Lesson 8: Vulnerability Management

Device and OS Vulnerabilities

System States:

• Legacy Systems: Old systems still being used but outdated, rare support
• EOL (End-of-Life): No support at all, officially retired
• EOS (End-of-Support): No updates or technical help
• Obsolete: Extremely outdated, incompatible with modern systems
• Unsupported: Not officially supported but may still function
• Deprecated: Still works but discouraged, will be removed
• Retired: Formally decommissioned, no longer in use

Other Vulnerabilities:

• Firmware Vulnerabilities: Embedded software flaws, difficult to detect/patch
• Virtualization Vulnerabilities: VM or hypervisor weaknesses (escape attacks)
• Application Vulnerabilities: Security flaws in installed software
• Zero-Day Vulnerabilities: Unknown by vendors, unpatched, actively exploited

Misconfigurations:

• Default credentials unchanged
• Unnecessary open ports/services
• Poor cloud or system settings

Cryptographic Vulnerabilities:

• Weak Keys: Short or poorly generated, can be brute-forced
• Deprecated Algorithms: MD5 and SHA-1 no longer secure
• Misconfigured Cipher Suites: Weak or improperly used encryption
• Unprotected Keys: Keys exposed or stored insecurely

Mobile Device Risks:

• Sideloading: Installing apps from non-official sources (APK files)
• Rooting (Android): Gaining root privileges, exposes system
• Jailbreaking (iOS): Removing iOS restrictions, increases attack surface

Application and Cloud Vulnerabilities

Application Vulnerabilities:

• Race Condition: Two processes access same resource simultaneously in unexpected order
• TOCTOU (Time-of-check to time-of-use): System state changes between verification and action
• Memory Injection: Malicious code injected into memory
• Buffer Overflow: Excess data overflows into adjacent memory
• Malicious Updates: Compromised update packages
• Type-Safe Programming Languages: Enforce type rules (Java, C#, Rust, C) to prevent memory vulnerabilities

Evaluation Scope for Secure Development:

Security testing, documentation review, source code analysis, configuration assessment, cryptographic analysis, compliance verification, security architecture review

Web Attacks:

• XSS (Cross-Site Scripting): Injects malicious scripts into web pages
• SQLi (SQL Injection): Manipulates SQL queries
• CSRF (Cross-Site Request Forgery): Forces users to execute unwanted actions

Cloud-Based Vulnerabilities:

• Cloud Attack Platforms: Attackers abuse cloud services (launching bots, malware, DDoS)
• Cloud Misconfiguration: Public S3 buckets, overly permissive access
• CASB (Cloud Access Security Broker): Monitor and enforce policies

Supply Chain Risks:

Vulnerabilities from vendors (hardware/software), Example: SolarWinds

Tools:

• SBOM (Software Bill of Materials): Lists all components in software
• Dependency Analysis: Scans third-party dependencies for vulnerabilities
• Code Signing: Confirms code is authentic and unaltered
• Vendor Risk Assessment: Reviews vendor security practices

Vulnerability Identification Methods

Vulnerability Scanning:

Tools: Nessus, OpenVAS (Greenbone)

• Credentialed Scan: Uses login credentials for deeper checks
• Non-Credentialed Scan: Surface-level, less accurate

Other: Web/App scanners, package monitoring

Threat Feeds:

Real-time updates on emerging threats Sources: MITRE ATT&CK, IBM XForce, Mandiant, Proofpoint, Abuse.ch, OSINT, ISACs, blogs, forums, dark web

Deep and Dark Web:

• Deep Web: Not indexed by search engines
• Dark Web: Anonymous overlay networks (TOR), illicit content

Other Assessment Methods:

• Penetration Testing:
  • Unknown environment: No internal knowledge (Black Box)
  • Known environment: Full internal knowledge (White Box)
  • Partially Known environment: Partial knowledge (Gray Box)
• Bug Bounties: Public vulnerability discovery programs
• Auditing: Systematic review of configurations and activities

Vulnerability Analysis and Remediation

CVE System:

• CVE (Common Vulnerabilities and Exposures): Standard identifiers for known vulnerabilities
• NVD (National Vulnerability Database): U.S. gov database using CVEs, part of SCAP
• SCAP (Security Content Automation Protocol): Automates vulnerability management and compliance

CVSS Scoring:

• 0.1-3.9: Low
• 4.0-6.9: Medium
• 7.0-8.9: High
• 9.0-10.0: Critical

Vulnerability Analysis Factors:

• Prioritization: What to fix first
• Classification: Type/severity grouping
• Exposure: Can it be reached?
• Environmental Variables: Unique org factors
• Risk Tolerance: Acceptable risk level

Remediation Practices:

• Patching: Fix with software update
• Cybersecurity Insurance: Transfer financial risk
• Network Segmentation: Limit lateral movement
• Compensating Controls: Alternatives when fixes not feasible (legacy systems)
• Exceptions/Exemptions: Documented acceptance for low-risk cases
• Validation & Re-Scanning: Verify fix worked
• Auditing & Reporting: Track progress, meet compliance