Chapter 1 - 05 - Understand Different Types of Vulnerabilities - 03_ocred.pdf

Certified Cybersecurity Technician Information Security Threats and Vulnerabilities Exam 212-82 Design Flaws o O Design vulnerabilities such as incorrect encryption or the poor validation of data refer to logical flaws in the functionality of the system that attackers exploit to bypass the detection...

Certified Cybersecurity Technician Information Security Threats and Vulnerabilities Exam 212-82 Design Flaws o O Design vulnerabilities such as incorrect encryption or the poor validation of data refer to logical flaws in the functionality of the system that attackers exploit to bypass the detection mechanism and acquire access to a secure system Copyright © by EC- L. All Rights Reserved. Reproduction ks Strictly Prohibited Design Flaws Vulnerabilities due to design flaws are universal to all operating devices and systems. Design vulnerabilities such as incorrect encryption or the poor validation of data refer to logical flaws in the functionality of the system that attackers exploit to bypass the detection mechanism and acquire access to a secure system. Module 01 Page 132 Certified Cybersecurity Technician Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Information Security Threats and Vulnerabilities 0O Due to vulnerabilities in the operating systems, applications such as Trojans, worms, and viruses pose threats Exam 212-82 (‘E\ OPERATING SYSTEM /;;' ALALN =~ Q These attacks use malicious code, script, or unwanted software, which results in the loss of sensitive information and control of computer operations I All Rights Reserved. Reproduction is Strictly Prohibited. Operating System Flaws Due to vulnerabilities in the operating systems, applications such as Trojans, worms, and viruses pose threats. These attacks use malicious code, script, or unwanted software, which results in the loss of sensitive information and control of computer operations. Timely patching of the OS, installing minimal software applications, and using applications with firewall capabilities are essential steps that an administrator must take to protect the OS from attacks. Module 01 Page 133 Certified Cybersecurity Technician Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Information Security Threats and Vulnerabilities Exam 212-82 Default Passwords ORI ponom » Manufacturers » provide users with default passwords to access the device during When users forget to update the passwords and continue using the default passwords, they its initial set-up, which users make devices must change and systems for future use vulnerable to various attacks, such as brute force and dictionary attacks Copyright © by E. All Rights Reserved. Reproduction ks Strictly Prohibited Default Passwords Manufacturers provide users with default passwords to access the device during its initial setup, which users must change for future use. When users forget to update the passwords and continue using the default passwords, they make devices and systems vulnerable to various attacks, such as brute force and dictionary attacks. Attackers exploit this vulnerability to obtain access to the system. Passwords should be kept confidential; failing to protect the confidentiality of a password allows the system to be easily compromised. Module 01 Page 134 Certified Cybersecurity Technician Copyright © by EG-Gouncil All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Information Security Threats and Vulnerabilities Exam 212-82 Zero-Day Vulnerabilities Unknown vulnerabilities in software/hardware that are exposed but not yet patched ? These vulnerabilities are exploited by the attackers before being acknowledged and patched by the software developers or security analysts Zero-Day Vulnerabilities Zero-day vulnerabilities are unknown vulnerabilities in software/hardware that are exposed but not yet patched. These Vulnerabilities are exploited by the attackers before being acknowledged and patched by the software developers or security analysts. Zero-day vulnerabilities are one of the major cyber-threats that continuously expose the vulnerable systems until they get patched. Module 01 Page 135 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Information Security Threats and Vulnerabilities Exam 212-82 Legacy Platform Vulnerabilities - 01 = |egacy platform vulnerabilities are caused by obsolete or familiar codes (174 am * Legacy platforms are usually not supported when patching technical assets such as smartphones, computers, loT devices, OSes, applications, databases, firewalls, IDSes, or other network components = This type of vulnerabilities can cause costly data breaches for organizations All Rights Reserved. Reproduction is Strictly Prohibited. Legacy Platform Vulnerabilities Legacy platform vulnerabilities are caused by obsolete or familiar codes. Legacy platforms are usually not supported when patching technical assets such as smartphones, computers, loT devices, OSes, applications, databases, firewalls, intrusion detection systems (IDSs), or other network components. This type of vulnerabilities could cause costly data breaches for organizations. Legacy systems can be secured using other security controls, rather than by fixing them. Another possible solution is to segregate these systems from the network so that attackers cannot gain physical access to them. Module 01 Page 136 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited.