I'd like you to imagine that you and I are
on a fairly small boat, let's imagine like a rowboat,
and there are some holes we discover in the boat
below the waterline, and water is coming in.
So my question for you is, which hole in that boat should we--
you and I--
focus on first?
And hopefully, we're going to focus on the biggest hole first
because that's where the most damage is
happening to our boat.
Well, that's where the most water is coming in.
So in a security environment, if we
have a compromise or attacks that are happening
or vulnerabilities, we want to know which attack WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or vulnerabilities, we want to know which attack
or which vulnerability is the most severe so we
can focus on those first.
So in this video, I'd like to share with you some tools
and scores that we can look at to help identify which attacks
and which compromises are the most severe
so we can focus our attention on those first.
So here we are once again at us talosintelligence.com,
and I'd like to focus our attention on vulnerability
information, and from the dropdown,
I'd like to click on Vulnerability Reports
right here.
And then other Vulnerability Reports
we have Zero Day Reports and Disclosed Vulnerability
Reports. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Reports.
Let's click on Disclosed Vulnerability Reports.
And then if you're following along,
we click over here on this column
on the far right under CVSS Score,
and I'm going to sort with the highest at the top.
So CVSS stands for the Common Vulnerability Scoring System.
Here I'm at nist.gov.
And if you scroll down a little bit,
it talks about how these scores are calculated.
And some of the major factors are the exploitability metrics
and the impact metrics.
So for AV, for attack vector, how
is this attack carried out, via the network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is this attack carried out, via the network
or via an adjacent network, or is the compromised
implemented locally or at the physical device?
And then for the attack complexity, AC, is it low--
I mean, it's pretty simple-- or is it high complexity,
meaning there's a lot of stuff going on to make it happen.
For privileges, required, PR--
none, low, or high.
So if there's an attack and it requires admin privileges
to pull this attack off, this malware, the privilege required
would be H. So it'd be less severe if it required admin
rights to pull off the attack. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
rights to pull off the attack.
And then does it require user interaction?
No, or user interaction required.
So if we had AV was physical, where a person or the attacker
had to be at the physical device and the attack complexity was
high, meaning there's a whole bunch of stuff that
has to happen, and a privilege is required is high,
the actual score--
because all those would be hard to pull off--
the score is going to be fairly low.
It maybe a 4 or 5, where if we contrast that and we say,
the attack vector is network based
and the attack complexity is low, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the attack complexity is low,
and the privilege is required to pull this off
are none, something like that is going to be like a or 10.
So the actual score that comes out
is going to be a number between 0 and 10,
where 10 is really, really severe and a 0 or a 1
would be the lowest side of that scale.
Also, there are factors regarding the confidentiality.
If this compromise is successful,
is confidentiality impacted?
If the answer is, there is a high impact, that's
going to increase the score.
Is data integrity going to be highly impacted? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Is data integrity going to be highly impacted?
That's going to increase the score.
And will availability be highly impacted?
That's going to increase the score.
So if the CIA was all H as well, we're
looking at this, going to have a very, very high CVSS score.
Again, the CVSS stands for Common Vulnerability Scoring
System.
So that was a nice little tangent.
If we go back and if we click on one of them,
it's going to show us the details for that vulnerability.
So the attack vector is network based,
the attack complexity is low, the privileges required WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the attack complexity is low, the privileges required
is none, the user interaction is none,
and here we have the CIA, confidentiality data integrity
and availability, and all of those are high.
And that's why it got this score of 10.
So if we had several different types of vulnerabilities
in our environment, we'd want to focus
on the ones that had the highest CVSS score because that's
very likely where our biggest risks are going to be.
Also, in this explanation, regarding this vulnerability,
it also has some CVE numbers.
So CVE-2020-6143 and CVE yadda, yadda, yadda, and let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So CVE-2020-6143 and CVE yadda, yadda, yadda, and let's
talk about what a CVE is.
This website is cve.mitre.org.
And CVE stands for common vulnerability and exposures.
So from here we can also search the CVE,
the common vulnerabilities and exposures list,
and let's grab the one we looking at from Talos.
So let's just grab this first one right here.
So we'll copy that, go back to search, click on Paste,
and Submit.
So here is giving us the details for that.
Now fortunately, Talos, what they did for us,
they included a lot of that detail for us. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they included a lot of that detail for us.
So we have the actual CVE number,
but we also have a summary, and if we scroll down a little bit
more, it has the details regarding that vulnerability,
and as we continue to down, has a CVE listed again for us.
And it has some examples, including a timeline.
So it was June of 2020 when the vendor disclosed this.
It was August 2020 when the vendor provided a patch
to tell us for testing.
It was four days later when Talos confirmed
the patch, resolved the issue, and then there
was a public release on 8/31.
So if we go back one page, we also
have a search option here where we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have a search option here where we
could search for the vulnerability
that we're looking for and then get more information on how
to correct it or remedy that vulnerability.
So one of the cool things is that without even logging in,
we're able to use Talos Intelligence to do some
searching regarding vulnerabilities, the CVSS
scores, and the CVE numbers to get more information
on those vulnerabilities.
And the good news keeps on coming.
It gets even better.
We can also use the talosintelligence.com
to do reputation lookups.
We're getting an IP address or domain to find out, ooh,
is that guy on the naughty list? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is that guy on the naughty list?
Is that known for malware?
Is that known for spam?
And we can look that up right here on talosintelligence.com
as well.
And what we'll do in the next video,
I'll walk you through an example of doing exactly that.
So I'll see you in a few moments in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.