and
surprisingly the world keeps turning and
I have other things to do besides
dealing with vulnerabilities that are
important to the security of my
organization and then I've got
leadership looking at me saying what do
we do about these vulnerabilities so
I've got to figure out how do I handle
these vulnerabilities and with all this
vulnerability related stress sometimes
at least in my mind this pop-up should
probably appear
because I'm overloaded I'm stressed out
how do I handle
all these vulnerabilities
let's talk about an example of how this
happened to me some of you will probably
remember this last October 2022
the open SSL team pre-released of
vulnerability because apparently that's
a thing now and they came out and said
and I wish they wouldn't have because it
it freaked me out
they're like they said oh there's a
vulnerability we're gonna disclose and I
think it was two weeks on a Tuesday and
it's a critical vulnerability
and I was battening down the hatches
because in my mind this is another heart
bleed this is going to be the end of the
world oh crap
so I was a lot like this
well then
the vulnerability was released and they
downgraded one of the vulnerabilities
and then I was like this but here I was
stuck in this hop cycle just freaking
out because oh we're voting there's this
vulnerability what do we do about it how
do we handle it
and then I realized something if I keep
living like this I'm gonna die of an
aneurysm
how do I handle all these
vulnerabilities
that's the question we've got to handle
answer excuse me is how do we handle
these vulnerabilities because the fact
of the matter is how we deal with
vulnerabilities as an information
security professional
has the potential to make or break us
and you say Jonathan you're just being
hyperbalist no I'm not because numbers
show
threat scope did or excuse me threat
connect did a survey last year and found
that 27 percent
of Information Security Professionals
were actively thinking about quitting
their job on a regular basis
and this shows and now I know not all
that's stressed because of
vulnerabilities I wouldn't dare suggest
that but it shows that it's Information
Security Professionals we're under a lot
of pressure
and some of that is because of
vulnerability so how do we handle them
well what I want to really get into is
how how have for my myself and
modernization have defeated this
vulnerability hop cycle and ask
meaningful questions that help us figure
out if a vulnerability is
real bad bad or not a worry
so the first thing you need to do is
start with the right questions the
questions to start with are super
important so the questions I like to
start with when I see a vulnerability is
number one are we affected now I know
this seems like a stupid question to
even ask
but sometimes it's harder to answer that
question than we think because what
about something like log4j
how many of you knew what lock for Jay
was and if you had it in your
environment before December of 2021
our people didn't
so sometimes and a lot of times this is
the key question to answer to figure out
are we affected by this vulnerability
and if we are where's that how bad is it
is this vulnerability the second
question I start with is is this
vulnerability being publicly exploited
because that can really play into
my decision of how urgent a thing is
because if it's just Theory nobody's
publicly exploiting maybe we don't patch
it as urgently but if people are popping
it left and right and we're vulnerable
then maybe we take everything down past
this immediately
my third beginning question
that I start with is how Mission
critical are the affected systems
so is this system something that
is used for a really low level thing
or is this
a vulnerable firewall firm firmware is
this something that could if an attacker
exploited this vulnerability it could
cause a total compromise of our
environment that's one of the key
questions I have to ask when I get a
vulnerability and think about because
that'll really help me figure out
how big of a deal a vulnerability is so
we start with the right questions
then we have to really assess the
technical impact
of a vulnerability and this is where the
nerd in me really rejoices because I
love looking at
what a vulnerability entails and how it
can be exploited and that's why I got
into hacking and cyber security in the
first place because that just really
excites me to figure out how we can take
this thing that really doesn't seem
dangerous and exploited
and do some pretty cool stuff
so when we look at this the first thing
I ask is is there a public POC because
maybe it's not public exploited yet but
there is a POC available and people are
going to figure out how to do this
how difficult is the vulnerability
to exploit this is a big one for me
because the we run a certain brand of
firewall that probably won't be hard for
some of you to guess and this brand of
firewall this year has had all
throughout their brains 60
vulnerabilities
and there was one that came out
a couple weeks ago there was a read
write vulnerability
and my boss was a little nervous about
it and he still a little nervous about
it and he asked me he's like is this a
big deal with this you know could they
own our firewalls if they exploited this
and I read the disclosure was going
through thinking about it when I read it
there was a key phrase that I looked at
that said
to exploit this the attacker must be on
the firewall
well if the attacker's already on your
firewall
you're already in trouble
so this is a question that can really
help us because it's like you've got to
be on the firewall or on the end point
then it helps us figure out really where
this vulnerability lies at and how
dangerous it is to us in our
organization
what's the skill level required to
exploit this vulnerability is this
something that's going to take an apt to
do or can any kid with an internet
connection and Powershell figure this
out
one of my key questions
that I ask is
if this vulnerability was exploited
how bad would my day suck
because some vulnerabilities if they're
exploited y'all might they'd be kind of
bad but I could still go get ice cream
later and it'd be okay but some
vulnerabilities if they're exploited
don't talk to me don't look at me don't
touch me
because it would be how bad real bad
and this is one of the key questions
that I have to ask because if I just go
straight to the freak out it's not going
to help anybody myself included but if I
ask well how bad would this be if this
was
exploited how bad would it make my day
then I can really hone in and figure out
oh this wouldn't be this bad or yeah
this could be
a really bad deal for us
some other questions we can ask and I'm
going to kind of
go through these fast some other
questions we can ask we don't have to
ask these all the time but these are
some as I'm thinking through
vulnerabilities that I'll ask at times
does it allow for a remote code
execution is it a zero click
vulnerability is the vulnerability
automatable does it allow
for network access
does it help the evasion of security
controls really what we're trying to do
when we judge the technical impact is
figure out the blast radius if this
vulnerability is popped
how bad would it be
that's what technical impact has to be
about is US judging if this is a big
deal
or not a big deal
and really
this can be where
we shine a lot a lot of light on
a situation and a vulnerability to
understand
what it could do potentially to us and
our organization
now we start with key questions we look
at the technical impact
but the fact we have to know a cyber
Security Professionals
is that those first two things that
we're thinking about
the first three questions looking at the
technical impact when we talk to
leadership about those things
they're probably not going to give a
crap about those things
third they will look at if you go do
leadership and you say
if if this vulnerability is exploited an
attacker will get remote code execution
what are most
Leader's going to look at you and say
is that bad
and it's not like making fun of them
they that's not what they get paid to
think about they it's not what they've
learned they just don't understand what
that is
so
what we have to ask ourselves is what
does leadership care about
what do the executives at your
organizations and my organization what
do they care about what are they
concerned about
and Leadership is concerned about
a lot of things but one major thing
the business
so the question we have to ask ourselves
ultimately when we're dealing with
vulnerabilities
is what is the business impact
we've considered from the technical side
how bad would this make my day
so the question we have to go to next is
to consider how bad
with this vulnerability being popped B
for our business
because the fact is if you go to your
leadership team and you say if this
vulnerability is exploited it will cause
a total shutdown of the company we will
not be able to make money and we will be
down for at least blah blah days
I guarantee they'll probably look at you
and say do what you got to do
why because you've taken a vulnerability
which is this kind of vague thing that
they don't really understand and you've
now made it make sense to them you've
translated it to business impact
that's what they care about
but not only should does leadership care
about business impact
as Security Professionals we should too
I know I really nerd out and I care
about the technical stuff I care about
the protections but ultimately my goal
should be to protect the business
why
because if the business ceases to exist
I'm looking for a job
and that's what we were hired to do is
take care of the security
of the business
this has to be one of our top drivers
and I know sometimes we can get there
and we get in this kind of monotony
where it gets old
but we have to remember why we're there
and what we've been hired to do we've
been hired to keep the business safe
to keep leadership informed and
ultimately keep our end users protected
now do you want to mention some helpful
resources
that are out there
the first one is by Paul acidorian he
really walks through
not only the half cycle and how it
really occurs but he talks about more
how vulnerabilities turned into what we
would call Forever days
the second one is a lot of the questions
I've talked about it's a really good
article third one is another good
article just talking about that the
fourth thing I do want to mention I want
to spend a brief moment on if you've not
looked at or considered to see it the
cesus stakeholder specific vulnerability
categorization guide I'd highly if you
are in charge of vulnerability
management of your org
I would highly recommend you take a look
at that that is a really good guide I
know that's kind of shocking cease to
put out something good but they've been
doing better these days
it's like Monty Python they got better
so check that out one thing in there
that I would encourage you to look at is
I know a lot of us are visual people
and one of the things in there is
something I'll show you next this may be
hard to see but it is in that guide this
is a flow chart where you start with the
vulnerability you go through answer the
questions
and then it will help you quantify how
bad that vulnerability is this is a
really good chart this can be really
really helpful for you and your
organization this can be a good way if
you don't have a way if you're a like a
me and my teammate that's here if you're
a small team in cyber security
uh that's handling cyber security for
your org this can be really helpful to
help you figure out what's going on and
help you protect your org
so wrapping it up
vulnerabilities are going to happen
we can get stuck in this vulnerability
hop cycle but we can also defeat it how
do we defeat it we ask the right
questions
we determine the technical impact
and we translate the vulnerability to
real business risk and impact
thank you all for attending today
six minutes if anybody has any questions
if not thank you
foreign
[Music]