CYS405 · Chapter 5 · Annotated SlidesVulnerability Analysis
Original
Overview

Vulnerability Analysis

Vulnerability research and classification (misconfiguration, defaults, buffer overflows, unpatched servers, design flaws…), network, host, wireless and application scans, scan targets and frequency, scanner pros and cons, PCI DSS, CVSS, CVE and assessment tools.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 43 slides
  1. 1 Slide 1
  2. 2 INTRODUCTION
  3. 3 Traditionally, cyber security professionals are trained to
  4. 4 The US National Institute of Standards and
  5. 5 An ethical hacker needs to keep up with the most recently discovered
  6. 6 Vulnerability Research
  7. 7 Vulnerability Classification
  8. 8 Misconfiguration
  9. 9 Default Installations
  10. 10 Buffer Overflows
  11. 11 Unpatched Servers
  12. 12 Design Flaws
  13. 13 Operating System
  14. 14 Application Flaws
  15. 15 Open Services
  16. 16 Default Passwords
  17. 17 As a practical matter, it is impossible to remove every technical vulnerability from a given environment. There are several reasons for this. o Some vulnerabilities are latent until they are
  18. 18 • This in turn means that any given environment will have multiple
  19. 19 • Vulnerability assessments are not exploitative by nature (compared
  20. 20 Types of Vulnerability Assessments
  21. 21 1- Network-Based Scans
  22. 22 2- Host-Based Scans
  23. 23 2- Host-Based Scans Scope (Cont ... )
  24. 24 Component What It Checks
  25. 25 3- Wireless Network Scans
  26. 26 Host-Based vs. Network-Based Scans
  27. 27 4- Application Scans
  28. 28 Identifying Scan Targets
  29. 29 • What is the data classification of the information stored, processed, or
  30. 30 Determining Scan Frequency
  31. 31 What are vulnerability scanners and how do they work?
  32. 32 Pros and Cons of a Vulnerability Scanner
  33. 33 Many organizations find themselves bound by
  34. 34 Security Standard
  35. 35 PCI DSS prescribes many of the details of vulnerability scans:
  36. 36 ❑ Vulnerability scanning for PCI DSS compliance is a thriving and
  37. 37 How to Perform Vulnerability analysis?
  38. 38 Many of the services contain known vulnerabilities which can be
  39. 39 Common Vulnerability Scoring System
  40. 40 CVSS assessment consists of three metrics for measuring vulnerabilities:
  41. 41 Common Vulnerabilities and Exposures (CVE)
  42. 42 Resources for Vulnerability Research
  43. 43 Vulnerability Assessment Tools
Slide 1 / 43

Slide 1

Slide 1: Slide 1
Slide 2 / 43

INTRODUCTION

Slide 2: INTRODUCTION
Slide 3 / 43

Traditionally, cyber security professionals are trained to

Slide 3: Traditionally, cyber security professionals are trained to
Slide 4 / 43

The US National Institute of Standards and

Slide 4: The US National Institute of Standards and
Slide 5 / 43

An ethical hacker needs to keep up with the most recently discovered

Slide 5: An ethical hacker needs to keep up with the most recently discovered
Slide 6 / 43

Vulnerability Research

Slide 6: Vulnerability Research

Notes

  1. Vulnerability research: keep up with newly discovered weaknesses (advisories, CVE, vendor bulletins).

Slide 7 / 43

Vulnerability Classification

Slide 7: Vulnerability Classification

Exam angle

PredictionQ1

Leaving "admin/admin" on a router is which class of vulnerability?

Slide 8 / 43

Misconfiguration

Slide 8: Misconfiguration
Slide 9 / 43

Default Installations

Slide 9: Default Installations
Slide 10 / 43

Buffer Overflows

Slide 10: Buffer Overflows

Notes

  1. Buffer overflow: writing more data than a buffer holds overwrites memory and can run attacker code.

Slide 11 / 43

Unpatched Servers

Slide 11: Unpatched Servers
Slide 12 / 43

Design Flaws

Slide 12: Design Flaws
Slide 13 / 43

Operating System

Slide 13: Operating System
Slide 14 / 43

Application Flaws

Slide 14: Application Flaws
Slide 15 / 43

Open Services

Slide 15: Open Services
Slide 16 / 43

Default Passwords

Slide 16: Default Passwords
Slide 17 / 43

As a practical matter, it is impossible to remove every technical vulnerability from a given environment. There are several reasons for this. o Some vulnerabilities are latent until they are

Slide 17: As a practical matter, it is impossible to remove every technical vulnerability from a given environment. There are several reasons for this. o Some vulnerabilities are latent until they are
Slide 18 / 43

• This in turn means that any given environment will have multiple

Slide 18: • This in turn means that any given environment will have multiple
Slide 19 / 43

• Vulnerability assessments are not exploitative by nature (compared

Slide 19: • Vulnerability assessments are not exploitative by nature (compared
Slide 20 / 43

Types of Vulnerability Assessments

Slide 20: Types of Vulnerability Assessments
Slide 21 / 43

1- Network-Based Scans

Slide 21: 1- Network-Based Scans
Slide 22 / 43

2- Host-Based Scans

Slide 22: 2- Host-Based Scans
Slide 23 / 43

2- Host-Based Scans Scope (Cont ... )

Slide 23: 2- Host-Based Scans Scope (Cont ... )
Slide 24 / 43

Component What It Checks

Slide 24: Component What It Checks
Slide 25 / 43

3- Wireless Network Scans

Slide 25: 3- Wireless Network Scans
Slide 26 / 43

Host-Based vs. Network-Based Scans

Slide 26: Host-Based vs. Network-Based Scans

Notes

  1. Network-based scans see services exposed over the network; host-based scans (with an agent or credentials) see local config, patches and accounts.

Exam angle

PredictionQ1

Which scan type best finds missing local patches and weak file permissions?

Slide 27 / 43

4- Application Scans

Slide 27: 4- Application Scans
Slide 28 / 43

Identifying Scan Targets

Slide 28: Identifying Scan Targets
Slide 29 / 43

• What is the data classification of the information stored, processed, or

Slide 29: • What is the data classification of the information stored, processed, or
Slide 30 / 43

Determining Scan Frequency

Slide 30: Determining Scan Frequency

Notes

  1. Scan frequency depends on risk appetite, regulations (PCI DSS: quarterly), resources and licensing.

Slide 31 / 43

What are vulnerability scanners and how do they work?

Slide 31: What are vulnerability scanners and how do they work?
Slide 32 / 43

Pros and Cons of a Vulnerability Scanner

Slide 32: Pros and Cons of a Vulnerability Scanner

Notes

  1. Scanners are fast and repeatable but give false positives, miss logic flaws and can disrupt systems.

Exam angle

PredictionQ1

A clean vulnerability scan proves a system is secure.

Slide 33 / 43

Many organizations find themselves bound by

Slide 33: Many organizations find themselves bound by
Slide 34 / 43

Security Standard

Slide 34: Security Standard
Slide 35 / 43

PCI DSS prescribes many of the details of vulnerability scans:

Slide 35: PCI DSS prescribes many of the details of vulnerability scans:

Notes

  1. PCI DSS (card payments) requires quarterly internal and external scans (external by an Approved Scanning Vendor).

Slide 36 / 43

❑ Vulnerability scanning for PCI DSS compliance is a thriving and

Slide 36: ❑ Vulnerability scanning for PCI DSS compliance is a thriving and
Slide 37 / 43

How to Perform Vulnerability analysis?

Slide 37: How to Perform Vulnerability analysis?
Slide 38 / 43

Many of the services contain known vulnerabilities which can be

Slide 38: Many of the services contain known vulnerabilities which can be
Slide 39 / 43

Common Vulnerability Scoring System

Slide 39: Common Vulnerability Scoring System

Exam angle

PredictionQ1

CVSS is used to:

Slide 40 / 43

CVSS assessment consists of three metrics for measuring vulnerabilities:

Slide 40: CVSS assessment consists of three metrics for measuring vulnerabilities:
Slide 41 / 43

Common Vulnerabilities and Exposures (CVE)

Slide 41: Common Vulnerabilities and Exposures (CVE)
Slide 42 / 43

Resources for Vulnerability Research

Slide 42: Resources for Vulnerability Research
Slide 43 / 43

Vulnerability Assessment Tools

Slide 43: Vulnerability Assessment Tools

Notes

  1. Tools: Nessus, OpenVAS, Qualys, Nexpose, Nikto (web).