All right.
Really, the only thing that we like about the number of vulnerabilities that are constantly appearing
in our world is the job security.
There are so many vulnerabilities occurring all of the time.
It's really necessary for us to classify them, to break them down into different classifications.
This can help us guard against them.
This is another area where a lot of training is going to come in right to play so we can have this help
us design training mechanisms.
The first thing that we are going to have, which creates sometimes massive vulnerabilities in systems,
is good old fashioned misconfiguration.
Yep.
From a fat fingered command is what we would typically say in the industry where you have just mis clicked
the wrong thing or maybe you just didn't understand, heaven forbid how a feature worked and you flat
out misconfigured it misconfigured an application.
Right alongside this is things left in their defaults.
There was oh, my gosh, there's been so many Microsoft based attacks, attacks against Microsoft products
due to default, administrator credentials left somewhere, default administrator passwords left in
systems.
It's just unbelievable how much it happens.
So one of the things that you'll note I do and I teach is never using defaults.
When we go up and build something in a WAC, we don't use the default VPC.
We build a new VPC just to our special parameters.
So this is a great habit to get into across everything you touch.
Buffer overflows are a vulnerability and we'll be dealing with those elsewhere in this course.
But just understand buffer overflows another key vulnerability vector.
This is by the way, the buffer overflow is something that attackers can trigger and that's a bad thing.
Unpatched devices remember we are constantly on that on that just given take of we want our lives to
go simple and smooth and that would mean we're not patching our systems every darn day.
But if we don't patch our systems, yeah, we're compiling more and more vulnerabilities that we can
be attacked through.
So while it's risky to patch our systems because something may break, oh boy, we are running the risk
of vulnerabilities.
I aggressively patch everything in my life now.
I really do.
Especially when you think about like with cloud based storage and with my stuff always being backed
up that I care about.
Patching the underlying operating system on my device becomes less of a scary thing.
Because if the worst case scenario happened and there was data loss and backed up.
Design flaws.
These are something that obviously through training we are going to hope our dev team can mitigate as
they design the stuff.
Operating system flaws are going to exist always in any OS, some more than others.
And I'm not going to say another word before I -- someone off that's watching this application flaws.
So when something in the application just is vulnerable, a classic that always comes to mind for me
in this regard when I'm teaching this subject matter is the like super long you are well that early
versions of Internet exploder I mean Internet Explorer would fall down so imagine that I mean they released
the browser and no one thought to do a maximum character limitation in the address field.
And so you could send, you know, certain number of characters.
And once you got up to that threshold, you could buffer overflow the machine and cause all kinds of
problems.
So you can only imagine things like this need to be checked for and hopefully the dev teams are doing
that.
This one drives me insane.
We need to harden all of our devices.
You need to know what protocols your various devices are speaking and shut down those services that
are not needed.
And my goodness, talk about using defaults.
There should never be a default password anywhere near your systems.
Well, those are common ways to classify vulnerabilities.
They're pretty straightforward.
But clearly it was, I hope, valuable for you to run through those with me.