Vulnerability, Threat, and Risk

Vulnerability, Threat, and Risk

• Vulnerability is a weakness or gap in protection
• Outdated software versions with known security flaws exemplify a vulnerability
• A threat is something that can damage or destroy an asset
• Malware attacks, which target vulnerabilities in computer systems, are threats
• Risk is where assets, threats, and vulnerabilities intersect
• Risk assessment for a data breach involving sensitive customer information is an example

Group Activity 1: College Laptop Theft Scenario

• A college's MySecondTeacher (MST) contains sensitive personal data (student records, academic transcripts, and financial information)
• An administrative staff member accidentally leaves their laptop unattended
• The laptop is stolen
• The vulnerability is the lack of physical security measures for protecting laptops containing sensitive data
• The threat is theft of the laptop and potential unauthorized access to sensitive information
• The potential risks include data breaches, identity theft, and reputational damage to the college
• Proactive measures to enhance security and mitigate risks include:
  • Implementing encryption for sensitive data stored on laptops
  • Enforcing strong password policies
  • Providing staff training on security protocols
  • Implementing remote wiping capabilities
  • Conducting regular security audits and monitoring

Understanding Vulnerability Types

• Confidentiality protects information and systems from unauthorized access
• Disclosure is revealing information that was previously confidential or secret
• A data breach is an unauthorized access or disclosure of sensitive information
• Data exfiltration, also known as data theft, is the unauthorized transfer of data from a computer or network to an external location
• Integrity protects information and systems from unauthorized modification
• Alternative attacks are methods or techniques employed to compromise security or achieve malicious objectives
• Availability ensures that information and systems are available for authorized users when needed
• Denial attacks disrupt or prevent legitimate users from accessing services or resources

Risk Categories

• Financial Risk: The potential loss of financial resources due to adverse events, or uncertainties in activities
• Reputational Risk: The potential damage to an individual's or organization's reputation or brand image
• Strategic Risk: The risk that strategic objectives or goals will not be achieved
• Operational Risk: Potential risk from internal processes, systems, or human factors resulting in losses, disruptions, or liabilities
• Compliance Risk: Potential risk of failing to comply with laws, regulations, standards, or internal policies

Supply Chain Vulnerability

• End of life constitutes the cessation of production and support for a product
• Lack of vendor support means absence of assistance or updates from the manufacturer
• An embedded system is a specialized computing device with limited functionality, often integrated into larger systems

Configuration Vulnerability

• Default Configuration poses a vulnerability
• Follow documentation standards and configuration baseline to prevent vulnerability
• Cryptographic Vulnerability poses a vulnerability
• Patch Management (OS, firmware and application)
• Access control

Malware

• Propagation Mechanism: The way a malware object spreads
• Payload: The malicious action that the malware performs

Virus, Worm and Trojan

• Virus: Attacks the files in a system
• Worms: Attack systems in a network
• Trojans: Attack the users in a system
• Viruses replicate
• Worms replicate
• Trojans do not replicate
• Viruses spread through human interaction
• Worms spread by themselves
• Trojans Poses as beneficial software

Payload

• Spyware: Gathers information from a device without the user's consent
• Adware: Displays advertisements and tracks user data
• Bloatware: Consumes excessive system resources and storage space
• Ransomware: Encrypts files or locks a device
• Crypto-malware: Mines cryptocurrency

Backdoor and Logic Bombs

• Backdoor: A hidden method or vulnerability intentionally inserted into software or systems for unauthorized access
• Logic bomb: Code inserted into software or systems that triggers a malicious action under specific conditions.

Attributes of Threat Actors

• Motivation: Understanding the driving force behind an attacker's actions, whether it's financial gain, ideology, or sabotage.
• Capabilities and Skills: Assessing the technical expertise and proficiency of threat actors in executing attacks.
• Resources: Evaluating the availability of financial, technological, and human resources at the disposal of attackers.
• Tactics, Techniques, and Procedures (TTPs): Recognizing the specific methods and strategies employed by threat actors to achieve their goals.
• Targeting Strategy: Identifying the types of targets actors prioritize based on their objectives.
• Geographical Location: Considering the geographic origin of threat actors for attribution and threat analysis.
• Level of Sophistication: Gauging the sophistication and complexity of attacks carried out by threat actors.
• Persistence and Adaptability: Observing the persistence and ability of threat actors to adapt their tactics in response to defenses.

Advanced Persistent Threat (APT)

• Is a type of cyberattack performed by hackers to establish an illegal, long-term connection with a victim's network to steal highly sensitive information.

APT Work Method

• Access: Hackers introduce malware
• Settle: Hackers gain access to a system
• Stretch: Hackers search for opportunities to gain administrator rights
• Move: Hackers dig deeper into a network
• Persist: Hackers remain in place until they've achieved their goal

How to Manage APT

• Protect the perimeter: Limit and control access to the firewall and the physical space.
• Monitor everything: Gather everything you can about your data.
• Apply data security analytics: Compare file and user activity to baseline behaviors.

Attack Surface

• Attack surface constitutes the possible points where an unauthorised person can exploit the system with vulnerabilities
• Digital Attack surfaces are classified into three types
• Physical attack surface
• Social Engineering Attack Surface

Attack Indicators

• Account Lockout
• Concurrent session use
• Imposible travel time scenario
• Block contains
• Resource consumption
• Resource inaccessibility
• out-of-cycle logging
• Missing log

Various Types of Attacks

• Social Engineering attacks: Phishing, Spear phishing, Pretexting, Baiting, Tailgating.
• Password attacks: Brute force attacks, Dictionary attacks, Rainbow table attacks, Credential stuffing attacks.
• Application attacks: SQL injection, Cross-site scripting (XSS), Cross-site request forgery (CSRF), Remote code execution (RCE).
• Cryptanalysis attacks: Brute force attacks, Known plaintext attacks, Chosen plaintext attacks, Birthday attacks.
• Network attacks: Denial of Service (DoS) attacks, Distributed Denial of Service (DDoS) attacks, Man-in-the-middle (MitM) attacks, DNS spoofing attacks.