Discovering Vulnerabilities

Knowing the vulnerabilities that are out there is just half of the equation. Now what we need to do is discover those vulnerabilities on our network. So what are some methods of identifying what vulnerabilities we have within our infrastructure?

Here are some different ways of identifying vulnerabilities. We could be identifying because we're doing some sort of active scan. We could be doing an audit. We could be checking our code, if it's software, for different vulnerabilities. We could hire out a pen test or attempt to do it ourselves. We could have a disclosure program. Or we could just be looking at different forums and feeds and seeing if there are different vulnerabilities that we might find on our network.

Vulnerability scans

A big way to do this is vulnerability scans, and there's lots of things to think about from a vulnerability scans standpoint, so I'm going to do a whole lesson just on vulnerability scans. But essentially what it is, is we can load up software — maybe this is a server — and we load up certain software on here, and then it will scan the network for different assets and different devices, and then be able to look at those devices and see if there's any vulnerabilities based off of known vulnerabilities.

Application security

We also might be a company that's developing some sort of application, or we're doing coding. In this case we need to be thinking about application security, and there are several tools out there and several different approaches to discover vulnerabilities within the applications and the code that we're developing.

One way we might do this is some sort of code review. I create code and then pass it over to some sort of other developer, or somebody else that's going to do a review to make sure my code doesn't have any security risks involved with it, that there's no vulnerability to it.

There's also different scanners and tools that I can use, that I can set up to do this kind of scanning. Perhaps it's doing some sort of static analysis, where it's analyzing the code and looking for issues within the code. Or maybe it's actually running the software, running the code, and then seeing how it responds. So there is both static analysis and dynamic analysis. Then I could also hire somebody else to come in and do some sort of pen testing against my application.

On a similar note, we should be doing some sort of package monitoring. On your computers you have a lot of different software that's being run and that's been downloaded from somewhere. We call these packages — there's packages that are downloaded from other sources and installed on the computer. Well, those packages get updated now and then, so we need to do some sort of package monitoring to understand if there's security holes in these and when to update those packages.

Threat feeds and information sharing

We may also want to find out what are the hot vulnerabilities that are out there, so we might scan certain threat feeds and news feeds for certain vulnerabilities that might exist on our network, and then try to find those vulnerabilities on our network.

One example of that is there's a lot of organizations out there that are set up for information sharing, specifically around vulnerabilities and risk management. There's organizations out there that you can go and look at their feed and find out what are the hot topics right now.

There's also open-source intelligence, or OSINT. OSINT is any sources out there that are just giving away this information for free, and so there's a lot of them out there — information sharing organizations that are just open source, and anybody can grab that information.

There's also some proprietary third-party information that's out there. There are organizations that are taking information from all of these other sources and putting them in one spot, that you could actually do maybe some sort of subscription to, or it's part of the vulnerability scanning, and so that's a solution as well.

Then there's the dark web. This is kind of the hidden part of the internet, where you have to know how to get to it, and a lot of this stuff is untraceable, so it's a place where a lot of nefarious activities are happening, where people are doing some illegal trading and stuff. The dark web might also be a source, though, where we can find out what are the vulnerabilities that might not be broadcasted at other sources quite yet.

Some places that we find information sharing would be vendors' websites — there are different vendors out there that have websites that offer this information. There are advisory boards that are out there, and there's also bulletins and news feeds that you can get access to. I used to subscribe to an email news feed where it would just send me emails whenever they found a hot topic, a hot vulnerability, so that I would know to go and look and see if these vulnerabilities existed on my network.

Here's the ISACA website. ISACA stands for Information System Audit and Control Association, and this is a great site for a lot of information sharing. So this is one organization that shares a lot of the information that we can go to and find out details about current vulnerabilities.

Pen testing and adversary emulation

Pen testing is another way that we can identify vulnerabilities on our network. We may hire somebody — typically I would hire somebody out — or maybe you have a team member that does this internally. But you do some sort of pen testing where they're trying to penetrate the network and gain access to the network, for the purpose of identifying vulnerabilities and fixing those vulnerabilities.

Pen testing is an approach that tries to get any way into the network to see if there are vulnerabilities and find those vulnerabilities. Adversary emulation looks very similar to that. The difference, though, is that it's going to adopt some sort of technique in trying to break into your network, to see if your network is vulnerable to that type of technique. So they would go out there and choose a technique that hackers are currently using, and then use that technique to see if they can break into your network.

Disclosure programs and bug bounties

Companies have also set up responsible disclosure programs. What they do is they put out there that they will pay people to test for vulnerabilities, and so they will hire hackers to come in and try to hack the network essentially. Then if they were to hack something or expose a vulnerability, they get what's called a bug bounty. A bug bounty is something that they get paid for finding a vulnerability, so they get a bounty — in this case that's like money or something like that — if they find bugs in the system.

System and process audits

There's also a lot of system and process audits that can take place. I try to do these at least on a yearly basis, and depending on what we're talking about, sometimes a lot more often. There are checklists and things that I will have my team go through that will check, maybe for instance, the firewall to make sure that it's functioning well, maybe switches, maybe there's other devices on the network to test to see how well they're working against some sort of audit.