Threats - Common Equipment Vulnerabilities

One of the things that I've really enjoyed about my IT career is that when I ordered a new piece of equipment, I'd get it, open it up, and it felt a little bit like I was getting a present. Sure, the company is the one that bought it and they're the ones that owned it, but I got to play with a new piece of equipment. It was really cool and exciting. Of course, with that came a certain level of responsibility. Some of it was that I had to set it up and get it running, but I also had to do it in a secure manner. So let's talk about some common equipment vulnerabilities, things you have to think about when you unpackage something to make sure that you're setting it up securely.

Every time you add new equipment to your network, you're actually adding vulnerabilities to your network. We're going to talk about some of the common vulnerabilities you're adding to your network: things like default settings, unused services, outdated software, misconfigurations, and some technology issues that happen with just the equipment when you're adding it to your network.

Default settings

Let me give you a little scenario. Let's say you just got a new switch and you're excited about setting it up. You put it on the rack, you put some power to it, you connect devices on there so they can start communicating, and it doesn't work. Things are not communicating and the equipment is not functioning as you want it to. That would be really frustrating, and the manufacturers get frustrated with that as well, because then you're calling them and you're complaining about their equipment not working, trying to figure out why it's not working.

That is why equipment comes to you with things already functioning, with things that are already working. There's a certain amount of things that are functioning on a piece of equipment so that way you don't get frustrated and the vendor is not getting frustrated either.

Let me give you an example of this. The Cisco switch is what I'm displaying right here, and this Cisco switch is going to come to you already functioning. You can plug power into it, you can start plugging devices into it, and it's going to start communicating. But that is not the most secure way to handle this piece of equipment. The more secure way of handling this piece of equipment is to shut things off, like ports. But it comes set up so that way it already can communicate, and it comes with a default username and password. That's not the most secure way of doing things: the same username and password that would be on this device, or no username and password to get onto this device. You're going to want to change those default settings.

So the default settings are set up for your experience to start out in a positive way, but not set up to make things secure. By default, things are unsecure.

Unused services

The same thing goes true for different services that are running on these different pieces of equipment. Whether it's a switch or whether it's a computer or a server or whatever it is, it probably has some sort of computing component to it, and that computing component has different processes that are running, or different services that are running. Those services give it functionality. They're going to want a certain amount of functionality with the equipment right off the bat so that way you start out with a positive experience. Can you imagine a computer that you get where you have to start turning on different services to gain access to the internet, to gain access to other resources, to be able to do certain things on the computer?

So you end up with these devices coming with a lot of services that are running. The problem is that those services each have their own weaknesses, those services each have their own vulnerabilities, and so the more services that you have running on these devices, the more problematic it is. The fact that this equipment comes with unused services that you don't ever plan on using, and comes with them already turned on, is problematic. It's a security concern. They do that so you start out with a positive experience, but it causes vulnerabilities on your system.

Outdated software

Another thing that happens when you get new equipment, whether it be a server, whether it be a computer or a switch, is that it's going to have outdated software on it. The manufacturing process, the time that it rolls off the assembly line, the shipping time, the time it gets to you, is going to be delayed from the time that the image was actually put on that machine, the software that was actually put on that machine. During that time there's probably a lot of fixes that have come out, fixes for vulnerabilities. So if you were to take that machine and just put it on your network without updating it, then you're putting a machine on there that has vulnerabilities, and you need to update that before you actually put it on your network.

Misconfigurations

So what is it that you need to do? You need to update, you need to patch, you need to configure things so that way it is more secure. But of course that comes with its own set of vulnerabilities, because we're human and we're flawed. We can introduce problems onto these different pieces of equipment as well.

When's the last time you set up this piece of equipment, or have you ever set this piece of equipment up before? Have things changed since the last time you've set up this piece of equipment? Are you consistently rolling equipment out in a consistent manner, so do you have documentation on how to do that? Are you following best practices? There's a lot of things that can creep in, which is why misconfiguration is actually one of the most common ways that we introduce vulnerabilities onto our network.

Inherent issues with the technology

There are also inherent issues with the technology itself. An example of this is wireless. Wireless is something that we use out there and is really prevalent because it's really convenient, but it's being broadcast. All your messages are being broadcast everywhere, and anybody can listen to those messages that are being sent out. So that's problematic with the technology itself. Wireless is not known to be secure.

You'll also have things like new technology, like the Internet of Things. We are constantly getting more and more equipment out there that has not traditionally been equipped with networking and now is. You're introducing all of these new technologies, and new technologies have not been tested yet, so that can be problematic.

The reverse is true as well. IP version 4 is an old technology, so we've got these protocols out there that are really old that still have the inherent issues that they had a long time ago, and so that can be problematic as well.

Even things that we think of as being secure, like encryption. Encryption is something that we do to secure things, but the problem is that our encryption algorithms get outdated. There are new encryption algorithms that are coming out, there are new standards that are being created, so that way we make sure that we maintain a certain amount of security with them. If you're not upgrading even your encryption, then that can become problematic because it gets outdated. So we need to make sure that we're thinking of all these inherent issues with the technology and compensating somehow for these inherent issues.

Doing nothing is itself a vulnerability

One thing that I hope I've impressed upon you is that the lack of doing anything is a security concern in itself. You have to do something, and there are a lot of things that you should be doing: things like equipment hardening, password management, physical security, redundancy, backup, policies and procedures, a security program, documentation, encryption, logging, monitoring, alerting, basic security principles. The lack of any of these things is problematic and creates problems, and we're going to be tackling that in a future module. Just know that the lack of doing anything is going to be problematic as well.

So a piece of equipment is going to just be insecure by its nature. It's going to come with default settings on it, it's going to have a bunch of services that are running on it, it's going to come with outdated software, and we're going to have to start configuring that piece of equipment and updating it to make sure that it's more secure. But that comes with issues in itself: are we misconfiguring things, are we configuring it correctly? And then there are a bunch of vulnerabilities within technology itself. There are ways that we can compensate for all of these, and so there are things that we put in place that we are going to talk about in the rest of this course to make sure that we are secure. So that is common equipment vulnerabilities.