Hi and welcome to the Deep dive into Network,
assessments by ec-council. This is
Section 1 introduction to network.
Security Assessments in this
video, will take a look at identifying vulnerabilities, only
at work on assets. So that's
divernon.
So you're probably wondering what exactly is a
vulnerability to put simply a vulnerability,
is a security weakness or flaw in
his system, which is a transaxle such as
a Chaka Khan compromised by using an exploit.
Do you have various types of security weaknesses on
his system? And these can be less
afraid example, default settings to default
settings simply deployed
on Lexi network with the same configuration as
they have. Since we have left, a
manufacturer DC fall settings can
be very easily accessed by anyone. So
answer, this is recommended that
wants to buy a new device. You should consider it and
remove any salt on before. Considerations, that may
pose a weakness on your network. Additionally, another
security weaknesses using week
encryption systems, which
use in Secure encryption Technologies, which
at right after can simply exploit on, can
gain unauthorized access to data system
itself clearly. So use of
unsecured protocols,
Unsecured. Protocols are simply not open or
close all applications, which does not provide any
sort of security features such as encryption
on any other security technologies
that is used to ensure the Privacy between
a client such as a computer on a
silver. There's also the use of
open permissions on social given
to any one which can lead to a security
risk from users on a network. This mean, to
say anyone can make any sort of modifications on the
files and let's see, the folders the use
of unsecured. What account is also a
major security vulnerability, diesel route accounts
on lights, a lot of space system, which does not
contain any sort of complex password. The
a very easy to compromise. Can also
pose a security risk.
Domenio necessary Services running on
a system. Some of these Services me open
a network port to allow inbound connections
from let's see a remote system. I
try to talk to come laundry. Remote exploit
across a network to take advantage of
the vulnerable services on a Target system.
They are all so Security phone number to use that, we need to consider whether
we are using cloud-based system. One on-premise
system vulnerabilities on a cloud.
Is simply having been secure applications suicide
is an even virtual machines on the cloud.
And these systems are vulnerable to anyone or
abilities within. Let's see,
an on-premise solution, assembly, security weaknesses,
which exists on systems that are
within the organization to put. Simply we
need to secure all applications systems
on Virtual machines. What a d cyst on
the salt one or what a disa songs are
on our existing Network.
There's also vulnerable to use our existing
to the party and these are what we call to the
party risk. When a security risk exists an
organization Macy, to transfer to risk. I'm
willing to let see another guy's Asian
or disc Institute, Party City party
is usually a trusted provider who have
the experience and handling the cybersecurity risk.
However, three parties can
lock vendor support. This means to see if
there's an issue with a product from, let's a vendor, the vendors
may not provide adequate support to the
customer and this me inform the
customer that there's something wrong or the
customers, and I'm not actual device.
Guess also risk and data storage.
It's important to know where your data is being stored
data. Can we lost all linked by
a third party? Vendor data can be stolen while being
stored on a to the party's infrastructure are
many issues. We're marching to
the party fenders. They can be security
concerns as a security concerns,
which ours is the
vendor has certified professionals. Who work on the equipment to
support does a vendor, have a privacy policy
for customer data, does a vendor meet,
Susan compliance and Regulatory standards.
Analyzation should ensure event is
properly screened on meet all requirements before conducting
any sort of business would defend itself.
There's also risk involved with
system. Integration. Sometimes an
organization may have to integrate Leslie a
system with a three-party system.
Please install the two party system or systems
of very well, trusted on a secure.
There's also risk involved in supply chain to
230, Vendome, Bonneville, or be
victim of a supply chain attack and have not
realized it just security concerns. If
it's a party, is not acquiring a
hardware on, this sofa components from
other suppliers and a trusted retailer. There's
a major risk when Outsourcing co-development.
When is the parties developing code
on application to security concerns such
as compliance, secure coding
techniques as well. There's also improper
on weed. Patch management. There are
security vulnerabilities with an organization
that does not have proper patch management. Policies.
In effect. This means my answering your
phone operating systems and applications
within the organization.
Florida Mall. JC ready, which is a really bad
pain. Herbal tea to put, simply software vendors
to protest the application. So, security weaknesses before publishing
their products to the customers. Sometimes, our
soccer is able to find a security vulnerability
with an application. After it
has been published. But before the software vendor is
aware of the vulnerability. Socko
constantly, take advantage of this boner ability to compromise
application. And this is what we
call is he ready? Know that you have an understanding of the
concepts of vulnerability and vulnerability management. Let's take
a look at it. Working with nessus. Nessus is a
very popular phone release,, which in a cyber security industry.
To get started. We'll be installing nessus inside
of a calendar switch on machine.
So head over to your web browser and let
us which one messes.
Will click the tenable link. As you
can see, there's a professional version of masses, which is YouTube,
commercial, Ave Coast, professional use, but for
Sullivan about us, we can use an SOS Essentials, which
allows us to scan up to 16 IPS
for free. So simply scroll down
and click on download.
Once you click on download, please complete
this form because you need to register for an activation
code. To call will be sent to you via email. Next,
you'll be guided to
this beach. What? Size, thank you for registering for classes.
Please click here to download Nexus. Simply click
the download button and you will now be
redirected to diss download page, simply stroll
down and download the verge of Nexus for
Kali Linux.
Known as a sieve. Let's head over to all downloads
direct route and color rocks. And here we can
see the messages in store file.
You can simply open a tumor from right
here. So you can right-click on open command prompt.
I know, let's actually install nessus.
We can use a dpkg to
to get a dash. I on the name of
the file.
Next, let's copy this command which
is / band /, systemctl. Stop nessus,
D. Silver's and Jason
all to know I hit answer. This is
to Simply in short of nurses scanning Services, actually
in the world.
Next, let's copy to URL open a
web browser on Android.
Simply accept the security risk and continue.
I know we are on the
nessus. Initialization VH Essentials antler
continue.
This page requires you to request the
code, but we've already done. So, that's good. Skip
Simply copy the code, which is activation
code from your email account, which is sent to
you by tenable P. Sit here and play
continue.
Next, you'll be required to create a
user account. Please ensure that you remember this
user account details, cuz this is what you need to log
into the Nexus web interface.
Unloading a slight fission process is actually
going to start on his way to download some plug-ins and some
updates. This process usually takes a few
minutes to complete. So please
repeat.
Now, the process is complete and
shorty. Log internet service, Alice. Click on
Lucia.
Begin, ask on, let's click on you scan.
I hear we have pre-built templates.
simply click on P6 con or Advance can
but willing to click on B6, can
We can settle name. A description on
our Target or Target. Will be.
Of metasploitable to Celeste complete information.
And to begin to scan, let's go to strap down
next to see if I will see launch.
So now the scanners running, this should take a couple of minutes
to complete. Let's give it some time.
What is Carlos complete simply click on his
console to view the results?
And here we can see a list of vulnerabilities and
we can see the 2,000 herbal
teas, be sold unless it is severity rating.
Do Jerry to report? Let's click on report and click
on PDF report on
a custom report.
Simply click on custom.
On here, you can see the different options that
you can have in food within the report.
Next, let's changes
to Executive. So we will get on Executive report
act like generate reports and now the
PDF files already and now
we can opener report. I can see an overall summary
of all the vulnerabilities that has discovered using
NASA's or no target. The customer
report allows you to create a more technical report
as required, by penetration testing, a member
of technical staff. In this
video. We took a look at discovering of
various types of security vulnerabilities, which exists within an
organization. Have also learned how to install set
up a performing vulnerability assessment. Using
Nexus 4, you will take
a look at eluding objectives for section two.
I hope this video has been informative for you. I'll
see you in the next one.