WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:01.920 align:middle line:90%
So we know what's
important to us

3
00:01.920 --> 00:04.570 align:middle line:90%
and we know where we
have some weaknesses.

4
00:04.570 --> 00:08.280 align:middle line:90%
Now we need to identify what
are the actual threats to them

5
00:08.280 --> 00:10.020 align:middle line:84%
compromising our systems?

6
00:10.020 --> 00:12.390 align:middle line:90%
What are the threats that
exist internally as well

7
00:12.390 --> 00:13.410 align:middle line:84%
as externally?

8
00:13.410 --> 00:15.780 align:middle line:90%
And then we need to analyze
what are the real costs

9
00:15.780 --> 00:17.368 align:middle line:84%
and risks associated with that.

10
00:17.368 --> 00:18.910 align:middle line:90%
That's what this
Nugget is all about.

11
00:18.910 --> 00:21.202 align:middle line:90%
We're going to be talking
about the threats themselves,

12
00:21.202 --> 00:24.030 align:middle line:90%
setting us up for the upcoming
Nuggets, where we actually talk

13
00:24.030 --> 00:26.010 align:middle line:84%
about common attack methods.

14
00:26.010 --> 00:26.980 align:middle line:84%
Let's get going.

15
00:26.980 --> 00:29.250 align:middle line:90%
So we've identified
what's important to us.

16
00:29.250 --> 00:31.020 align:middle line:90%
And we know what
our weak points are.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.250 --> 00:31.020 align:middle line:90%
And we know what
our weak points are.

17
00:31.020 --> 00:32.910 align:middle line:84%
But now what's the real threat?

18
00:32.910 --> 00:36.060 align:middle line:90%
What's the real attack that's
going to be used against us?

19
00:36.060 --> 00:37.770 align:middle line:90%
That's what we need
to identify next.

20
00:37.770 --> 00:40.860 align:middle line:90%
What's the real risk
associated with this?

21
00:40.860 --> 00:43.350 align:middle line:90%
And we're going to
categorize these upfront.

22
00:43.350 --> 00:45.870 align:middle line:90%
Whereas before, we talked
about them abstractly

23
00:45.870 --> 00:48.070 align:middle line:90%
and then talked about how
we could classify them.

24
00:48.070 --> 00:50.880 align:middle line:90%
Now we need to start
the threat analysis

25
00:50.880 --> 00:54.060 align:middle line:90%
with an assessment or a
classification, so to speak,

26
00:54.060 --> 00:55.428 align:middle line:84%
of where they begin.

27
00:55.428 --> 00:57.720 align:middle line:90%
And the first thought, just
like we talked about before

28
00:57.720 --> 00:59.760 align:middle line:84%
with people, guess what?

29
00:59.760 --> 01:03.190 align:middle line:90%
Our first real threat
could come internally.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.760 --> 01:03.190 align:middle line:90%
Our first real threat
could come internally.

30
01:03.190 --> 01:06.720 align:middle line:90%
And this doesn't necessarily
mean it happens intentionally.

31
01:06.720 --> 01:09.000 align:middle line:90%
People could print
something that's sensitive

32
01:09.000 --> 01:12.030 align:middle line:90%
and accidentally forget about
it and leave it on the printer

33
01:12.030 --> 01:14.190 align:middle line:90%
so that somebody can come
along and pick it up.

34
01:14.190 --> 01:17.260 align:middle line:90%
Or people could click on a link
with the best of intentions,

35
01:17.260 --> 01:19.710 align:middle line:90%
but that link ends up
downloading malware.

36
01:19.710 --> 01:22.230 align:middle line:90%
And again, it falls back to
what are our vulnerabilities

37
01:22.230 --> 01:23.760 align:middle line:90%
and what are the
assessments there?

38
01:23.760 --> 01:27.660 align:middle line:90%
But sometimes
internal actors do act

39
01:27.660 --> 01:29.040 align:middle line:84%
with the worst of intentions.

40
01:29.040 --> 01:31.500 align:middle line:90%
This recently just
happened, where
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.040 --> 01:31.500 align:middle line:90%
This recently just
happened, where

41
01:31.500 --> 01:37.410 align:middle line:90%
Cisco had an employee quit, log
into Cisco's AWS, Amazon Web

42
01:37.410 --> 01:42.930 align:middle line:90%
Services environment, and delete
virtual machines out of AWS

43
01:42.930 --> 01:45.660 align:middle line:90%
that caused their Webex
Teams product to go down

44
01:45.660 --> 01:49.620 align:middle line:90%
and lost tens of thousands
of in customer accounts.

45
01:49.620 --> 01:51.600 align:middle line:84%
And it cost Cisco $2.4 million.

46
01:51.600 --> 01:55.350 align:middle line:90%
This was a software
engineer within Cisco

47
01:55.350 --> 01:57.510 align:middle line:90%
who had access to
this environment

48
01:57.510 --> 02:00.090 align:middle line:90%
and took that privilege
home with him so
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:57.510 --> 02:00.090 align:middle line:90%
and took that privilege
home with him so

49
02:00.090 --> 02:03.090 align:middle line:90%
that when they quit, they
enacted some sort of event that

50
02:03.090 --> 02:07.050 align:middle line:90%
actually deleted actual virtual
machines and actual data out

51
02:07.050 --> 02:08.470 align:middle line:84%
of the AWS environment.

52
02:08.470 --> 02:10.680 align:middle line:90%
Now that person, as you
can see here, pled guilty

53
02:10.680 --> 02:13.440 align:middle line:90%
and is looking at probably some
jail time and some bad stuff

54
02:13.440 --> 02:13.950 align:middle line:84%
too.

55
02:13.950 --> 02:17.370 align:middle line:90%
But know that your first
threat really comes internally.

56
02:17.370 --> 02:20.100 align:middle line:90%
Now if internal is the first
threat, then obviously,

57
02:20.100 --> 02:22.383 align:middle line:90%
external and hackers
themselves are

58
02:22.383 --> 02:23.550 align:middle line:84%
going to be the next threat.

59
02:23.550 --> 02:25.770 align:middle line:90%
But there's many different
types of hackers.

60
02:25.770 --> 02:27.960 align:middle line:90%
There's different shapes
and sizes to them.

61
02:27.960 --> 02:30.810 align:middle line:90%
The black hat hacker, this
is the traditional hacker
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:27.960 --> 02:30.810 align:middle line:90%
The black hat hacker, this
is the traditional hacker

62
02:30.810 --> 02:32.850 align:middle line:90%
that you're thinking
of here, their motives

63
02:32.850 --> 02:35.620 align:middle line:90%
are to do something
bad to somebody else.

64
02:35.620 --> 02:38.130 align:middle line:90%
Maybe they want to break into
somebody's personal computer

65
02:38.130 --> 02:40.650 align:middle line:90%
and steal their information,
or use their webcam.

66
02:40.650 --> 02:42.390 align:middle line:90%
Maybe they want to
break into a business

67
02:42.390 --> 02:44.160 align:middle line:90%
and encrypt the
data there, holding

68
02:44.160 --> 02:45.420 align:middle line:84%
the business for ransom.

69
02:45.420 --> 02:47.100 align:middle line:90%
Whatever it is, these
are the bad guys.

70
02:47.100 --> 02:48.720 align:middle line:90%
Black hat hackers
are the bad guys.

71
02:48.720 --> 02:50.565 align:middle line:90%
White hat hackers
are the good guys.

72
02:50.565 --> 02:52.690 align:middle line:90%
And I know you may be
thinking like, wait a minute.

73
02:52.690 --> 02:53.190 align:middle line:84%
What hacker?

74
02:53.190 --> 02:54.398 align:middle line:84%
How could that be a good guy?

75
02:54.398 --> 02:56.780 align:middle line:90%
There are actual
professions out there,

76
02:56.780 --> 03:00.240 align:middle line:90%
pen testers, who are hired
by businesses in order
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:56.780 --> 03:00.240 align:middle line:90%
pen testers, who are hired
by businesses in order

77
03:00.240 --> 03:02.970 align:middle line:90%
to actually attempt to
hack them and find out

78
03:02.970 --> 03:05.710 align:middle line:90%
where their vulnerabilities
are in the first place.

79
03:05.710 --> 03:08.460 align:middle line:90%
Now here we've identified
them as white hat hackers.

80
03:08.460 --> 03:10.590 align:middle line:90%
But their actual job
profession is usually

81
03:10.590 --> 03:12.960 align:middle line:90%
something like
penetration tester,

82
03:12.960 --> 03:14.790 align:middle line:84%
or pen tester for short.

83
03:14.790 --> 03:17.370 align:middle line:90%
They could also be called
an offensive security

84
03:17.370 --> 03:18.420 align:middle line:84%
professional.

85
03:18.420 --> 03:20.700 align:middle line:90%
Or sometimes they are just
called white hat hackers.

86
03:20.700 --> 03:22.075 align:middle line:90%
The point is, if
you're wondering

87
03:22.075 --> 03:23.820 align:middle line:90%
how much a hacker
gets paid and you're

88
03:23.820 --> 03:25.410 align:middle line:90%
going to go look for
job titles, you probably

89
03:25.410 --> 03:26.830 align:middle line:90%
want to start off with
penetration testers,

90
03:26.830 --> 03:27.910 align:middle line:84%
or something like that.

91
03:27.910 --> 03:31.885 align:middle line:90%
Now grey hat hackers are
somewhere in between.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:27.910 --> 03:31.885 align:middle line:90%
Now grey hat hackers are
somewhere in between.

92
03:31.885 --> 03:33.510 align:middle line:90%
Maybe you're interviewing
them and they

93
03:33.510 --> 03:34.890 align:middle line:90%
say they have the
best of motives

94
03:34.890 --> 03:36.480 align:middle line:84%
but you're just not sure.

95
03:36.480 --> 03:39.270 align:middle line:90%
Maybe they've done some
bad stuff in the past.

96
03:39.270 --> 03:42.600 align:middle line:90%
It's best to avoid grey hat
hackers because you're just not

97
03:42.600 --> 03:45.030 align:middle line:90%
totally sure where they're
going to go with this.

98
03:45.030 --> 03:46.770 align:middle line:90%
Now the suicide
hacker is someone

99
03:46.770 --> 03:49.080 align:middle line:90%
who knows they're
going to do damage

100
03:49.080 --> 03:51.780 align:middle line:90%
and they don't care if they
go down in flames with it.

101
03:51.780 --> 03:53.520 align:middle line:90%
You could probably
make, honestly,

102
03:53.520 --> 03:55.478 align:middle line:90%
a pretty good argument
that this person here--

103
03:55.478 --> 03:57.270 align:middle line:90%
I know there's writing
all over my screen--

104
03:57.270 --> 03:59.172 align:middle line:90%
that this person here
was a suicide hacker.

105
03:59.172 --> 04:00.630 align:middle line:90%
Because there's no
way you're going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:59.172 --> 04:00.630 align:middle line:90%
Because there's no
way you're going

106
04:00.630 --> 04:03.390 align:middle line:90%
to delete hundreds of
VMs out of Cisco's AWS

107
04:03.390 --> 04:04.350 align:middle line:84%
and get away with it.

108
04:04.350 --> 04:05.320 align:middle line:84%
But here we go.

109
04:05.320 --> 04:07.050 align:middle line:90%
That's what the
suicide hacker does.

110
04:07.050 --> 04:07.980 align:middle line:84%
They're going to hack.

111
04:07.980 --> 04:09.090 align:middle line:84%
They're going to cause damage.

112
04:09.090 --> 04:11.010 align:middle line:90%
And they don't care if
they go down fighting.

113
04:11.010 --> 04:14.400 align:middle line:90%
The script kiddie is someone
who is brand new to hacking

114
04:14.400 --> 04:17.040 align:middle line:90%
and they don't have the
expertise to actually perform

115
04:17.040 --> 04:18.279 align:middle line:84%
a hack themselves.

116
04:18.279 --> 04:20.279 align:middle line:90%
So they take somebody
else's script,

117
04:20.279 --> 04:22.470 align:middle line:90%
like a Python script or
a PowerShell script that

118
04:22.470 --> 04:24.450 align:middle line:90%
performs bad things,
and they just

119
04:24.450 --> 04:26.460 align:middle line:90%
run the script to
see what it does.

120
04:26.460 --> 04:29.010 align:middle line:90%
The cyber terrorist kind
of lives up to the name.

121
04:29.010 --> 04:32.580 align:middle line:90%
Their sole mission is to
actually cause terror and harm
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:29.010 --> 04:32.580 align:middle line:90%
Their sole mission is to
actually cause terror and harm

122
04:32.580 --> 04:33.798 align:middle line:84%
to an organization.

123
04:33.798 --> 04:35.340 align:middle line:90%
You could make the
argument that when

124
04:35.340 --> 04:37.590 align:middle line:90%
we're talking about in a
previous Nugget someone who's

125
04:37.590 --> 04:40.590 align:middle line:90%
trying to attack an
actual electrical field,

126
04:40.590 --> 04:44.370 align:middle line:90%
an actual electrical power
company, or a manufacturing

127
04:44.370 --> 04:46.470 align:middle line:90%
plant, someone who's
trying to cause real terror

128
04:46.470 --> 04:48.780 align:middle line:90%
and damage, physical
terror and damage,

129
04:48.780 --> 04:50.520 align:middle line:84%
that would be a cyber terrorist.

130
04:50.520 --> 04:52.230 align:middle line:90%
A state sponsored
hacker is someone

131
04:52.230 --> 04:54.750 align:middle line:90%
who is hired by the government
to hack another government.

132
04:54.750 --> 04:58.620 align:middle line:90%
This happens way more often
than anyone cares to admit.

133
04:58.620 --> 05:01.610 align:middle line:90%
But pretty much every first,
second, and many third world
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
04:58.620 --> 05:01.610 align:middle line:90%
But pretty much every first,
second, and many third world

134
05:01.610 --> 05:05.300 align:middle line:90%
countries have a state
sponsored hacking organization

135
05:05.300 --> 05:09.260 align:middle line:90%
whose sole goal is to
spy on others governments

136
05:09.260 --> 05:10.520 align:middle line:84%
by hacking with them.

137
05:10.520 --> 05:12.170 align:middle line:90%
And the hacktivist
is someone who

138
05:12.170 --> 05:16.010 align:middle line:90%
is performing hacks or leaks
of data and information

139
05:16.010 --> 05:20.030 align:middle line:90%
in order to fulfill what they
believe is a noble cause.

140
05:20.030 --> 05:22.715 align:middle line:90%
When you hear about
WikiLeaks or BlueLeaks,

141
05:22.715 --> 05:24.590 align:middle line:90%
this is typically what
they're talking about.

142
05:24.590 --> 05:27.770 align:middle line:90%
Someone who believes that
exfiltrating that data

143
05:27.770 --> 05:29.780 align:middle line:90%
and information, and
leaking government

144
05:29.780 --> 05:32.510 align:middle line:90%
classified information, they
believe that what they're doing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:29.780 --> 05:32.510 align:middle line:90%
classified information, they
believe that what they're doing

145
05:32.510 --> 05:35.670 align:middle line:90%
is exposing some truth or
some justice in the world.

146
05:35.670 --> 05:39.110 align:middle line:90%
So this sets up the internal
threat and the external threat.

147
05:39.110 --> 05:41.677 align:middle line:90%
But there's another category
of threat that both of these

148
05:41.677 --> 05:43.760 align:middle line:90%
contribute to, which we're
going to bring up here.

149
05:43.760 --> 05:45.720 align:middle line:84%
And that's physical threats.

150
05:45.720 --> 05:47.990 align:middle line:90%
Both internal and
external threats

151
05:47.990 --> 05:50.780 align:middle line:90%
have the ability to
take down our systems.

152
05:50.780 --> 05:54.620 align:middle line:90%
They can cause data corruption,
they can exfiltrate data,

153
05:54.620 --> 05:57.050 align:middle line:90%
they can harm people,
and they can even

154
05:57.050 --> 05:58.700 align:middle line:84%
harm our systems themselves.

155
05:58.700 --> 06:00.200 align:middle line:90%
If somehow or
other a hacker were
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:58.700 --> 06:00.200 align:middle line:90%
If somehow or
other a hacker were

156
06:00.200 --> 06:03.650 align:middle line:90%
to get into our power grid
and power monitoring systems,

157
06:03.650 --> 06:06.380 align:middle line:90%
maybe through the
usage of IoT, which

158
06:06.380 --> 06:09.740 align:middle line:90%
is where one of our top
vulnerabilities actually lives,

159
06:09.740 --> 06:13.100 align:middle line:90%
they could actually send
surges into our power systems,

160
06:13.100 --> 06:14.720 align:middle line:84%
frying them all.

161
06:14.720 --> 06:16.610 align:middle line:90%
Even redundancy
can't help you then

162
06:16.610 --> 06:19.200 align:middle line:90%
because now we've fried
all of our systems.

163
06:19.200 --> 06:21.030 align:middle line:90%
So all of this
begs the question,

164
06:21.030 --> 06:22.340 align:middle line:84%
how do we prevent this?

165
06:22.340 --> 06:23.780 align:middle line:90%
How do we mitigate
these threats?

166
06:23.780 --> 06:25.610 align:middle line:90%
And that's really
what the entire point

167
06:25.610 --> 06:26.657 align:middle line:84%
of this entire course is.

168
06:26.657 --> 06:28.490 align:middle line:90%
But the gist of it is
that there are a bunch

169
06:28.490 --> 06:29.670 align:middle line:84%
of things that you can do.

170
06:29.670 --> 06:32.180 align:middle line:90%
First of all, you can
have policies in place
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:29.670 --> 06:32.180 align:middle line:90%
First of all, you can
have policies in place

171
06:32.180 --> 06:35.090 align:middle line:90%
that stop people from doing the
wrong stuff in the first place.

172
06:35.090 --> 06:39.770 align:middle line:90%
This policy could go
hand-in-hand with training.

173
06:39.770 --> 06:42.462 align:middle line:90%
Letting people know and be
aware of what threats exists

174
06:42.462 --> 06:44.420 align:middle line:90%
so that they don't fall
victim to these threats

175
06:44.420 --> 06:46.760 align:middle line:90%
in the first place is going
to be really important.

176
06:46.760 --> 06:49.370 align:middle line:90%
Next, we have the
technical solutions.

177
06:49.370 --> 06:52.670 align:middle line:90%
These are going to be using
things like next gen firewall

178
06:52.670 --> 06:56.510 align:middle line:90%
systems, intrusion detection
and prevention systems,

179
06:56.510 --> 07:00.050 align:middle line:90%
using web content
filters, email security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

179
06:56.510 --> 07:00.050 align:middle line:90%
using web content
filters, email security

180
07:00.050 --> 07:02.690 align:middle line:84%
appliances, and antivirus.

181
07:02.690 --> 07:04.640 align:middle line:90%
All of these things are
technical, physical,

182
07:04.640 --> 07:07.797 align:middle line:90%
or software based solutions that
can help us prevent problems.

183
07:07.797 --> 07:09.380 align:middle line:90%
But then we can take
it a step further

184
07:09.380 --> 07:14.540 align:middle line:90%
with physical safeguards, things
like using locks, or key card

185
07:14.540 --> 07:17.090 align:middle line:84%
scanners, or camera systems.

186
07:17.090 --> 07:20.690 align:middle line:90%
Preventing physical access
to people who don't need it,

187
07:20.690 --> 07:23.330 align:middle line:90%
this is a policy of
the least privilege.

188
07:23.330 --> 07:26.510 align:middle line:90%
Wherever possible, we want to
minimize people's privileges.

189
07:26.510 --> 07:29.060 align:middle line:90%
That way they don't
have access to resources

190
07:29.060 --> 07:31.580 align:middle line:90%
they don't need and can't
cause harm in those areas.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
07:29.060 --> 07:31.580 align:middle line:90%
they don't need and can't
cause harm in those areas.

191
07:31.580 --> 07:33.720 align:middle line:90%
Then, of course, there's
networking solutions,

192
07:33.720 --> 07:35.930 align:middle line:90%
things like using the
correct protocols,

193
07:35.930 --> 07:39.770 align:middle line:90%
the correct ACLs, and the
list goes on and on and on.

194
07:39.770 --> 07:42.470 align:middle line:90%
And the temptation is for me
to keep going on and on and on.

195
07:42.470 --> 07:45.620 align:middle line:90%
But really, that's what the rest
of this course is all about.

196
07:45.620 --> 07:47.750 align:middle line:90%
At this point, we've
identified our assets,

197
07:47.750 --> 07:49.292 align:middle line:90%
our vulnerabilities,
and our threats.

198
07:49.292 --> 07:50.792 align:middle line:90%
In the next few
Nuggets, we're going

199
07:50.792 --> 07:52.340 align:middle line:90%
to talk about common
attack methods

200
07:52.340 --> 07:54.562 align:middle line:90%
that hackers may try
to use against us.

201
07:54.562 --> 07:56.270 align:middle line:90%
I hope this has been
informative for you.

202
07:56.270 --> 07:58.900 align:middle line:90%
And I'd like to thank
you for viewing.