Scribd
Upload
7 views

Lab 02

The document discusses managing risks by addressing threats, vulnerabilities, and exploits. It provides objectives and best practices for managing each, including creating security policies, identifying vulnerabilities, and hardening servers.

Uploaded by

dungnthe172688
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
7 views

Lab 02

The document discusses managing risks by addressing threats, vulnerabilities, and exploits. It provides objectives and best practices for managing each, including creating security policies, identifying vulnerabilities, and hardening servers.

Uploaded by

dungnthe172688
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 12

Managing Risk: Threats,

Vulnerabilities, and Exploits


Objectives

• Managing threats
• Managing vulnerabilities
• Managing exploits
• Risk Management strategies

http://fpt.edu.vn 05/20/202 2
4
Understanding and Managing Threats

• Threat as any activity that represents a possible danger


• The uncontrollable nature of threats
• Unintentional threats
• Intentional threats
• Any attempt to manage risk requires a through knowledge
of threats

http://fpt.edu.vn 05/20/202 3
4
Best Practices for Managing
Threats Within Your IT Infrastructure
• Create a security policy
• Insurance
• Use access controls
• Use automation
• Include input validation
• Provide training
• Use antivirus software
• Protect the boundary

http://fpt.edu.vn 05/20/202 4
4
Understanding and Managing
Vulnerabilities

• Vulnerability can be a weakness in an asset or the


environment.
• The loss occurs when a threat exploits the vulnerability.
– threat/vulnerability pairs
• Vulnerabilities can be mitigated.

http://fpt.edu.vn 05/20/202 5
4
Mitigation Techniques

• Policies and procedures


• Documentation
• Training
• Separation of duties
• Configuration management
• Version control
• Patch management

http://fpt.edu.vn 05/20/202 6
4
Mitigation Techniques (cont.)

• Intrusion detection system


• Incident response
• Continuous monitoring
• Technical controls
• Physical controls

http://fpt.edu.vn 05/20/202 7
4
Best Practices for Managing
Vulnerabilities Within Your IT Infrastructure

• Identify vulnerabilities
• Match the threat/vulnerability pairs
• Use as many of the mitigation techniques as feasible
• Perform vulnerability assessments

http://fpt.edu.vn 05/20/202 8
4
Understanding and Managing Exploits

• An exploit is the act of exploiting a vulnerability


• The result is a compromise to the system, an application, or
data
• Example: public-facing server
– Buffer overflow
– SQL injection attacks
– Denial of service (DoS) attacks
– Distributed denial of service (DDoS) attacks

http://fpt.edu.vn 05/20/202 9
4
Public-Facing Server Exploits

• Perpetrators
– Script kiddies, programmers
• Initiate
– Public server discovery
– Server fingerprinting
– Vulnerability discovery
• Find information about Vulnerabilities and Exploits
– Blogs, forums, security newsletters
– Common Vulnerabilities and Exposures (CVE) list
– Reverse engineering

http://fpt.edu.vn 05/20/202 10
4
Public-Facing Server Mitigation Techniques

• Remove or change defaults


• Reduce the attack surface
• Keep systems up to date
• Enable firewalls
• Enable intrusion detection systems (IDSs)
• Install antivirus software

http://fpt.edu.vn 05/20/202 11
4
Best Practices for Managing
Exploits Within Your IT Infrastructure

• Harden servers
• Use configuration management
• Perform risk assessments
• Perform vulnerability assessments

http://fpt.edu.vn 05/20/202 12
4

You might also like