WEBVTT

1
00:00.000 --> 00:01.040 align:middle line:84%


2
00:01.040 --> 00:02.790 align:middle line:90%
I'd like you to imagine
that you and I are

3
00:02.790 --> 00:05.340 align:middle line:90%
on a fairly small boat,
let's imagine like a rowboat,

4
00:05.340 --> 00:08.700 align:middle line:90%
and there are some holes
we discover in the boat

5
00:08.700 --> 00:11.200 align:middle line:90%
below the waterline,
and water is coming in.

6
00:11.200 --> 00:14.670 align:middle line:90%
So my question for you is, which
hole in that boat should we--

7
00:14.670 --> 00:15.420 align:middle line:84%
you and I--

8
00:15.420 --> 00:16.740 align:middle line:84%
focus on first?

9
00:16.740 --> 00:19.350 align:middle line:90%
And hopefully, we're going to
focus on the biggest hole first

10
00:19.350 --> 00:20.760 align:middle line:90%
because that's where
the most damage is

11
00:20.760 --> 00:21.690 align:middle line:84%
happening to our boat.

12
00:21.690 --> 00:23.648 align:middle line:90%
Well, that's where the
most water is coming in.

13
00:23.648 --> 00:25.260 align:middle line:90%
So in a security
environment, if we

14
00:25.260 --> 00:27.510 align:middle line:90%
have a compromise or
attacks that are happening

15
00:27.510 --> 00:30.630 align:middle line:90%
or vulnerabilities, we
want to know which attack
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:27.510 --> 00:30.630 align:middle line:90%
or vulnerabilities, we
want to know which attack

16
00:30.630 --> 00:33.530 align:middle line:90%
or which vulnerability
is the most severe so we

17
00:33.530 --> 00:34.690 align:middle line:84%
can focus on those first.

18
00:34.690 --> 00:36.982 align:middle line:90%
So in this video, I'd like
to share with you some tools

19
00:36.982 --> 00:40.210 align:middle line:90%
and scores that we can look at
to help identify which attacks

20
00:40.210 --> 00:42.380 align:middle line:90%
and which compromises
are the most severe

21
00:42.380 --> 00:45.250 align:middle line:90%
so we can focus our
attention on those first.

22
00:45.250 --> 00:47.890 align:middle line:90%
So here we are once again
at us talosintelligence.com,

23
00:47.890 --> 00:50.250 align:middle line:90%
and I'd like to focus our
attention on vulnerability

24
00:50.250 --> 00:51.990 align:middle line:90%
information, and
from the dropdown,

25
00:51.990 --> 00:54.390 align:middle line:90%
I'd like to click on
Vulnerability Reports

26
00:54.390 --> 00:55.350 align:middle line:84%
right here.

27
00:55.350 --> 00:56.850 align:middle line:90%
And then other
Vulnerability Reports

28
00:56.850 --> 00:59.880 align:middle line:90%
we have Zero Day Reports
and Disclosed Vulnerability

29
00:59.880 --> 01:00.430 align:middle line:84%
Reports.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.880 --> 01:00.430 align:middle line:84%
Reports.

30
01:00.430 --> 01:02.952 align:middle line:90%
Let's click on Disclosed
Vulnerability Reports.

31
01:02.952 --> 01:04.410 align:middle line:90%
And then if you're
following along,

32
01:04.410 --> 01:05.785 align:middle line:90%
we click over here
on this column

33
01:05.785 --> 01:08.050 align:middle line:90%
on the far right
under CVSS Score,

34
01:08.050 --> 01:10.830 align:middle line:90%
and I'm going to sort with
the highest at the top.

35
01:10.830 --> 01:14.770 align:middle line:90%
So CVSS stands for the Common
Vulnerability Scoring System.

36
01:14.770 --> 01:16.620 align:middle line:84%
Here I'm at nist.gov.

37
01:16.620 --> 01:18.270 align:middle line:90%
And if you scroll
down a little bit,

38
01:18.270 --> 01:20.940 align:middle line:90%
it talks about how these
scores are calculated.

39
01:20.940 --> 01:24.330 align:middle line:90%
And some of the major factors
are the exploitability metrics

40
01:24.330 --> 01:25.800 align:middle line:84%
and the impact metrics.

41
01:25.800 --> 01:28.230 align:middle line:90%
So for AV, for
attack vector, how

42
01:28.230 --> 01:30.240 align:middle line:90%
is this attack carried
out, via the network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:28.230 --> 01:30.240 align:middle line:90%
is this attack carried
out, via the network

43
01:30.240 --> 01:32.970 align:middle line:90%
or via an adjacent network,
or is the compromised

44
01:32.970 --> 01:35.640 align:middle line:90%
implemented locally or
at the physical device?

45
01:35.640 --> 01:38.650 align:middle line:90%
And then for the attack
complexity, AC, is it low--

46
01:38.650 --> 01:41.130 align:middle line:90%
I mean, it's pretty simple--
or is it high complexity,

47
01:41.130 --> 01:43.610 align:middle line:90%
meaning there's a lot of stuff
going on to make it happen.

48
01:43.610 --> 01:46.050 align:middle line:84%
For privileges, required, PR--

49
01:46.050 --> 01:48.700 align:middle line:84%
none, low, or high.

50
01:48.700 --> 01:51.780 align:middle line:90%
So if there's an attack and
it requires admin privileges

51
01:51.780 --> 01:55.080 align:middle line:90%
to pull this attack off, this
malware, the privilege required

52
01:55.080 --> 01:58.920 align:middle line:90%
would be H. So it'd be less
severe if it required admin

53
01:58.920 --> 02:00.420 align:middle line:84%
rights to pull off the attack.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.920 --> 02:00.420 align:middle line:84%
rights to pull off the attack.

54
02:00.420 --> 02:02.340 align:middle line:90%
And then does it require
user interaction?

55
02:02.340 --> 02:05.350 align:middle line:90%
No, or user
interaction required.

56
02:05.350 --> 02:09.990 align:middle line:90%
So if we had AV was physical,
where a person or the attacker

57
02:09.990 --> 02:13.588 align:middle line:90%
had to be at the physical device
and the attack complexity was

58
02:13.588 --> 02:15.630 align:middle line:90%
high, meaning there's a
whole bunch of stuff that

59
02:15.630 --> 02:19.740 align:middle line:90%
has to happen, and a
privilege is required is high,

60
02:19.740 --> 02:20.640 align:middle line:84%
the actual score--

61
02:20.640 --> 02:22.540 align:middle line:90%
because all those would
be hard to pull off--

62
02:22.540 --> 02:24.040 align:middle line:90%
the score is going
to be fairly low.

63
02:24.040 --> 02:27.030 align:middle line:90%
It maybe a 4 or 5, where if
we contrast that and we say,

64
02:27.030 --> 02:29.980 align:middle line:90%
the attack vector
is network based

65
02:29.980 --> 02:33.360 align:middle line:90%
and the attack
complexity is low,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.980 --> 02:33.360 align:middle line:90%
and the attack
complexity is low,

66
02:33.360 --> 02:36.000 align:middle line:90%
and the privilege is
required to pull this off

67
02:36.000 --> 02:39.450 align:middle line:90%
are none, something like that
is going to be like a or 10.

68
02:39.450 --> 02:41.040 align:middle line:90%
So the actual score
that comes out

69
02:41.040 --> 02:43.600 align:middle line:90%
is going to be a number
between 0 and 10,

70
02:43.600 --> 02:46.590 align:middle line:90%
where 10 is really, really
severe and a 0 or a 1

71
02:46.590 --> 02:48.970 align:middle line:90%
would be the lowest
side of that scale.

72
02:48.970 --> 02:51.780 align:middle line:90%
Also, there are factors
regarding the confidentiality.

73
02:51.780 --> 02:53.700 align:middle line:90%
If this compromise
is successful,

74
02:53.700 --> 02:55.410 align:middle line:84%
is confidentiality impacted?

75
02:55.410 --> 02:57.660 align:middle line:90%
If the answer is, there
is a high impact, that's

76
02:57.660 --> 02:59.010 align:middle line:84%
going to increase the score.

77
02:59.010 --> 03:01.152 align:middle line:90%
Is data integrity going
to be highly impacted?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.010 --> 03:01.152 align:middle line:90%
Is data integrity going
to be highly impacted?

78
03:01.152 --> 03:02.610 align:middle line:90%
That's going to
increase the score.

79
03:02.610 --> 03:04.842 align:middle line:90%
And will availability
be highly impacted?

80
03:04.842 --> 03:06.300 align:middle line:90%
That's going to
increase the score.

81
03:06.300 --> 03:09.420 align:middle line:90%
So if the CIA was
all H as well, we're

82
03:09.420 --> 03:13.380 align:middle line:90%
looking at this, going to have
a very, very high CVSS score.

83
03:13.380 --> 03:16.800 align:middle line:90%
Again, the CVSS stands for
Common Vulnerability Scoring

84
03:16.800 --> 03:17.403 align:middle line:84%
System.

85
03:17.403 --> 03:18.820 align:middle line:90%
So that was a nice
little tangent.

86
03:18.820 --> 03:21.610 align:middle line:90%
If we go back and if we
click on one of them,

87
03:21.610 --> 03:24.160 align:middle line:90%
it's going to show us the
details for that vulnerability.

88
03:24.160 --> 03:26.510 align:middle line:90%
So the attack vector
is network based,

89
03:26.510 --> 03:30.510 align:middle line:90%
the attack complexity is
low, the privileges required
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:26.510 --> 03:30.510 align:middle line:90%
the attack complexity is
low, the privileges required

90
03:30.510 --> 03:33.600 align:middle line:90%
is none, the user
interaction is none,

91
03:33.600 --> 03:37.510 align:middle line:90%
and here we have the CIA,
confidentiality data integrity

92
03:37.510 --> 03:40.930 align:middle line:90%
and availability, and
all of those are high.

93
03:40.930 --> 03:43.030 align:middle line:90%
And that's why it
got this score of 10.

94
03:43.030 --> 03:45.360 align:middle line:90%
So if we had several different
types of vulnerabilities

95
03:45.360 --> 03:47.220 align:middle line:90%
in our environment,
we'd want to focus

96
03:47.220 --> 03:50.160 align:middle line:90%
on the ones that had the highest
CVSS score because that's

97
03:50.160 --> 03:52.527 align:middle line:90%
very likely where our biggest
risks are going to be.

98
03:52.527 --> 03:54.860 align:middle line:90%
Also, in this explanation,
regarding this vulnerability,

99
03:54.860 --> 03:57.450 align:middle line:84%
it also has some CVE numbers.

100
03:57.450 --> 04:01.860 align:middle line:90%
So CVE-2020-6143 and CVE
yadda, yadda, yadda, and let's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:57.450 --> 04:01.860 align:middle line:90%
So CVE-2020-6143 and CVE
yadda, yadda, yadda, and let's

101
04:01.860 --> 04:04.530 align:middle line:84%
talk about what a CVE is.

102
04:04.530 --> 04:08.160 align:middle line:84%
This website is cve.mitre.org.

103
04:08.160 --> 04:11.820 align:middle line:90%
And CVE stands for common
vulnerability and exposures.

104
04:11.820 --> 04:13.770 align:middle line:90%
So from here we can
also search the CVE,

105
04:13.770 --> 04:16.100 align:middle line:90%
the common vulnerabilities
and exposures list,

106
04:16.100 --> 04:18.404 align:middle line:90%
and let's grab the one
we looking at from Talos.

107
04:18.404 --> 04:20.279 align:middle line:90%
So let's just grab this
first one right here.

108
04:20.279 --> 04:23.880 align:middle line:90%
So we'll copy that, go back
to search, click on Paste,

109
04:23.880 --> 04:24.860 align:middle line:84%
and Submit.

110
04:24.860 --> 04:26.610 align:middle line:90%
So here is giving us
the details for that.

111
04:26.610 --> 04:28.890 align:middle line:90%
Now fortunately, Talos,
what they did for us,

112
04:28.890 --> 04:30.640 align:middle line:90%
they included a lot
of that detail for us.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:28.890 --> 04:30.640 align:middle line:90%
they included a lot
of that detail for us.

113
04:30.640 --> 04:32.400 align:middle line:90%
So we have the
actual CVE number,

114
04:32.400 --> 04:34.983 align:middle line:90%
but we also have a summary, and
if we scroll down a little bit

115
04:34.983 --> 04:38.290 align:middle line:90%
more, it has the details
regarding that vulnerability,

116
04:38.290 --> 04:41.370 align:middle line:90%
and as we continue to down,
has a CVE listed again for us.

117
04:41.370 --> 04:44.290 align:middle line:90%
And it has some examples,
including a timeline.

118
04:44.290 --> 04:47.940 align:middle line:90%
So it was June of 2020 when
the vendor disclosed this.

119
04:47.940 --> 04:50.430 align:middle line:90%
It was August 2020 when
the vendor provided a patch

120
04:50.430 --> 04:51.908 align:middle line:84%
to tell us for testing.

121
04:51.908 --> 04:53.700 align:middle line:90%
It was four days later
when Talos confirmed

122
04:53.700 --> 04:55.680 align:middle line:90%
the patch, resolved the
issue, and then there

123
04:55.680 --> 04:57.960 align:middle line:84%
was a public release on 8/31.

124
04:57.960 --> 04:59.613 align:middle line:90%
So if we go back
one page, we also

125
04:59.613 --> 05:01.030 align:middle line:90%
have a search
option here where we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:59.613 --> 05:01.030 align:middle line:90%
have a search
option here where we

126
05:01.030 --> 05:02.590 align:middle line:90%
could search for
the vulnerability

127
05:02.590 --> 05:05.140 align:middle line:90%
that we're looking for and then
get more information on how

128
05:05.140 --> 05:08.150 align:middle line:90%
to correct it or remedy
that vulnerability.

129
05:08.150 --> 05:10.960 align:middle line:90%
So one of the cool things is
that without even logging in,

130
05:10.960 --> 05:13.180 align:middle line:90%
we're able to use Talos
Intelligence to do some

131
05:13.180 --> 05:15.830 align:middle line:90%
searching regarding
vulnerabilities, the CVSS

132
05:15.830 --> 05:18.490 align:middle line:90%
scores, and the CVE numbers
to get more information

133
05:18.490 --> 05:19.660 align:middle line:84%
on those vulnerabilities.

134
05:19.660 --> 05:21.107 align:middle line:90%
And the good news
keeps on coming.

135
05:21.107 --> 05:21.940 align:middle line:84%
It gets even better.

136
05:21.940 --> 05:23.850 align:middle line:90%
We can also use the
talosintelligence.com

137
05:23.850 --> 05:26.500 align:middle line:84%
to do reputation lookups.

138
05:26.500 --> 05:29.035 align:middle line:90%
We're getting an IP address
or domain to find out, ooh,

139
05:29.035 --> 05:30.460 align:middle line:84%
is that guy on the naughty list?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:29.035 --> 05:30.460 align:middle line:84%
is that guy on the naughty list?

140
05:30.460 --> 05:31.660 align:middle line:84%
Is that known for malware?

141
05:31.660 --> 05:32.880 align:middle line:84%
Is that known for spam?

142
05:32.880 --> 05:35.338 align:middle line:90%
And we can look that up right
here on talosintelligence.com

143
05:35.338 --> 05:36.110 align:middle line:84%
as well.

144
05:36.110 --> 05:37.850 align:middle line:90%
And what we'll do
in the next video,

145
05:37.850 --> 05:40.142 align:middle line:90%
I'll walk you through an
example of doing exactly that.

146
05:40.142 --> 05:42.267 align:middle line:90%
So I'll see you in a few
moments in the next video.

147
05:42.267 --> 05:44.530 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

148
05:44.530 --> 05:47.670 align:middle line:90%
and I'd like to thank
you for viewing.