Hardware Vulnerabilities - CompTIA Security+ SY0-701 - 2.3 — Transcript

Full transcript

1. 0:02if you look at your local network at
2. 0:03home and in your office you'll notice
3. 0:06there are a lot of devices connected to
4. 0:08the network many of these devices are
5. 0:10Hardware devices that don't generally
6. 0:12give us access to the operating system
7. 0:14that's running inside this might be a
8. 0:17device used to control the air
9. 0:18conditioning system you might use this
10. 0:20device to clock in or clock out of work
11. 0:23but in any case it's a device that has
12. 0:25an operating system running inside of it
13. 0:27but we don't generally have access to
14. 0:29that oper System since these devices are
15. 0:32connected to the network they are
16. 0:33therefore a potential security risk so
17. 0:36we need to make sure that we're always
18. 0:37up toate with the firmware or software
19. 0:40that might run inside of these Hardware
20. 0:42devices if you look around at home this
21. 0:44could mean that your stove your
22. 0:46refrigerator your garage door the front
23. 0:49doors to your house and all of these
24. 0:51embedded Internet of Things devices or
25. 0:54iot devices all could potentially be a
26. 0:58security issue for your home and your
27. 1:00office before iot our security concerns
28. 1:03were basically focused on operating
29. 1:05systems that we had control of our
30. 1:07Windows laptop or a tablet computer or
31. 1:10perhaps our mobile phone but with the
32. 1:12Advent of iot and these hundreds of
33. 1:14different devices that you could connect
34. 1:16to your network we now have security
35. 1:18concerns with every one of these devices
36. 1:22we often refer to this operating system
37. 1:24that's running inside of this Hardware
38. 1:26as firmware this is the operating system
39. 1:28that makes everything work in inside of
40. 1:30this device and very often we have no
41. 1:32idea what this operating system even is
42. 1:35this means that the only people who can
43. 1:37really update or manage this system is
44. 1:40the manufacturer themselves they're the
45. 1:42ones that created this device they're
46. 1:44the ones that developed the software
47. 1:46running in this operating system and
48. 1:48they're the only ones that can really
49. 1:49tell us how to upgrade the firmware in
50. 1:51all of these Hardware devices
51. 1:54unfortunately manufacturers of Hardware
52. 1:56don't necessarily have the same focus on
53. 1:59it security that others of us might have
54. 2:02for example we ran into exactly this
55. 2:04problem with train Comfort link to
56. 2:07thermostats these are thermostats that
57. 2:09are automated and you can control them
58. 2:11from something like a mobile phone or a
59. 2:14tablet train was notified of security
60. 2:16vulnerabilities of these Comfort link
61. 2:18thermostats in April of 2014 the
62. 2:22manufacturer did not release a patch for
63. 2:25these thermostats until April of 2015
64. 2:28and another patch was was released in
65. 2:30January of
66. 2:322016 in the World of Windows and Mac OS
67. 2:35and Linux we generally turn around these
68. 2:37patches in a month or less in this case
69. 2:40the manufacturer took at least a year to
70. 2:43provide the very first patch for these
71. 2:45security problems and in some cases
72. 2:47almost another year to release the other
73. 2:49one this obviously created security
74. 2:51concerns for people that were using
75. 2:53these Train cover link to thermostats
76. 2:55because during this entire period the
77. 2:58vulnerability was known but patch was
78. 3:00not
79. 3:01available sometimes the manufacturer of
80. 3:03these devices will inform you when a
81. 3:05device is no longer able to be updated
82. 3:08the first notice of this might be with
83. 3:10an EOL notice or an end of life this is
84. 3:13a notice that the manufacturer is giving
85. 3:15to everyone to let them know that in the
86. 3:17future they will stop selling this
87. 3:19particular product it's important to
88. 3:21keep these dates in mind because you can
89. 3:23still get security patches and updates
90. 3:25even though this product is not actively
91. 3:27being sold this may be the first notice
92. 3:30that it might be time to replace this
93. 3:32device although there is a time frame
94. 3:34where there is still support available
95. 3:36eventually that time frame will go away
96. 3:39once the device has already hit its end
97. 3:41of life and the manufacturers decided to
98. 3:44no longer support the device we now are
99. 3:47at the end of service life or
100. 3:50eosl the manufacturer themselves have
101. 3:52stated they are not going to provide any
102. 3:54additional security patches for this
103. 3:56device although they may provide you
104. 3:58with a very highend support option where
105. 4:01you can pay a great deal of money to
106. 4:02have them continue support for that
107. 4:04device that Financial outlay is not
108. 4:07something that most customers have the
109. 4:09ability to do so often they will replace
110. 4:11this device with something newer
111. 4:13obviously EOL is an important step that
112. 4:16might give you some warning that the
113. 4:18support for this device is going away
114. 4:20but the real important date is the
115. 4:23eosl if you have equipment in your
116. 4:25office or at home that has hit the end
117. 4:27of service life you may want to consider
118. 4:30replacing that device as soon as
119. 4:31possible so that you always have the
120. 4:33latest security patches
121. 4:35installed if you work for an
122. 4:37organization that has a large
123. 4:39infrastructure you've got data centers
124. 4:42that are located around the world and
125. 4:43many different remote sites then you
126. 4:45probably have equipment in one of these
127. 4:47locations that have been installed for
128. 4:50years and years this is a legacy device
129. 4:53and it's one that might be running an
130. 4:54older operating system maybe the
131. 4:56application is very old and has not been
132. 4:58updated in quite sometime or maybe the
133. 5:00middleware that this application uses is
134. 5:03very outdated in each of these cases the
135. 5:06software that's running on these systems
136. 5:08may be at their end of life or even
137. 5:10their end of service life and if that's
138. 5:12the case we may want to compare the risk
139. 5:14of continuing to use this device or this
140. 5:17application versus the security concerns
141. 5:20or risks associated with keeping it on
142. 5:22our Network the real challenge might be
143. 5:24if this particular device or software
144. 5:27has a very critical part of the overall
145. 5:30goals of your organization this means
146. 5:32that it's not as easy as simply turning
147. 5:34off the device or replacing it with
148. 5:36another device that we can get elsewhere
149. 5:38this means we may need to keep this
150. 5:40device running for a certain amount of
151. 5:41time but we might also want to create
152. 5:44some type of mitigation that would
153. 5:46prevent someone from taking advantage of
154. 5:48any known security vulnerabilities this
155. 5:51means we may want to create additional
156. 5:52firewall rules that would limit the
157. 5:54people able to directly connect to this
158. 5:56device or you might add additional IPS
159. 5:59signature
160. 6:00especially signatures that are built for
161. 6:02some of these older operating systems so
162. 6:04although this may not be something you
163. 6:06can easily phase out of your network you
164. 6:08may be able to put together a path to
165. 6:10replace this device while at the same
166. 6:12time providing the security needed for
167. 6:15these Legacy
168. 6:25platforms