WEBVTT

1
00:00.000 --> 00:00.035 align:middle line:84%


2
00:00.035 --> 00:02.160 align:middle line:90%
Now that we understand
what's important to us, what

3
00:02.160 --> 00:04.170 align:middle line:90%
are assets that we're
trying to protect,

4
00:04.170 --> 00:06.540 align:middle line:90%
the next thing we have
to do before we look

5
00:06.540 --> 00:08.540 align:middle line:90%
outside to the world
where there's hackers,

6
00:08.540 --> 00:09.840 align:middle line:84%
we need to look in the mirror.

7
00:09.840 --> 00:11.190 align:middle line:84%
What are our vulnerabilities?

8
00:11.190 --> 00:13.110 align:middle line:84%
Where are we weakest internally?

9
00:13.110 --> 00:15.000 align:middle line:90%
And we'll talk about
what vulnerabilities

10
00:15.000 --> 00:18.060 align:middle line:90%
may exist within an organization
in this particular Nugget.

11
00:18.060 --> 00:19.090 align:middle line:84%
Let's get going.

12
00:19.090 --> 00:20.700 align:middle line:90%
So now that we
understand our assets,

13
00:20.700 --> 00:23.633 align:middle line:90%
it's time for us to talk about
where are we most vulnerable.

14
00:23.633 --> 00:25.050 align:middle line:90%
And you can already
tell where I'm

15
00:25.050 --> 00:27.420 align:middle line:90%
going with the very first
little picture here.

16
00:27.420 --> 00:30.180 align:middle line:90%
Yeah, we're starting
off with people again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:27.420 --> 00:30.180 align:middle line:90%
Yeah, we're starting
off with people again.

17
00:30.180 --> 00:33.300 align:middle line:90%
People, again, honestly,
people might be our number one

18
00:33.300 --> 00:36.630 align:middle line:90%
vulnerability because I
believe that people inherently

19
00:36.630 --> 00:37.560 align:middle line:84%
are good people.

20
00:37.560 --> 00:39.450 align:middle line:84%
And people are inherently nice.

21
00:39.450 --> 00:41.680 align:middle line:90%
And they just want
to be helpful.

22
00:41.680 --> 00:45.000 align:middle line:90%
So when they receive a
spam email asking for help,

23
00:45.000 --> 00:47.250 align:middle line:90%
their response to
that might be to help.

24
00:47.250 --> 00:51.667 align:middle line:90%
Or when somebody comes in
dressed like an AT&T employee,

25
00:51.667 --> 00:53.250 align:middle line:90%
they might just trust
them and believe

26
00:53.250 --> 00:55.167 align:middle line:90%
that they're an AT&T
employee without checking

27
00:55.167 --> 00:56.190 align:middle line:84%
with anyone first.

28
00:56.190 --> 00:57.510 align:middle line:90%
We're going to talk
more about that when

29
00:57.510 --> 00:58.802 align:middle line:84%
we get this social engineering.

30
00:58.802 --> 01:02.850 align:middle line:90%
But that is a real life scenario
that I'm talking about too.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:58.802 --> 01:02.850 align:middle line:90%
But that is a real life scenario
that I'm talking about too.

31
01:02.850 --> 01:06.210 align:middle line:90%
So what we need to do when we're
assessing how vulnerable we are

32
01:06.210 --> 01:09.300 align:middle line:90%
with people, we need to
talk about what policies

33
01:09.300 --> 01:13.530 align:middle line:90%
do we have in place that
enforce how people should behave

34
01:13.530 --> 01:14.970 align:middle line:84%
in certain situations.

35
01:14.970 --> 01:17.550 align:middle line:90%
Are they allowed to
download bootleg software

36
01:17.550 --> 01:18.600 align:middle line:84%
in the first place?

37
01:18.600 --> 01:21.420 align:middle line:90%
And how are we enforcing
these policies?

38
01:21.420 --> 01:23.900 align:middle line:90%
Is this just written down
in a document somewhere?

39
01:23.900 --> 01:25.650 align:middle line:90%
Or are we actually
deploying software

40
01:25.650 --> 01:30.360 align:middle line:90%
and technological resources
that enforce these policies when
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:25.650 --> 01:30.360 align:middle line:90%
and technological resources
that enforce these policies when

41
01:30.360 --> 01:32.520 align:middle line:90%
the end users are
interacting with technology?

42
01:32.520 --> 01:34.437 align:middle line:90%
Beyond that, we also
need to look at something

43
01:34.437 --> 01:36.210 align:middle line:84%
like training opportunities.

44
01:36.210 --> 01:37.920 align:middle line:90%
How many people
actually have gone

45
01:37.920 --> 01:39.900 align:middle line:90%
through some form
of training letting

46
01:39.900 --> 01:42.690 align:middle line:90%
them know what vulnerabilities
and attacks exist

47
01:42.690 --> 01:43.560 align:middle line:84%
in the real world?

48
01:43.560 --> 01:45.210 align:middle line:84%
What should they expect?

49
01:45.210 --> 01:48.540 align:middle line:90%
Is it OK to pick up any
random USP flash drive that's

50
01:48.540 --> 01:50.790 align:middle line:84%
just sitting on a park bench?

51
01:50.790 --> 01:51.600 align:middle line:84%
Probably not.

52
01:51.600 --> 01:52.690 align:middle line:84%
But do people know that?

53
01:52.690 --> 01:53.190 align:middle line:84%
Maybe not.

54
01:53.190 --> 01:55.710 align:middle line:90%
Maybe they pick it up and plug
it in and see what it does.

55
01:55.710 --> 01:57.960 align:middle line:90%
So understand that your first
vulnerability, and maybe

56
01:57.960 --> 02:00.547 align:middle line:90%
your biggest one, is going to
be the people, which again, were
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:57.960 --> 02:00.547 align:middle line:90%
your biggest one, is going to
be the people, which again, were

57
02:00.547 --> 02:02.130 align:middle line:90%
maybe your biggest
asset that you need

58
02:02.130 --> 02:03.588 align:middle line:84%
to protect in the first place.

59
02:03.588 --> 02:05.130 align:middle line:90%
In other words, what
we're saying is,

60
02:05.130 --> 02:08.058 align:middle line:90%
focus a lot on people before
you focus on technology

61
02:08.058 --> 02:09.600 align:middle line:90%
because that's who
we need to protect

62
02:09.600 --> 02:11.070 align:middle line:84%
the most at the end of the day.

63
02:11.070 --> 02:14.190 align:middle line:90%
But moving on, some other
vulnerabilities we may have

64
02:14.190 --> 02:17.003 align:middle line:90%
is within the operating
systems themselves.

65
02:17.003 --> 02:19.170 align:middle line:90%
And I know your gut goes
to think about, well, maybe

66
02:19.170 --> 02:21.530 align:middle line:90%
one operating system is
weaker than the other,

67
02:21.530 --> 02:22.455 align:middle line:90%
or more prone to
vulnerabilities.

68
02:22.455 --> 02:23.872 align:middle line:90%
But at the end of
the day, they're

69
02:23.872 --> 02:26.610 align:middle line:90%
all prone to some
form of vulnerability

70
02:26.610 --> 02:28.740 align:middle line:84%
if you don't patch them.

71
02:28.740 --> 02:32.040 align:middle line:90%
Patches for these devices come
out relatively frequently.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:28.740 --> 02:32.040 align:middle line:90%
Patches for these devices come
out relatively frequently.

72
02:32.040 --> 02:35.468 align:middle line:90%
Many of them roll out patches
as frequently as once a week.

73
02:35.468 --> 02:37.260 align:middle line:90%
Some of them roll out
patches once a month.

74
02:37.260 --> 02:39.330 align:middle line:90%
But the idea is that
they're constantly

75
02:39.330 --> 02:42.720 align:middle line:90%
updating the threat landscape
and pushing new signatures

76
02:42.720 --> 02:45.270 align:middle line:90%
and definitions down to
these operating systems

77
02:45.270 --> 02:47.490 align:middle line:90%
to protect you against
common threats.

78
02:47.490 --> 02:49.980 align:middle line:90%
So if you have a
file server that

79
02:49.980 --> 02:51.790 align:middle line:90%
hasn't been patched
in two years,

80
02:51.790 --> 02:54.900 align:middle line:90%
chances are you're exposed
to a great number of threats.

81
02:54.900 --> 02:58.080 align:middle line:90%
Of course, you should deploy
the patches in a secure manner.

82
02:58.080 --> 03:00.300 align:middle line:90%
You don't necessarily want
to push the patch down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:58.080 --> 03:00.300 align:middle line:90%
You don't necessarily want
to push the patch down

83
03:00.300 --> 03:01.815 align:middle line:90%
to your operating
systems the moment

84
03:01.815 --> 03:03.690 align:middle line:90%
they become available
because you're not sure

85
03:03.690 --> 03:05.760 align:middle line:90%
if there would be any
adverse reactions to it.

86
03:05.760 --> 03:09.330 align:middle line:90%
But you should endeavor
to patch a test system

87
03:09.330 --> 03:10.810 align:middle line:84%
when it becomes available.

88
03:10.810 --> 03:12.750 align:middle line:90%
And once you know the
patch doesn't impact you

89
03:12.750 --> 03:14.292 align:middle line:90%
in a bad way, then
you should push it

90
03:14.292 --> 03:15.820 align:middle line:84%
to your production servers.

91
03:15.820 --> 03:18.810 align:middle line:90%
Now lastly, I think I have to
erase my little drawing here

92
03:18.810 --> 03:21.510 align:middle line:90%
because we're about
to bring up a diagram.

93
03:21.510 --> 03:22.370 align:middle line:84%
There we go.

94
03:22.370 --> 03:25.980 align:middle line:90%
Now lastly, vulnerabilities
can exist and probably

95
03:25.980 --> 03:29.370 align:middle line:90%
do exist within the applications
we create themselves.

96
03:29.370 --> 03:31.637 align:middle line:90%
These are different programming
languages written here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:29.370 --> 03:31.637 align:middle line:90%
These are different programming
languages written here

97
03:31.637 --> 03:32.220 align:middle line:84%
on the screen.

98
03:32.220 --> 03:35.880 align:middle line:90%
Look, full disclosure, full
I'm being vulnerable right now.

99
03:35.880 --> 03:37.860 align:middle line:90%
I have written some
code in the past

100
03:37.860 --> 03:40.800 align:middle line:90%
when I was first learning
to code, that would not

101
03:40.800 --> 03:43.888 align:middle line:84%
pass a security standard.

102
03:43.888 --> 03:44.680 align:middle line:84%
Everyone's done it.

103
03:44.680 --> 03:46.380 align:middle line:90%
Everybody who's
written code their life

104
03:46.380 --> 03:48.570 align:middle line:90%
is probably thinking back
to a previous job going,

105
03:48.570 --> 03:49.470 align:middle line:84%
you know what?

106
03:49.470 --> 03:51.240 align:middle line:90%
I should probably
contact them about that

107
03:51.240 --> 03:53.160 align:middle line:84%
because that's not good.

108
03:53.160 --> 03:56.700 align:middle line:90%
This is things like hard coding
passwords within your codes,

109
03:56.700 --> 03:58.950 align:middle line:90%
or not using
encryption anywhere.

110
03:58.950 --> 04:01.410 align:middle line:90%
Software developers,
especially new ones,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:58.950 --> 04:01.410 align:middle line:90%
Software developers,
especially new ones,

111
04:01.410 --> 04:03.990 align:middle line:90%
tend to take shortcuts
wherever they can.

112
04:03.990 --> 04:07.510 align:middle line:90%
And that often comes at
the cost of security.

113
04:07.510 --> 04:10.110 align:middle line:90%
So it's important for us
to identify not only what

114
04:10.110 --> 04:14.220 align:middle line:90%
our vulnerabilities are but
also to classify and categorize

115
04:14.220 --> 04:14.790 align:middle line:84%
them.

116
04:14.790 --> 04:17.760 align:middle line:84%
Is this a policy vulnerability?

117
04:17.760 --> 04:20.519 align:middle line:84%
Is it a software vulnerability?

118
04:20.519 --> 04:24.390 align:middle line:90%
Is the code just poorly
designed in the first place?

119
04:24.390 --> 04:27.690 align:middle line:90%
And does it expose the
incorrect protocols?

120
04:27.690 --> 04:30.780 align:middle line:90%
Would the vulnerability
give network access?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:27.690 --> 04:30.780 align:middle line:90%
Would the vulnerability
give network access?

121
04:30.780 --> 04:34.200 align:middle line:90%
Or would it introduce the
opportunity for malware

122
04:34.200 --> 04:36.010 align:middle line:84%
to be brought into the system?

123
04:36.010 --> 04:38.940 align:middle line:90%
So that's how you would identify
what your vulnerabilities are,

124
04:38.940 --> 04:40.800 align:middle line:90%
but then classify
them yet again.

125
04:40.800 --> 04:43.830 align:middle line:90%
Now we've got assets
identified and classified

126
04:43.830 --> 04:46.123 align:middle line:90%
and vulnerabilities
identified and classified.

127
04:46.123 --> 04:48.540 align:middle line:90%
In the next Nugget, we're going
to talk about the existing

128
04:48.540 --> 04:50.222 align:middle line:84%
threats to our landscape too.

129
04:50.222 --> 04:51.930 align:middle line:90%
I hope this has been
informative for you.

130
04:51.930 --> 04:54.070 align:middle line:84%
And I'd like to thank you for.