Managing Risk: Threats,

Vulnerabilities, and Exploits

 Objectives

• What threats are and how can they be managed

• What vulnerabilities are and how can they be managed
• What exploits are and how can they be managed
• Which risk management initiatives the U.S. federal
government sponsors

http://fpt.edu.vn 14/05/2019 2
 Understanding and Managing Threats

• Threat as any activity that represents a possible danger

• The uncontrollable nature of threats
• Unintentional threats
• Intentional threats
• Any attempt to manage risk requires a through knowledge
of threats

http://fpt.edu.vn 14/05/2019 3
 Best Practices for Managing
Threats Within Your IT Infrastructure
• Create a security policy
• Insurance
• Use access controls
• Use automation
• Include input validation
• Provide training
• Use antivirus software
• Protect the boundary

http://fpt.edu.vn 14/05/2019 4
 Understanding and Managing
Vulnerabilities
• Vulnerability can be a weakness in an asset or the
environment.
• The loss occurs when a threat exploits the vulnerability.
– threat/vulnerability pairs
• Vulnerabilities can be mitigated.

http://fpt.edu.vn 14/05/2019 5
 Mitigation Techniques

• Policies and procedures

• Documentation
• Training
• Separation of duties
• Configuration management
• Version control
• Patch management

http://fpt.edu.vn 14/05/2019 6
 Mitigation Techniques (cont.)

• Intrusion detection system

• Incident response
• Continuous monitoring
• Technical controls
• Physical controls

http://fpt.edu.vn 14/05/2019 7
 Best Practices for Managing
Vulnerabilities Within Your IT Infrastructure
• Identify vulnerabilities
• Match the threat/vulnerability pairs
• Use as many of the mitigation techniques as feasible
• Perform vulnerability assessments

http://fpt.edu.vn 14/05/2019 8
 Understanding and Managing Exploits

• An exploit is the act of exploiting a vulnerability

• The result is a compromise to the system, an application, or
data
• Example: public-facing server
– Buffer overflow
– SQL injection attacks
– Denial of service (DoS) attacks
– Distributed denial of service (DDoS) attacks

http://fpt.edu.vn 14/05/2019 9
 Public-Facing Server
Exploits
• Perpetrators
– Script kiddies, programmers
• Initiate
– Public server discovery
– Server fingerprinting
– Vulnerability discovery
• Find information about Vulnerabilities and Exploits
– Blogs, forums, security newsletters
– Common Vulnerabilities and Exposures (CVE) list
– Reverse engineering

http://fpt.edu.vn 14/05/2019 10
 Public-Facing Server
Mitigation Techniques
• Remove or change defaults
• Reduce the attack surface
• Keep systems up to date
• Enable firewalls
• Enable intrusion detection systems (IDSs)
• Install antivirus software

http://fpt.edu.vn 14/05/2019 11
 Best Practices for Managing
Exploits Within Your IT Infrastructure
• Harden servers
• Use configuration management
• Perform risk assessments
• Perform vulnerability assessments

http://fpt.edu.vn 14/05/2019 12