Now that we understand what's important to us, what
are assets that we're trying to protect,
the next thing we have to do before we look
outside to the world where there's hackers,
we need to look in the mirror.
What are our vulnerabilities?
Where are we weakest internally?
And we'll talk about what vulnerabilities
may exist within an organization in this particular Nugget.
Let's get going.
So now that we understand our assets,
it's time for us to talk about where are we most vulnerable.
And you can already tell where I'm
going with the very first little picture here.
Yeah, we're starting off with people again. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yeah, we're starting off with people again.
People, again, honestly, people might be our number one
vulnerability because I believe that people inherently
are good people.
And people are inherently nice.
And they just want to be helpful.
So when they receive a spam email asking for help,
their response to that might be to help.
Or when somebody comes in dressed like an AT&T employee,
they might just trust them and believe
that they're an AT&T employee without checking
with anyone first.
We're going to talk more about that when
we get this social engineering.
But that is a real life scenario that I'm talking about too. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But that is a real life scenario that I'm talking about too.
So what we need to do when we're assessing how vulnerable we are
with people, we need to talk about what policies
do we have in place that enforce how people should behave
in certain situations.
Are they allowed to download bootleg software
in the first place?
And how are we enforcing these policies?
Is this just written down in a document somewhere?
Or are we actually deploying software
and technological resources that enforce these policies when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and technological resources that enforce these policies when
the end users are interacting with technology?
Beyond that, we also need to look at something
like training opportunities.
How many people actually have gone
through some form of training letting
them know what vulnerabilities and attacks exist
in the real world?
What should they expect?
Is it OK to pick up any random USP flash drive that's
just sitting on a park bench?
Probably not.
But do people know that?
Maybe not.
Maybe they pick it up and plug it in and see what it does.
So understand that your first vulnerability, and maybe
your biggest one, is going to be the people, which again, were WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
your biggest one, is going to be the people, which again, were
maybe your biggest asset that you need
to protect in the first place.
In other words, what we're saying is,
focus a lot on people before you focus on technology
because that's who we need to protect
the most at the end of the day.
But moving on, some other vulnerabilities we may have
is within the operating systems themselves.
And I know your gut goes to think about, well, maybe
one operating system is weaker than the other,
or more prone to vulnerabilities.
But at the end of the day, they're
all prone to some form of vulnerability
if you don't patch them.
Patches for these devices come out relatively frequently. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Patches for these devices come out relatively frequently.
Many of them roll out patches as frequently as once a week.
Some of them roll out patches once a month.
But the idea is that they're constantly
updating the threat landscape and pushing new signatures
and definitions down to these operating systems
to protect you against common threats.
So if you have a file server that
hasn't been patched in two years,
chances are you're exposed to a great number of threats.
Of course, you should deploy the patches in a secure manner.
You don't necessarily want to push the patch down WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You don't necessarily want to push the patch down
to your operating systems the moment
they become available because you're not sure
if there would be any adverse reactions to it.
But you should endeavor to patch a test system
when it becomes available.
And once you know the patch doesn't impact you
in a bad way, then you should push it
to your production servers.
Now lastly, I think I have to erase my little drawing here
because we're about to bring up a diagram.
There we go.
Now lastly, vulnerabilities can exist and probably
do exist within the applications we create themselves.
These are different programming languages written here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
These are different programming languages written here
on the screen.
Look, full disclosure, full I'm being vulnerable right now.
I have written some code in the past
when I was first learning to code, that would not
pass a security standard.
Everyone's done it.
Everybody who's written code their life
is probably thinking back to a previous job going,
you know what?
I should probably contact them about that
because that's not good.
This is things like hard coding passwords within your codes,
or not using encryption anywhere.
Software developers, especially new ones, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Software developers, especially new ones,
tend to take shortcuts wherever they can.
And that often comes at the cost of security.
So it's important for us to identify not only what
our vulnerabilities are but also to classify and categorize
them.
Is this a policy vulnerability?
Is it a software vulnerability?
Is the code just poorly designed in the first place?
And does it expose the incorrect protocols?
Would the vulnerability give network access? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Would the vulnerability give network access?
Or would it introduce the opportunity for malware
to be brought into the system?
So that's how you would identify what your vulnerabilities are,
but then classify them yet again.
Now we've got assets identified and classified
and vulnerabilities identified and classified.
In the next Nugget, we're going to talk about the existing
threats to our landscape too.
I hope this has been informative for you.
And I'd like to thank you for.