So we know what's important to us
and we know where we have some weaknesses.
Now we need to identify what are the actual threats to them
compromising our systems?
What are the threats that exist internally as well
as externally?
And then we need to analyze what are the real costs
and risks associated with that.
That's what this Nugget is all about.
We're going to be talking about the threats themselves,
setting us up for the upcoming Nuggets, where we actually talk
about common attack methods.
Let's get going.
So we've identified what's important to us.
And we know what our weak points are. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we know what our weak points are.
But now what's the real threat?
What's the real attack that's going to be used against us?
That's what we need to identify next.
What's the real risk associated with this?
And we're going to categorize these upfront.
Whereas before, we talked about them abstractly
and then talked about how we could classify them.
Now we need to start the threat analysis
with an assessment or a classification, so to speak,
of where they begin.
And the first thought, just like we talked about before
with people, guess what?
Our first real threat could come internally. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Our first real threat could come internally.
And this doesn't necessarily mean it happens intentionally.
People could print something that's sensitive
and accidentally forget about it and leave it on the printer
so that somebody can come along and pick it up.
Or people could click on a link with the best of intentions,
but that link ends up downloading malware.
And again, it falls back to what are our vulnerabilities
and what are the assessments there?
But sometimes internal actors do act
with the worst of intentions.
This recently just happened, where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This recently just happened, where
Cisco had an employee quit, log into Cisco's AWS, Amazon Web
Services environment, and delete virtual machines out of AWS
that caused their Webex Teams product to go down
and lost tens of thousands of in customer accounts.
And it cost Cisco $2.4 million.
This was a software engineer within Cisco
who had access to this environment
and took that privilege home with him so WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and took that privilege home with him so
that when they quit, they enacted some sort of event that
actually deleted actual virtual machines and actual data out
of the AWS environment.
Now that person, as you can see here, pled guilty
and is looking at probably some jail time and some bad stuff
too.
But know that your first threat really comes internally.
Now if internal is the first threat, then obviously,
external and hackers themselves are
going to be the next threat.
But there's many different types of hackers.
There's different shapes and sizes to them.
The black hat hacker, this is the traditional hacker WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The black hat hacker, this is the traditional hacker
that you're thinking of here, their motives
are to do something bad to somebody else.
Maybe they want to break into somebody's personal computer
and steal their information, or use their webcam.
Maybe they want to break into a business
and encrypt the data there, holding
the business for ransom.
Whatever it is, these are the bad guys.
Black hat hackers are the bad guys.
White hat hackers are the good guys.
And I know you may be thinking like, wait a minute.
What hacker?
How could that be a good guy?
There are actual professions out there,
pen testers, who are hired by businesses in order WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
pen testers, who are hired by businesses in order
to actually attempt to hack them and find out
where their vulnerabilities are in the first place.
Now here we've identified them as white hat hackers.
But their actual job profession is usually
something like penetration tester,
or pen tester for short.
They could also be called an offensive security
professional.
Or sometimes they are just called white hat hackers.
The point is, if you're wondering
how much a hacker gets paid and you're
going to go look for job titles, you probably
want to start off with penetration testers,
or something like that.
Now grey hat hackers are somewhere in between. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now grey hat hackers are somewhere in between.
Maybe you're interviewing them and they
say they have the best of motives
but you're just not sure.
Maybe they've done some bad stuff in the past.
It's best to avoid grey hat hackers because you're just not
totally sure where they're going to go with this.
Now the suicide hacker is someone
who knows they're going to do damage
and they don't care if they go down in flames with it.
You could probably make, honestly,
a pretty good argument that this person here--
I know there's writing all over my screen--
that this person here was a suicide hacker.
Because there's no way you're going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because there's no way you're going
to delete hundreds of VMs out of Cisco's AWS
and get away with it.
But here we go.
That's what the suicide hacker does.
They're going to hack.
They're going to cause damage.
And they don't care if they go down fighting.
The script kiddie is someone who is brand new to hacking
and they don't have the expertise to actually perform
a hack themselves.
So they take somebody else's script,
like a Python script or a PowerShell script that
performs bad things, and they just
run the script to see what it does.
The cyber terrorist kind of lives up to the name.
Their sole mission is to actually cause terror and harm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Their sole mission is to actually cause terror and harm
to an organization.
You could make the argument that when
we're talking about in a previous Nugget someone who's
trying to attack an actual electrical field,
an actual electrical power company, or a manufacturing
plant, someone who's trying to cause real terror
and damage, physical terror and damage,
that would be a cyber terrorist.
A state sponsored hacker is someone
who is hired by the government to hack another government.
This happens way more often than anyone cares to admit.
But pretty much every first, second, and many third world WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But pretty much every first, second, and many third world
countries have a state sponsored hacking organization
whose sole goal is to spy on others governments
by hacking with them.
And the hacktivist is someone who
is performing hacks or leaks of data and information
in order to fulfill what they believe is a noble cause.
When you hear about WikiLeaks or BlueLeaks,
this is typically what they're talking about.
Someone who believes that exfiltrating that data
and information, and leaking government
classified information, they believe that what they're doing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
classified information, they believe that what they're doing
is exposing some truth or some justice in the world.
So this sets up the internal threat and the external threat.
But there's another category of threat that both of these
contribute to, which we're going to bring up here.
And that's physical threats.
Both internal and external threats
have the ability to take down our systems.
They can cause data corruption, they can exfiltrate data,
they can harm people, and they can even
harm our systems themselves.
If somehow or other a hacker were WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If somehow or other a hacker were
to get into our power grid and power monitoring systems,
maybe through the usage of IoT, which
is where one of our top vulnerabilities actually lives,
they could actually send surges into our power systems,
frying them all.
Even redundancy can't help you then
because now we've fried all of our systems.
So all of this begs the question,
how do we prevent this?
How do we mitigate these threats?
And that's really what the entire point
of this entire course is.
But the gist of it is that there are a bunch
of things that you can do.
First of all, you can have policies in place WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
First of all, you can have policies in place
that stop people from doing the wrong stuff in the first place.
This policy could go hand-in-hand with training.
Letting people know and be aware of what threats exists
so that they don't fall victim to these threats
in the first place is going to be really important.
Next, we have the technical solutions.
These are going to be using things like next gen firewall
systems, intrusion detection and prevention systems,
using web content filters, email security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using web content filters, email security
appliances, and antivirus.
All of these things are technical, physical,
or software based solutions that can help us prevent problems.
But then we can take it a step further
with physical safeguards, things like using locks, or key card
scanners, or camera systems.
Preventing physical access to people who don't need it,
this is a policy of the least privilege.
Wherever possible, we want to minimize people's privileges.
That way they don't have access to resources
they don't need and can't cause harm in those areas. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they don't need and can't cause harm in those areas.
Then, of course, there's networking solutions,
things like using the correct protocols,
the correct ACLs, and the list goes on and on and on.
And the temptation is for me to keep going on and on and on.
But really, that's what the rest of this course is all about.
At this point, we've identified our assets,
our vulnerabilities, and our threats.
In the next few Nuggets, we're going
to talk about common attack methods
that hackers may try to use against us.
I hope this has been informative for you.
And I'd like to thank you for viewing.