The great news against the alarming news that we have to deal with vulnerabilities and new vulnerabilities
in different systems all the time.
The great news is there are plenty of excellent tools and solutions that we can turn our attention to.
I'm going to go ahead and demonstrate the additional resources page for you and you'll notice a link
to the common vulnerabilities scoring system there.
The CV SS is famous for scoring vulnerabilities, for using a complex set of metrics to let you know
just how potentially vulnerable something is, just how explainable it is.
And then there's the Common Vulnerabilities and Exposures database where you actually see the vulnerabilities
that are scored with the CV.
SS.
There's the National Vulnerability Database that ties into this as well, that is government managed
from the United States.
Now there's great vulnerability management tools out there and Nessus open vars nikto GFI land guard
qualys.
You should know these names.
They'll be in the flashcards for you.
And certainly, as time would allow download complimentary trial versions and experience this software,
a lot of these vulnerability scanners are going to maintain databases for you.
Of vulnerabilities that exist in your systems.
And again you're going to be able to do the research on is it a serious enough threat and are the is
the data or the service that's being protected, you know, requiring that level of protection?
Again, remember, not all data is created equal.
Well, now, as promised, let me show you the e h resources link at my age.
S Networking Ecom blog site.
So if you head there and by the way, the advertising that I'm doing with Google is getting obnoxious
and I'm going to be trimming it back.
I apologize for that, man.
All right.
Anyways, one of the sections in here is the vulnerability resources.
And notice I've got the titles and the links for you.
So if we go to the common vulnerability scoring system, for instance, hopefully it opens in a new
tab.
Oh, it does.
Thank goodness.
You should definitely spend time up here looking at the latest version of the common vulnerability scoring
system.
So notice there's a complimentary self-paced online training course that explains how all of this works.
And that is complimentary, right?
Yeah, yeah, yeah.
So this is something you should be doing.
Okay, for sure.
Now, notice there's the calculator.
I mean, if you don't have time to go through and take the course, at least come in here and look at
the components that make up the base score.
And notice there's the base score, there's the temporal score and the environmental score, and you
can look at the parameters that are used.
Notice, this is very complicated indeed, complicated stuff here.
But how cool is this that they work so hard to score these vulnerabilities, doing all this research
that's really going to help us when we're trying to figure out where we need to spend our time and our
dollars to guard against exploits of various vulnerabilities.
So another resource on this list that you're going to love is exploit.
DB The exploit database is going to allow you to come in here and type A product name.
Maybe it's Adobe Acrobat, and you're going to be able to find the vulnerabilities that have to do with
that product.
And notice you're going to get the date, the title, the type, the platform and who contributed this
to the database.
Of course, these are hyperlinks.
So you can drill in and you can get all kinds of great details about the exact hack or the exact vulnerability.
Hopefully it hasn't been exploited with a hack, but oftentimes, of course, it's here because it's
been exploited.
That's how it was discovered by the exploit.
Is this an amazing tool that you're going to have in your tool belt as you are penetration testing or
helping an organization design protections against such vulnerabilities?