Essential Security Principles

0:01Cybersecurity. Wow, what a topic. My name's James Conrad, and it's my pleasure to join you here in the Cisco Certified Support Technician certification for cybersecurity. Now, you can imagine how important this is. If you follow the news every week, there's some kind of major exploit that takes place where a major corporation, or a government, or nation state has lost lots of data, millions of records, sometimes social security numbers, credit card numbers, personally identifiable information, health information, all kinds of things can get stolen, even email.

0:38Did you know that email lists are really valuable? Yeah, I just saw some being advertised on the dark web. A list of millions of emails available for two Bitcoin. So yes, you can even buy those. And anyway, there's a lot of different kinds of things being stolen, and we need to really be sure what is involved in cybersecurity and understand how it works and how all the parts move together so that we can properly defend our systems against potential hacks.

1:08Yes, there's all kinds of hacks taking place. Just this year alone, AT&T, the University of Minnesota, T-Mobile, who else? Twitter, the United States Government. All of these organizations have had significant hacks that have taken place. So we're gonna be taking a look at what they are and how we can protect ourselves and others against these hacks. Alright, I'll see you in the next nugget where we'll start taking a look at vulnerabilities.

0:00All right, let's take a look here at vulnerabilities. This is really kind of the starting point for hackers. In order to be able to exploit something, they have to know of a vulnerability first. So they either look for those vulnerabilities, or they'll take a known vulnerability and then they'll write some kind of programming code against it. That's very often how it happens. Or some kind of a script or something like this. So what happens here? Well, first of all, again, there has to be a vulnerability for them to exploit. And what is a vulnerability? Kind of as the name implies, it's a weakness.

0:31It's a defect in operating systems, in software. It could be in a driver. It could be in hardware. So even hardware has software that's written into it, right? Normally, hardware will have circuits on it, and on those circuits is very often embedded code of some type, okay? Now, anyway, these defects are ultimately security loopholes that hackers can then exploit. And it's to be expected that there's gonna be vulnerabilities.

1:04All of this stuff's written by humans. But some of it's so huge, it's very difficult to manage. So for example, Windows 11. Windows 11. I'll put that up there. That has about 50 million lines of code in it. Now, even though Microsoft has a well-paid army of programmers, that's a lot of code. Something's gonna slip through the cracks. And it does, and then Microsoft will have to issue a patch for it or something. Another example. Well, Google. Google itself. I'll just put Goog.

1:34Google itself has about 2 billion lines of code across all of their various services and systems that they offer. So that's just way too much for anybody to be able to go through, even using artificial intelligence and other methods. There's gonna be a weakness there eventually that's gonna be found. And then once a hacker finds that weakness, then they will exploit it. Let's take a look here at some hardware examples. Yes, vulnerabilities exist on hardware. Why is that? Well, if you take a look at it, you'll have embedded circuits on hardware that a programmer has written something for.

2:12A good example would be maybe an internet of things device. IoT, internet of things. So for example, I've got on my wall right behind me over here somewhere a thermostat. That thermostat's connected to the internet, and I can control it here from my iPhone. So let's say, you know, here in Phoenix, it gets quite hot in the summer, and we might like to keep our air conditioning set at 72 degrees, which means it runs constantly. 'Cause even at midnight, it can be 100 degrees here. So anyway. But somewhere in there is a chip or a circuit of some kind that contains, that is, that contains code on it that controls all that stuff, that allows it to interoperate with the internet and my phone and all that kind of stuff, right?

2:55Well, there could be a weakness on there. And so an evil hacker person out here on the internet, they might find that weakness through the internet, find their way onto that code or onto that programming, and then from there they might be able to leapfrog to other systems. Maybe my laptop here. It's supposed to be a laptop. One thing you'll find out quickly as you join me in this course is I have very unique artistic skills, which is another way of saying that they're terrible. Anyway, there's my laptop. Maybe they could leapfrog over to that and exploit this thing.

3:26Maybe they could leap over to my phone or over to, you know, an iPad or something like this. So you see, very often a hacker only needs to find one little thing that's got a weakness in it, and then they can kind of leapfrog from one thing to the next and escalate privileges and lots of other kinds of things. Let's take a look at some hardware examples there as well. Rowhammer is one of those. It's kind of pretty well known, and it's been out for a little while now. But if you take a look at a memory module, this would be like a memory module.

3:57You've seen those probably in computers. I don't know where that came from. Let's get rid of that. You've probably seen that in various computers, like personal computers, where this will get inserted into the motherboard. And on these memory modules are various cells, okay? They actually appear on the little black chips that you see on there, those circuits, those little chips that are on there. And in those chips are cells. And the way that memory works is there's an electrical charge that gets written to these.

4:29Okay, I'll make a little different color here so it'll make it a little bit more clear. So there's electrical charges that might get written to that one. It's all binary, so something's turned on or turned off. And in computing, a combination of items that are turned on and off ultimately results in something. It might be the letter A or it might be a graphic or a photograph or something like this. Any different kinds of things. Anyway, it's all done by turning on or off one of these cells. Well, hackers have figured out a way using this rowhammer thing to be able to corrupt data.

4:59Maybe I've got valid data here that checks out, that's good data, but they might be able to exploit a cell next to it and hammer it. That's why it's called rowhammer. Hammer it with signals so fast and so hard that it can corrupt this data next to it. So anyway, that's an example of one of the hardware exploits. There's another one called Meltdown and Spectre. That's why I kind of got these graphics up here. They're so famous that they even allow you to download graphics advertising these particular exploits.

5:30And it's so famous, it even has a webpage. And here it is. I'll bring it over. Here it is. So you can see what happens here is that it exploits vulnerabilities in modern processors. Now, these are hardware vulnerabilities that could allow programs to steal data, which is currently processed on the computer. What happens here is that normally you'll have an application that's running, and that application has data that it works with. Let's say you have, I don't know, an open spreadsheet, okay? That spreadsheet is accessed by, say, Microsoft Excel, and it should be the only program that properly accesses that data.

6:06But Meltdown and Spectre are able to use other methods so that they could kind of hop over and access that data, even though they're not supposed to be able to access it. They actually have some good examples of how this works, by the way. These were actually discovered by some really smart people over at Google, actually. Google has something called Project Zero. There it is. So Jann Horn did this, and he's with Google Project Zero. They're the ones that look for a lot of security vulnerabilities and things like this.

6:38But anyway, you can see here there's a lot of pretty good FAQ there. And this is pretty interesting. If you look at this, it actually shows Meltdown in action. This is a screenshot of it. But this is all the registers within memory, a memory dump, and it's able to actually pull data out of it. You can see kind of somewhat readable data over here. It's able to pull that out of it. This is a good example right over here. Actually, let's just take a look at this. This is an exploit against a password manager. So we'll talk more about those later on. But a password manager is really actually a pretty good way to take a lot of complicated passwords that no human can really remember.

7:12And, you know, these big, long, complicated passwords that we're supposed to have for every different website we go to and all this stuff, it can be stored in a password manager, which is normally a good idea. But using Meltdown, they're demonstrating here how that someone could enter in, see they're entering in their password to unlock their password manager, and it actually shows up down here in this exploit. Okay? Here, in this other example, they're able to actually reconstruct an image that someone's using, okay?

7:42I won't go through it here, but you can see it also reconstructing a photo. So in other words, it's able to access data that it's not supposed to be able to access. And like I said before, it's such a famous vulnerability, they even have logos and stuff like that that you can download. Now, let's take a look at another vulnerability. I mentioned earlier that there might be something embedded in hardware, like an internet of things device. That would just be a vulnerability there. But there's some times when there's actually malicious code embedded in hardware. I first became aware of this, oh, a few years back.

8:14There's a news program here called "60 Minutes" in the United States, and they run a special on this where there's a company called Huawei. It's got a weird spelling, I'll show it to you here in a minute. It's a Chinese company, and they're actually embedding malware into their own hardware that they then sell to the unsuspecting American public and United States military. As a result, it's able to pull out data while it's going across the wire, while it's going across routers and things like this, because they build network equipment.

8:47So in other words, they put on their network equipment spyware that is able to siphon off data as it's transiting their networks, send it to China or whatever target that they have designated there. Here's how you spell Huawei that I was mentioning earlier. And I'll link this down below for you beneath this video somewhere so that you can see it. But Huawei has circuitry and embedded spyware, apparently, that they've put on mobile devices, network equipment, all kinds of things.

9:17And you can see, if you wanna read through this, you can. It's actually pretty interesting. The United States government is trying to ban the products from Huawei, in fact. Although, it's been going on for years, in my view, it's kind of a little bit too little, too late. Here's another example. I almost forgot to show you this one. Vodafone found hidden back doors in Huawei equipment. Now, this happened a little while ago, but a lot of that equipment is still out there. This article is dated 2019. And even though they've been called out many times, they still have a lot of this equipment out there.

9:49Here's another one, relating to Australia. With this one, Huawei installed malicious code on an Australian network, and it's in their telephone network, that recorded all communications and transmitted it to China. So without beating this dead horse, I just wanted to point out, I'm not just against Huawei on this, although they've been doing some dastardly deeds, I'm just saying that there are either weaknesses or outright exploits directly on some hardware devices that could also be exploited. Now, most of the exploits will take place against software, and I think we're kind of very well aware of that, probably.

10:24That's why you have, probably on a weekly basis, updates to your Windows machines, because they'll have security patches that address some of their weaknesses. Same would be true of your iOS devices, your Android phones, your tablets, all that kind of stuff. So the operating systems there or software on those devices will have a weakness that will then get a patch. Now, there's something else here as well, the SYNful Knock. SYN is a network communication where we'll send out communication to a destination right over here.

10:59And the destination normally replies with an acknowledgement that they received that network communication. Talk more about that possibly well into the future here. But this kind of an exploit right here is against the Internetwork Operating System. That's not Apple's iOS. That's Internetwork Operating System of Cisco. Now, how did this kind of thing get released? What happens here is if you download your updates from Cisco, you're gonna be fine, okay? There was an update that was supposed to be from Cisco that was masquerading as an authentic update from Cisco for their operating system, which controls their various network devices.

11:40And apparently, it wasn't actually from them. I don't know if somebody got an email that purported to be from Cisco. There was a fake email that said, "Click here to download the latest update for your router." And someone might have clicked on it, and instead they got this vulnerability that would then exploit that operating system. And then from there, they can, again, scoop out your data and all that kind of stuff.

0:00In our last nugget, we took a look at vulnerabilities and what they are. Now let's take a look at some examples of software vulnerabilities. There's actually quite a lot more than what you'll see on this particular slide, but some of them kind of branch off of what we see here, and they're various forms of what we see here. And some of them are also a little bit more obscure. But these are the main categories of the types of software vulnerabilities that you'll see, such as non-validated input. What does that mean? Well, this is the incorrect type of data that's being entered into something, okay?

0:33And it can take a lot of different forms, but very often you'll see this in maybe in a database form. So maybe, you know, you filled out a form that wants your, you know, your first name here, your last name here. Maybe you're ordering something on the internet or whatever. And maybe right here is where they want your address, okay? But what if you were to enter in something different there in the address field? Now these examples that I'm gonna show you are kind of examples where if a programmer were to write something like this or a database administrator were to write something like what I'm showing you, there'd be a pretty bad administrator, okay?

1:11They're very obvious weaknesses, but they do happen and they have happened. But you're not gonna find this kind of an example I'm about to show you on Amazon or eBay or something like that. So anyway, get back to the address field. So normally that'd be 123 Main Street or something like this, right? And that field is designed to accept alpha numeric characters. So because of that, I could possibly exploit that, depending on how this field has been configured. So what if I were, instead of putting an address in there, were to put in some kind of a path to a network script or something like that, like a Python script here or something like this.

1:50And again, you know, this is not gonna be happening every day, but there are certain weaknesses that could be accidentally left open here. So now if I'm malicious, I could go into this field and enter in a script, which could do just about anything, depending upon the level of privilege that I've elevated myself to. It could run system functions, it could crash the system, it could corrupt a database or corrupt a record at least. So any different number of things that could happen with this script. It just depends on how nefarious I am when I write that script.

2:23Another example of this would be, you know, there's the street address. You know, maybe I've got a field down here for postal code or zip code right here. Now, in terms of the non-validated input, what kind of data goes in a zip code? Do letters go in a zip code? No, it's only going to be numbers. So whoever created the form and manages the database, they should configure that field so that if someone tries to put in letters like this, it won't work. It should give a message to the user saying, only accepts numbers, or something like that.

2:57Or only accepts, I dunno, five digits or only accepts five digits dash, and then four digits for a more specific zip code. But again, with the non-validated input in the zip code. So my zip code here, maybe it's 85032. What if instead of a zero there I put an O. Okay, the letter O instead of a zero. What would that do? Would it cause something to freeze up? Would it cause some other kind of a problem? Who knows? There's a lot of different things that could happen as a result of this, but that's what the non-validated input is about, is where the incorrect type of data is put into a field.

3:34And that can then exploit that poorly designed form or that poorly designed database. How about looking at race conditions here? This is where there are two or more actions that are supposed to take place in a sequence. So it's supposed to be, you know, action number one, and then action number two, and then action number three and four and five and so forth. So what if we could force some of those to go out of order? What if we made it go action number one, and then action number three, and then number two and four and five. Well, we've obviously switched a couple of those right here.

4:07What would happen if we did that? It kind of depends on what the data is. So for example, you could see here I said, you know, in e-commerce multiple uses of of a coupon code, for example. Maybe we were trying to exploit a 50% off coupon code and it was one time use only per customer. Well, if we could rearrange the order of these, so it checks to see whether I've used that coupon code at a later point in time, and then I've actually been able to enter in that coupon code, I dunno, five different times, then by changing the order of this, the check that it makes to see if the coupon's been used or not yet, well, I might be able to use that code multiple times there before it gets checked to see whether it's been used only once.

4:49There's also processing the order before the payment. You know, maybe I could do something like that. These are simple examples, but maybe I am, I don't know, buying a big screen TV or something like this in a particular form. And you know, again, I've entered in my name here, my address, you know, whatever else it is. And normally after you enter all this in and you've selected the item that you want to buy, maybe the next page will have the payment processing that takes place there. But maybe in a race condition, I figured out a way to go ahead and send the order to processing before the payment page.

5:21So now it's in their order processing system and I'm able to cancel it before I actually get to the payment. Well, too late that ship has sailed. Now it's already in their order fulfillment. And someone's gonna send me a TV. I say that as if I've done it before. I assure you I haven't. Anyway, how about this next one, buffer overflow. Wow, this one's a common one that can take a lot of different forms and be used in a lot of different kinds of exploits. But what happens here, it's gonna shove more data into memory than it was designed to hold. So let's say I have an application here, and this is the application's memory allotment right here.

5:57Maybe it's designed to hold, I don't know, one megabyte of data, and that's for the executable program, maybe any temporary files that it needs to load, all that kind of stuff. But it's only designed to use one megabyte of this data. Well, a hacker, what they might be able to do, is to shove up some more data into this, which might cause some data to overflow outside of the bounds of this memory. And then from that point, a few different things could happen. Number one, I might shove that data out, but I might shove in code of some kind or something malicious here, malware, whatever it is.

6:33And now that code could operate under the same privileges of whatever this application is. What if this was a privileged application that had access to confidential data or something like that? Well now, my malicious code could potentially access that same kind of data or those same resources that the user who launched this application could access. Or another thing that could happen is what shoots outta the top of this. I might be able to figure out a way to shoot out code into this data that's been shot outta the top of this memory allocation.

7:07And that might be executable code or otherwise malicious as well. Now, notice that here, it's outside of the bounds of the memory. Well, what controls it then? I actually don't know. It could be anything. It could be the operating system. Now it might be operating underneath the privileges of the operating system itself, which can do anything. There's no limits to what it can touch, what it could destroy, what it could access. And from there it could go to a lot of other places. It might be able to hopscotch into other applications, access certain kinds of data, or very often this kind of thing right here is also very unstable and it could just crash the system or terminate the application where that buffer overflow happened.

7:46And that might be another reason why a hacker would do it, is they just want to vandalize the application or be a nuisance. When this kind of thing happens by the way, even though this whole thing crashes, the original data that it was using, this one megabyte, I know it's getting messy here, but that original one megabyte of data memory, that could now potentially become a memory leak. What does that mean? It means that it's being used by the operating system and it's being accounted for because the operating system thinks the application needs it, even though the application's already crashed and it just leaves that one megabyte open.

8:19Now, hacker might figure out a way in a buffer overflow to cause this to happen dozens or hundreds of times. And pretty soon you're out of memory and hence they've crashed a server, because it has no memory usage anymore. Or they really slow it down because it's forcing it to use what we call a swap file instead, which is much slower than using actual ram. There's also weak security practices that could be occurring here as well. So for example, when a developer's first creating an application, you know, in their mind they're thinking, okay, we're in a kind of a, what we call a sandbox environment very often.

8:53And this is an environment where since the program that we're developing is new and not yet stable and we haven't gotten all the bugs fixed and all that kind of stuff, it could crash stuff. So in this sandboxed environment, since it's already kind of protecting itself from the rest of the operating system and any other important systems, sometimes it's easy to get a little bit careless with that, because maybe they'll just run it at a higher level of privilege than it really needs. One time I saw a webpage, okay, webpage here and the source code, which is just HTML and XML data actually, it actually had the admin password here, that's supposed to be ADM admin password because I guess a few of the developers that were working on this wanted to make sure that that password was available so that other administrators could log in and do whatever they needed to do while they were developing this code.

9:45You know, it's a little bit kind of a weakness, not ideal to do it that way, but an isolated environment, I guess you know, they thought they could get away with it. The thing is, they forgot that they had that in there. And so when they then put the webpage into production, that admin password was still there and anybody that would analyze that webpage could then find the admin password. So that's just a weak security practice. There's lots of other, you know, weak security practices that could occur there. But other things that are involved in that are what kind of authentication you use, and authorization and encryption, all of those different kinds of things can protect your data and protect your applications and operating system.

10:26Generally, you don't wanna recreate the wheel. There's lots of good methods that are already in place to encrypt things. So you might use Windows encryption, for example, to encrypt hard drives, to encrypt data. Those are good security practices. So for example, on a laptop, you might want to use encryption on that hard drive in case that laptop gets stolen or something like that. Then that data might be useless to anybody. So that would be a good security practice on something like a mobile device, for example. And then there's also things such as access control.

10:57This largely relates to things like permissions. So for example, in a certain form, for example, depending upon who you've logged on as, you might have permission to enter in certain data into forms. If you're a supervisor, then you might have a different level of permission to enter into a form on your web application, for example. On simpler terms, and very common, would be in our file system. So you know, here I've just got, you know, an empty drive almost empty anyway, so let's just create a new folder here. I'll just call this, you know, secrets.

11:28And we wanna make sure that that gets protected. We don't want just anybody to be able to access any files that I might put in there. So this is just a simple example of working with the permissions there. But I could go to properties right here and then go down here to sharing. And once I'm in this, I can go to, in my case, advanced sharing and then share this folder. Then I want to go to permissions and specify who can access it. Right now everyone can read what's in there, as you can see. That's probably not ideal. I really would rather not have everyone reading whatever secrets I put in that particular folder.

12:02So what am I do instead would be to remove everyone and then add in a specific person. So I'm trying to think of another account I have. Lab admin is one I have. There we go, lab admin right here. And that's just an account that I created for a different course and everything, but I'm just using it as an example, all right. Maybe I want that account to have full control and that's the only account that I want to be able to have any access over this particular folder and any of the contents that get created in it. And now, anybody else that everyone, which is literally just that, everyone.

12:34or any other user accounts or groups will not be able to access this.

0:00Now here I just want to kind of mention that I'm taking a lot of our material, of course, from the Cisco Certified Support Technician Cybersecurity Objective Domains. This is available from Cisco's website. If you're interested in this certification, you've probably already seen the website where you can go for this. I'll put a link down below in case you haven't already seen this. But one of the things you can get from there is this PDF file of all of the exam objectives if you're interested in the exam, even if you're not a test taker, these are all good things to know.

0:32So reason why I'm going over this right now is because I'm about to cover additional terms and things like that that appear kind of throughout this area right here, and I'm just kind of putting them up on a slide so that we can make sure that we have kind of common terms that we understand right through here. So we're gonna address some of those additional security terms. One of those terms here would be simply an exploit. And we've kind of already addressed that a little bit because we talked about vulnerabilities earlier. Vulnerabilities really just kind of are weaknesses that sit there by themselves until someone exploits them.

1:08And then when they perform the exploit, then they access your data or they log in to your network when they shouldn't be able to or that kind of stuff. So basically the exploit is the software that's written to exploit a vulnerability. In other words, that's the attack, when they actually run that exploit software, that exploit script against a vulnerability. There's also risks. Now, one thing you have to understand right from the beginning with cybersecurity is we're all at risk. No matter how well you lock down your systems, remember there's millions and billions of lines of code that there's gonna be a weakness in there somewhere.

1:46Eventually somebody will find it. So in terms of cybersecurity from a professional viewpoint, we're kind of always on the defensive. There's gonna be something that gets exploited eventually, but you want to try to reduce that risk as much as possible. So just wanna make sure that we understand every organization's at risk. Doesn't matter if you have good firewalls and inner malware protections in place. All kinds of other things that we'll be discussing throughout this course. Our responsibility though, professionally, is to secure as best as we can and to, we do what we call reducing the attack surface or hardening ourselves as a target here.

2:24So let's say that you became a new cybersecurity specialist or an IT admin at an organization where you inherited somebody else's infrastructure and their mess, so to speak. So maybe when you get there, this is the size of the attack surface. It could be a, maybe it was originally a small family run business and aunt Judy kinda was pretty good with computers so she set up all of our computers and everything like that. But then it grew and now we have, I don't know, a couple hundred employees here.

2:55And as time went by, we realized, or they realized that it wasn't very secure. So they hired you to come take a look at things. All the folders were open to everybody, all the file resources were open, anybody could access them at any time. You could be a warehouse worker and gain access to the tax records of the organization or the bank account numbers or any of that kind of stuff. So that's a very large attack surface (laughing) because anybody can access anything and probably including people from the internet that we don't want to access it.

3:27So that's pretty big. What we want to do is to reduce that attack surface. So maybe we start to apply passwords or a better yet, access controls. So like I showed you in the last nugget, when you could put permissions on a folder to control who can access it, maybe we, or shrink that circle, we shrink that attack surface inwards here to make it smaller and smaller. What other kind of things could we do? Well, maybe we don't really have any network firewalls to protect us from the internet.

3:57That's a big one. So we put in some firewalls here, one or more firewalls to shrink the attack surface or the target a little bit more. We're hardening our security profile here. What else do we do, well maybe we didn't have all the updates we need on all our software. So we make ourselves even a smaller target here, okay? We keep shrinking the size of our target. What else can we, maybe we have user accounts with easy passwords that some people have never changed their passwords in the 10 years they've worked at this company and their real simple passwords, like password.

4:31So we shrink our target here a little bit more, forcing everyone to change their passwords to complicated passwords. So anyway, that's a little bit of what's going on there. When we reduce our attack surface or harden our attack surface, we're just making it harder and harder and harder for an unauthorized party to be able to access our resources. There's also threats. There's a couple of different kinds of threats here that you should be aware of. One of those would be external. So remember when I said we might implement firewalls to protect ourselves from the evil internet?

5:03Well, the internet at large is the external source there. Someone that's not part of our organization trying to gain access inwards to our organization. They might do this by a number of different methods. So let's say for example, we have a firewall here, and this is our internal network and this is the evil internet out here. Boy, that's an awful diagram. Anyway, that's the internet. This is our work organization. And firewalls are generally designed to do a lot of different things, but one of the things they do is to close all ports except for what's actually necessary.

5:37So maybe I had a web server in here, www server, well, that uses something called TCP port 80, so that port's gonna be open on the firewall. But maybe a long time ago we used to use, I don't know, FTP, which is file transfer protocol, notoriously insecure. So maybe we decide we don't need to use that anymore. We're gonna close that down. We're not gonna use FTP anymore. We'll use other secure methods to transfer our files, but someone forgot and left port 21, which is what FTP uses, open on the firewall.

6:10So an evil internet person here, a hacker, might be able to figure out that, oh, they can, there's ways of probing this. They figured out that we got port 21 open and now maybe they can find their way to punch through that or to use that open port to access their way into our organization or to repurpose that particular port, for example, for some other nefarious purpose. So those are kinda external threats where someone's trying to find their way into our organization. So another kind of a threat we might have would be in terms of external threats would be maybe we have an evil hacker person out here and they're trying to social engineer.

6:47That's another thing that we use here in hacker world, social engineering. And this is where, really, it's just a con job. Normally that's gonna be some kind of an impersonation, for example, where we might call someone and say, hey, I need your help, I'm working for the COO and I'm their administrative assistant. They told me to gain access to this folder. I realized I don't have access to it. They're on a plane on the way to Philadelphia for an important meeting. Can you tell me the credentials I need or a password that gains me access to specific resources?

7:20Or can I use your password to access this particular folder? I gotta do it before the boss lands, or I'm gonna be in big trouble. I'm gonna get fired, okay. Well, people like to help other people, generally speaking, that's just the good part of humanity. So they say, oh man, I don't wanna, I don't want you to get fired, here's my password. So that's just kind of a social engineering, simple kind of a thing that could happen. Lots of other vectors that that can spring off of. But anyway, there's also internal attacks, okay?

7:50And with this kind of thing, it might be perfectly innocent. It might be just a mistake. So maybe our company invented some hot new gadget. It's gonna be the, this generation's fidget spinners and we're gonna make billions of dollars off of this thing. And I'm so excited about it that I took a picture of our new gadget and I posted it on social media. Well, that's an internal threat because I had access to those pictures of that product. Maybe I could even take a picture of it with my phone. And I'm really happy to work for my company, but I might not work for my company anymore if I release that kind of information ahead of schedule or without authorization.

8:29Again, I'm an internal employee, I mishandled our internal data. And these things are another threat folks. Yes, these ubiquitous USB flash drives. Now I use 'em all the time. We probably all do, might be an external drive of some kind or a flash drive like this, but they're easy to store data on. And so we just plug 'em into a USB and we can access the data on them. But those can be abused as an internal threat. So we might have brought one of these from home and we plug it into our computer at work because I wanna take some of these files home so I can work on 'em there.

9:02Well, that might not be an appropriate use of data. It might be against the rules, so to speak, or against our practices, security practices, to copy that data to a thumb drive like this. So that's an internal threat. We bring it home and it turns out our home computer's not secure. It's already got a virus on it, and then it can steal that data and send it to somebody. So that's an internal threat. I had authorization to access the data, but I did not have permission to take it home. Another internal threat might be simply, emails.

9:34We might have gotten a spam email from somebody that looked like they were one of our internal users, or maybe they were even, maybe they even, email even talked about projects that we work on or something. And it said, hey, please click this link to download the latest manual about this product or whatever, and we click on it and maybe it's actually malware. So that could be, again, an internal threat where really it came from external 'cause someone from outside our organization sent it to us, but it became an internal threat. Once I clicked on that email as an employee and I released this malware into our organization, that happens a lot.

10:09There's also internal threats of things like disgruntled employees. They're very upset. Maybe I'm very upset that I didn't get that promotion. I've been working here longer than that guy that he got the promotion, he doesn't even know as much as I do. How did he get this promotion? Well then they can start going in and deleting files and vandalizing things or kind of throwing a wrench in the works. That's an internal threat as well. I gotta say, the internal threats are at least as significant as the external threats because we already have access to files, we already have access to resources.

10:40We already know how the organization works, and we're in many ways, much more of a threat than some external hacker. So those are a few more of the security principles to take a look at. In our next nugget, we're gonna be addressing several more. Stick around for that.

0:00All right, let's continue our discussion of essential security principles, and here, we're gonna take a look at a couple of different terms, such as attack vectors. Now, in a certain way, we've kind of already discussed this a bit, because really, it's what happens when there's a vulnerability and then an attacker wants to use an exploit against that vulnerability. Whatever that vulnerability is, that's their entry point. That's their attack vector. That's what they're going to vector on, or focus on, with their technique to exploit that weakness, okay? So that's just really all that is.

0:33The defense in depth approach to security is another topic we should discuss. We also did see that a little bit as we were going in our previous nugget. I think I might have put a note at the bottom of my last video on a certain area there, where we were talking about concentric circles, where we make our attack surface smaller and smaller and smaller. and so that we become a very small target for someone to be able to attack. Well, what we do there is we implement a layered approach. We might use network equipment with certain security settings on it.

1:05We might use updates, we might use antivirus software, we might use company training to train our employees to know what to look for and stuff like that. So all that layered approach will be used to help cover attack vectors and to minimize this as much as possible. And one of the weakest attack vectors that are out there is the human factor, okay? Humans will probably give up more than technology will because of a number of different reasons. But anyway, some of those would be social engineering, which we looked at in our last nugget.

1:38Defense in depth, you might be working with the network, you might have a firewall, or another thing we haven't discussed yet would be an intrusion detection system or an intrusion prevention system. They're very similar, and what they do is they sit somewhere on your network, usually at an entry point to your network, such as in from the internet, and they will look for patterns of attack. So they'll look for the kind of behavior that an attacker would use to try to gain entry into your network, and once they detect that, they can either just send an alert to it or they can actually prevent the attack from happening.

2:09There's also firewalls, which those primarily will also prevent inbound traffic that's uninvited, so just a bold attack coming in from the external network, usually the internet. And again, firewalls generally will have ports open so that services can be available in that port, such as a website or something like this. Software, we wanna make sure that we have up-to-date software that does not have known security vulnerabilities, and related to that would be getting the proper updates, which we can often do for either our operating system itself or also for the software that we're running on those systems.

2:48Anti-malware products really should be in place. It's kind of easier now with Windows, because Windows machines generally already have it. Microsoft Defender is already there, and that's their anti-malware product, and it does a number of other things as well. It can integrate also a client firewall on the actual computer in addition to maybe your hardware firewalls that exist on your network infrastructure. And there's policies and training. This is so important, because employees need to know what they're allowed to do and not allowed to do.

3:20Can they share that there's a new product announcement? Can they put that on social media? Very often, they can't, because they might not be aware of the timing. They might not be aware of that it's not supposed to be released yet or we gotta wait another quarter to release that product. So if they make that known too early, then that could potentially be a problem. Other policies would be whether they're allowed to bring in external storage from home or some other location into work, okay? Sometimes those can be brought in, but they have to be scanned first or something like that, or the company will provide these that have already been pre-scanned if they really need to use something like a thumb drive.

3:58That's a couple of policies that might exist there. Other policies in a company would be, what are the users allowed to gain physical access? Are they allowed to go into the server room? Probably not. Usually, that's just IT, and usually, that's even a higher level of IT that's allowed to go in there. Training, this is really critical. Again, humans are usually the weakest part of a defense in depth approach, because they're more likely to give out secrets, either accidentally or on purpose. Either way, but we need to train them so that they can do things like spot a social engineering attack, so that they can spot a spam or a phishing attempt, which is gonna try to get information from those users or use those users to gain access to our systems and resources.

4:46CIA is another part of this as well, and that's not the three-letter acronym for the government agency. That's just confidentiality, integrity, and availability. Most of what we're trying to protect will be somewhere underneath one of those three domains of CIA. So confidentiality is so that we can prevent people from seeing data that they're not supposed to be able to see. If it's confidential, it stays that way, right? One of the ways that that can be done would be through encryption, for example, so we could encrypt files.

5:17Maybe we have a website that we run out here somewhere. This is our WWW server, and it runs HTTPS, and that means there's a certificate involved, and that certificate can be used with complex mathematical algorithms to encrypt any data that comes in. So if a user's here, they're trying to place an order on our secured website here, then their credit card information should be confidential. It should be encrypted in this transmission.

5:47Maybe they had to put other personal information, I don't know, date of birth, address, anything else like that, all that should be confidential because we're using encryption to do that. There's also integrity. By the way, the same certificate that provides this encryption here can also be used to provide integrity. But very often, what happens there is, lemme start over here. We have a document, let's say, that we want to send to somebody else or put on a file server or just transmit somewhere to a destination. So this is the source, this is the destination.

6:17Doesn't matter what the destination is right now, but we have a specific copy of the data. and when it arrives at the destination, we wanna make sure that it's exactly the same and that it has not been tampered with. This could prevent something such as what we call a man-in-the-middle attack, where someone can take that data en route, modify it for their own purposes to get some different version of it, and then send it on its way. It could be program code, it could be something related to our applications or software, or it could just be a document, even a Word document or something like that, that they have modified for their own purpose.

6:56Well, with integrity, what happens there is, again, there's a mathematical algorithm called a hash, and it runs this document through a hash, and out of the hash, there will be a result here, and it's a long, complex result, but it'll be, ABC123, something like that, and then on the destination, that hash should match when it runs against the same mathematical algorithm. So if this matches both the source and destination, then at the destination, we know that that document has not been tampered with or corrupted.

7:29It could just be accidental. Might've just gotten corrupt on the way, but if it doesn't match, if there's been any change to it, this hash will change to something else. You know, XYX987, something like that, anything. And again, it's a longer number. I'm just making a short representation here, but if it's changed, then it'll be apparent that has been modified in transit somehow. Now, do users have to know how to do the hash and all that stuff? No, and we really don't either. A lot of systems that are in place will apply the hash automatically, and we'll be able to determine if there has been any change in the data.

8:04But from an IT perspective, we have to make sure that those preventions are in place already. Then there's also availability. We really need to make sure that, when we're trying to tighten down everything and making sure that our systems are secure and there are no weaknesses in it, that we don't tighten it down so much that nobody can do their jobs, nobody can access the files they're supposed to access. So we need to be able to prevent that sort of thing from happening as well, and again, that happens through things such as permissions on various files and folders, permissions on databases, to make sure that certain departments have the level of access that they need and they're not being restricted in their job performance.

8:44On the other hand, people that are not supposed to access it don't have an elevated privilege so that they can access it when they really should not be.

0:00All right now when it comes to the types of a hacker that's out there, there's a lot of different types, and this is not gonna be an exhaustive list, by any means, but generally speaking, they'll fall into certain kind of categories, if you will. So one of those would be what we call a script kiddie, also known as just an amateur. And this is where someone will take, you know, preexisting scripts, preexisting programs, and just use that to attack a target without ever writing anything on their own. Now this is not always entirely bad.

0:30I mean, most hackers will use preexisting tools, but they don't always come up with their own original code. And a good example of what I'm talking about is right here behind me, it's Kali Linux. Now Linux has long been kind of a favored platform for hackers. A big part of that would be the flexibility of it. It's kind of not limited, if you will, by a specific organization like Microsoft or Apple. So in terms of a lot of the liberties that come just inherently with the operating system, a lot of hackers just like Linux.

1:05The other thing here is what we call Kali Linux. This is just a flavor of Linux. There's lots of different flavors out there. They're not all governed by one company, so a lot of different ones. But the Kali Linux flavor of it, if you will, is designed for hackers, what does that mean? Well, you can see here that if I click into the menu system, notice that there's all these various applications that have been added on. Now, you might see something like calculator that's just there as part of Linux here, the help system, some of the utilities, you know, this videos thing.

1:38But a lot of these other things that we see here really are hackers tools like, you know, you can kind of tell that that's a hacker's tool, I think. Most hackers are very familiar with Kali Linux and most hackers will use a lot of these different tools. So just using them alone does not make somebody a script kiddie. You can see there's several different pages of this. Most of these things are not just the default part of Linux. But anyway, you can use these things and not necessarily be a script kiddie per se.

2:09A lot of times the use of the term script kiddie is just to insult another hacker. So if a hacker thinks that someone else is, you know, an amateur, or not very good, it doesn't matter if they actually are very good as a hacker, you just call 'em a script kiddie in some chat room and you're likely to start some kind of fight. So this is definitely an insult, but we all kind of do it at the same time, we use preexisting tools. So then, there's just the hacker themselves. This would be somebody that is a little bit, usually, more skilled. This is someone that could potentially write their own code, or write their own scripts, exploit weaknesses on their own, stuff like that.

2:46Does take quite a lot of time and research, by the way. So hackers are, generally, very highly skilled, usually very highly intelligent and also have a lot of patience 'cause it takes some time to find some of the weaknesses sometimes, especially if you're looking for, what we call, an O day or a 0 day vulnerability, and that equivocates to a new vulnerability that nobody's discovered yet. And also for which there are no longer... there are no patches yet, okay? No patches, or updates, or anything like that.

3:17Someone that comes up with this kind of stuff is usually a highly skilled hacker and it might even be an organization of hackers all working as a team. There's also organized hackers that have various reasons for attacks. And I'll go over that right here. First of all might be just cyber criminal rings, okay? There are criminal rings out there that are just a group of very talented hackers. Some of them even have an office and office hours that they keep, okay? So they're very highly organized. Most of them are gonna be also very well compensated and a lot of times they'll participate in some kind of a split of any profits that they get.

3:56A lot of times, this is coming right now in the form of ransomware, okay, we'll probably discuss this a little more later on. But the basic idea there is they'll reach out, and they'll find somebody's files, and they'll encrypt them all so that they can no longer read those files or all the data's locked up and they will not allow you to see your own data unless you pay them, usually, some Bitcoin or some kind of an alt coin. And a lot of times it adds up to millions of dollars, okay? So we'll get into that a little bit more at a future point in time.

4:27But that's very often what they're doing right now. There's also hacktivists, these are organizations that have a specific social, or political objective in mind. So maybe they, I dunno, hate a specific government. And so, they might attack those government systems and the government servers, or military targets, or something like this, something that they stand against. Or maybe they're hardcore environmentalists and so they might attack an oil company's resources and stuff like that so that's just an example of that.

5:01This symbol above my head here, you might not recognize that maybe, it comes from actually a movie called "V for Vendetta." I think it was actually based on a book, by the way, or actually a graphic novel. But anyway, there was somebody in that film that wore a mask and it was kind of a rage against the machine, or a rage against the system kind of a movie. Well, so the hackers group Anonymous kind of adopted that. And Anonymous is a group of, I would primarily call them kind of hacktivists because I don't know that they never do anything for profit.

5:33But in general they will hack organizations that they disagree with politically or socially. They are very highly skilled. And then, there's also another kind of a hacker here known as just a terrorist. Very often they're closely aligned with a state sponsored hacker. So these kind of go hand in hand sometimes, but it might be a nation state, a specific country that has an enemy in another country and they will just hack that country. They will try to steal their military secrets, try to steal infrastructure secrets, all that kind of stuff.

6:06Now then, there are also several different kinds of hackers in terms of a code of ethics. Now, you might think that hackers don't have any ethics. Well, sometimes they do, especially if they're, you know, hacktivists because they have various principles that they're trying to support as opposed to just financial gain. But there's also a level of ethic within each group of hackers. So for example, first of all there's the black hat hacker. These are hackers, just go after what we would normally consider unethical gain, such as stealing money, stealing credit cards, that sort of thing, taking down critical infrastructure just for fun, for example, sometimes a black hat hacker will disrupt something just because they think it's fun and they wanna see if they can do.

6:49It might be some kind of utility that they deny or something like that. Much of the time these are gonna be just for profit. Then there's also a white hat hacker, that's actually what I am, by the way. This is, lemme see if I still have it open. Here it is, I am actually a certified ethical hacker. There's an organization called the EC Council, and you can see that I got a Certified Ethical Hacker Certification back in November 11th, 2005 so it's been a while now since I originally got this. When you get this, you have to demonstrate a certain level, a certain competency as a hacker, but you also commit to not using your powers for evil.

7:29They have to only be used for good. And generally speaking, we will only agree to attack organizations with their permission. It's usually just called a penetration test, to kind of suss out any weaknesses that might exist there and not to steal anything, not to deliberately disrupt anything, anything like that. That would be a white hat hacker. And then, there's also a gray hat. Now that's exactly what it sounds like. It's probably a combination of these two. So by day, somebody might be a white hat hacker and maybe they work for a penetration testing company, or a security organization of some type.

8:07But by night, when they go home, and after they put the kids to bed, they get involved in black hat hacking. Maybe they kind of wear two hats depending upon, you know, what their motives are and what mood they're in or something. But they could go either way is what the gray hat is.

0:00Alright. Now we know about some of the types of hackers, black hat, white hat, hacktivists, all those sorts of things. Now let's take a look at some of the motives for the hacking. Some of these are kind of implied in the various types of hackers they are, but there are various reasons for their attacks. One of those might be simply to gain an advantage. There is still corporate espionage that goes on, and companies do try to steal each other's secrets. A lot of times it's actually done by poaching employees. So I don't know that it actually happens this way, but you know, if Microsoft wanted somebody at Apple that was really smart, and they had a lot of things that Microsoft wanted, they might try to hire that employee.

0:37So it's that kind of thing. It's not always hacking, but there are various things that can be done to gain advantage. Now in an unethical way, they could try to hack into their systems and see what's there, and steal secrets. So they might try to steal various products that are there, or see how they're made, or someday I would really love to hack into KFC and find out the secret fried chicken recipe, or the Coca-Cola recipe, or anything else of those tasty things that are so addicting. Anyway, some, someday I may have to do it.

1:08Anyway, they may also hack defense secret. This is normally gonna be a state sponsored hacker, is trying to get, I don't know, missile designs, or nuclear secrets, or troop movements. All of those sorts of things could happen. And right now, actually in our current geopolitical landscape, there's a lot of that going on right now. And I'm embarrassed to say the United States government has had a lot of information leaked out of it. There's also maybe things like a proprietary formula, a new way to create a car battery, for example, or a new way to hand soft drinks at half the cost that we used to have in the past, or some new way to manufacture something.

1:49So a lot of those things could be involved there. And there's also, of course, blackmail. That just happens. A lot of times that actually comes out, by the way, in like phishing attacks or spam attacks, where they might send an email saying, "We turned on your video camera, and your microphone on your computer, and we know what you were doing last night at 11 o'clock. And unless you send us one Bitcoin, we're going to release what you were doing, the video recordings we have of you, to all of your friends and family."

2:20We also have things such as just general disruption. Sometimes hackers, they're kind of a proud bunch, and they wanna prove that they're better than the hacker next to them. And so it might just be kind of a contest, and they'll say, "Oh, bet I could hack into the power plant, and turn off a power grid." So they might turn off power, or some other kind of a utility. There was a water treatment plant that got hacked into not long ago, and the mix of chemicals that gets put into the water was modified by a hacker. They were able to gain control of their automated systems.

2:52Now, what was the motive for changing the water? Again, really not much of one, other than the pride of saying that they could do it. A lot of times it's gonna be commerce. They might try to interrupt, I don't know, a subway schedule, or mess with the automatic scheduling of buses or something like this. Shipping schedules, train schedules, all kinds of stuff that goes on there. Again, just to kind of cause some kind of a traffic jam or something like this. A lot of times it's also vengeance.

3:23Remember I said that hackers are kind of a proud bunch, and in a lot of ways they should be because they're very, very smart. But they might not like it that another hacker got the better of them, or proved them wrong about something. Or they were able to hack into something that the other hacker couldn't. So they might try to just take vengeance on somebody. And by the way, this might surprise you. Hackers actually hack each other quite a lot, because they just wanna prove that they can, I guess. It might also be more petty than that. It might be an an ex-boyfriend, an ex-girlfriend that someone's trying to get vengeance against.

3:57Or an ex-employer where maybe somebody got fired, and they want to say, "You shouldn't have done that. I'm gonna show you." And then they hack into something. So that's another motive. And then of course there's financial gain. That's gonna be the biggest advantage, the biggest reason probably amongst all of these reasons, is usually financial gain.

0:00Alright for this particular validation I had you take a look at this article right here, and as you took a look at it, here's the article. It's from a website called Krebson Security. I have been referencing them for years. This is an excellent news site for hacks, hackers, you know, all that sort of thing. It's really good information here. This author here, he actually started this because someone hacked into his information once and he's a reporter. He was a reporter then and it really riled him up and so he thought he'd make a study of computer security and cybersecurity, so that's what he did here.

0:37Anyway, this article is about this person who apparently he's known for a couple of different things. One of those things is some involvement in a hack on Twitter, but most of the article really covers other things here such as SIM swapping, and that's one of the questions that we had right here. The first paragraph, describes sim swapping. What is that? I'm kind of using that as teaching something. I didn't really talk about sim swapping in the main course, but if you read the article, then you read that first paragraph and you can see this is where you can trick somebody, a mobile provider, into diverting a customer's phone calls and text messages to a device they control.

1:13So that would be this one right here, okay. Yours might be in a different order. The answers are randomized, so they don't always appear in the same order just FYI. But that is the correct answer there. What was the primary motive in the attack that this hacker Plugwalk Joe carried out in the sim swapping attack? Well, it was primarily financial gain. If you take a look at the article, because you can see in a couple of different places here, he stole cryptocurrency. It actually appears in several places in this.

1:44You can see here that he was charged with a theft of cryptocurrency at the time, valued at about $800,000. So obviously his main motive there would've been financial gain. What kind of hacker is Plugwalk Joe? Is he a black hat, gray hat, cowboy hat, or white hat? Well, he is certainly not a white hat hacker. He's not doing this for altruistic purposes or to just do penetration tests to help companies out and help them be more secure.

2:15He's clearly a black hat hacker doing things just for his own personal selfish gain. Okay, what did he steal? Credit card numbers, lottery tickets, social security numbers, cryptocurrency, or bank account. We talked about that a moment ago. It was cryptocurrency. Plugwalk Joe also threatened certain people. Just a wonderful guy, apparently. True or false? Well, if you look at this, this is really, I hate to even bring it up. He sim swapped his way into Snapchat accounts of female celebrities and threatened to release nude photos found on their phones.

2:48And then this one's even more awful. Threatened and cyber stalked a 16-year-old girl. Let you read the rest, I don't even want to get into that one, so this guy's in jail, thankfully all right. But anyway, he did also threaten certain people, and there's another one by the way, other indication of that as well. Right up in here remarked that some people in a circle of friends had been known to hire others to deliver physical beatings on people they didn't like. There you have it, there's some information about hacking and a hacker and some of the methods that they used.

3:20Hopefully we all stay on the white hat side of things here.