course 5 – ASSETS, THREATS, AND VULNERABILITIES

Module 3: Vulnerabilities in Systems

GOOGLE CYBERSECURITY PROFESSIONAL CERTIFICATE

Coursera Study Guide

Enroll in Coursera Google Cybersecurity Professional Certificate

TABLE OF CONTENT

INTRODUCTION – Vulnerabilities in Systems

In this comprehensive overview, participants will delve into the intricacies of the vulnerability management process, gaining a nuanced understanding of how organizations identify, assess, and mitigate vulnerabilities to enhance overall cybersecurity. The module unfolds with a comprehensive exploration of common vulnerabilities, shedding light on the diverse threats that can jeopardize asset security if left unaddressed. Participants will develop a keen attacker mindset, delving into the tactics and techniques that malicious actors employ to exploit vulnerabilities and compromise the integrity of organizational assets.

Throughout the module, participants will engage in practical exercises and case studies, allowing them to apply theoretical concepts to real-world scenarios. By the conclusion of this section, learners will not only grasp the vulnerability management process but will also be equipped with the analytical skills to identify and assess potential threats to asset security. This comprehensive overview ensures that participants gain both theoretical knowledge and practical insights, empowering them to navigate the complex landscape of vulnerability management in the realm of cybersecurity.

Learning Objectives

  • Differentiate between vulnerabilities and threats.
  • Describe the defense in depth strategy.
  • Explain how common vulnerability exposures are identified by MITRE.
  • Explain how vulnerability assessments are used to assess potential risk.
  • Analyze an attack surface.
  • Develop an attacker mindset to recognize threats.

TEST YOUR KNOWLEDGE: FLAWS IN THE SYSTEM

1. Which of the following are steps in the vulnerability management process. Select two answers.

  • Catalog organizational assets
  • Prepare defenses against threats (CORRECT)
  • Assign a CVE® ID
  • Identify vulnerabilities (CORRECT)

Vulnerability management is an internal process that includes identifying vulnerabilities and preparing defenses against threats.

2. An organization is attacked by a vulnerability that was previously unknown. What is this exploit an example of?

  • A cipher
  • A zero-day (CORRECT)
  • An asset
  • A perimeter layer

A zero-day refers to an exploit that was previously unknown.

3. Which layer of the defense in depth strategy is a user authentication layer that mainly filters external access?

  • Perimeter (CORRECT)
  • Data
  • Network
  • Endpoint

The perimeter layer consists of authentication technologies that let verified users in.

4. A security researcher reports a new vulnerability to the CVE® list. Which of the following criteria must the vulnerability meet before it receives a CVE® ID? Select two answers.

  • The vulnerability must be unknown to the developer.
  • It must affect multiple applications.
  • The submission must have supporting evidence. (CORRECT)
  • It must be independently fixable. (CORRECT)

Criteria that must be met are that vulnerabilities should be independently fixable and must have supporting evidence.

5. Which of the following are steps in the vulnerability management process? Select three answers.

  • Consider potential exploits (CORRECT)
  • Identify vulnerabilities (CORRECT)
  • Prepare defenses against threats (CORRECT)
  • Conduct zero-day exploits

Vulnerability management is a four-step process that includes the following steps: identify vulnerabilities, consider potential exploits, prepare defenses against threats, and evaluate those defenses.

6. Which of the following is a layered approach to vulnerability management that reduces risk?

  • Separation of duties
  • OAuth
  • Defense in depth (CORRECT)
  • Asset management

Defense in depth is a layered approach to vulnerability management that reduces risk. It’s a security approach that protects assets by surrounding them with multiple layers of protection.

7. Which of the following criteria need to be met before qualifying for a CVE® ID? Select three answers.

  • Vulnerabilities must be submitted with supporting evidence. (CORRECT)
  • Vulnerabilities must only affect one codebase. (CORRECT)
  • Vulnerabilities must be recognized as a potential security risk. (CORRECT)
  • Vulnerabilities must be exploited prior to reporting.

Vulnerabilities must only affect a single codebase, be submitted with supporting evidence, and be recognized as potential security risks to qualify for a CVE® ID. They must also be independent of other issues.

TEST YOUR KNOWLEDGE: IDENTIFY SYSTEM VULNERABILITIES

1. Fill in the blank: A vulnerability ____ refers to the internal review process of an organization’s security systems.

  • assessment (CORRECT)
  • scanner
  • patch
  • scoring

A vulnerability assessment is an internal review process of an organization’s security systems.

2. What are the goals of a vulnerability assessment? Select two answers.

  • To identify existing weaknesses (CORRECT)
  • To audit regulatory compliance
  • To detect network traffic
  • To reduce overall threat exposure (CORRECT)

The goals of a vulnerability assessment are to identify existing weaknesses and reduce overall threat exposure.

3. Which of the following remediation examples might be implemented after a vulnerability scan? Select two answers.

  • Locating vulnerabilities in workstations
  • Installing software updates and patches (CORRECT)
  • Identifying misconfigurations in an application
  • Training employees to follow new security procedures (CORRECT)

Examples of remediations that might be performed after a vulnerability scan include training employees on new procedures and installing software updates and patches.

4. What are two types of vulnerability scans? Select two answers.

  • Patch or upgrade
  • Risk or threat
  • Limited or comprehensive (CORRECT)
  • Authenticated or unauthenticated (CORRECT)

Authenticated or unauthenticated and limited or comprehensive are two types of vulnerability scans. Internal and external is another common type of vulnerability scanning.

5. Which of the following steps may be part of a vulnerability assessment? Select three answers.

  • Data encryption
  • Risk assessment (CORRECT)
  • Identification (CORRECT)
  • Remediation (CORRECT)

A vulnerability assessment may include identification, risk assessment, and remediation. It may also include vulnerability analysis. During remediation, the vulnerabilities that were identified and analyzed are addressed.

TEST YOUR KNOWLEDGE: CYBER ATTACKER MINDSET

1. What is the difference between an attack vector and an attack surface?

  • An attack surface refers to all the weaknesses of an asset that can be attacked; an attack vector refers to an outdated and vulnerable network.
  • An attack surface refers to the specific method of attack; an attack vector refers to an outdated and vulnerable network.
  • An attack surface refers to the specific pathway of exploiting a weakness; an attack vector refers to all the weaknesses of an asset that can be exploited.
  • An attack vector refers to the pathways attackers use to penetrate security defenses; an attack surface refers to all the vulnerabilities of an asset that can be exploited. (CORRECT)

Attack vectors are the pathways threat actors use to penetrate security defenses. Attack surfaces are all the potential vulnerabilities that a threat actor could exploit.

2. What are examples of security hardening? Select three answers.

  • Hashing all user passwords (CORRECT)
  • Restarting a crashed application
  • Disabling unused network ports (CORRECT)
  • Keeping systems patched and updated (CORRECT)

Disabling unused network ports, hashing all user passwords, and keeping systems patched and updated are examples of security hardening.

3. Which steps are applied when using an attacker mindset? Select three answers.

  • Stay in communication with a target
  • Determine how a target can be accessed (CORRECT)
  • Evaluate a target’s attack vectors (CORRECT)
  • Identify a target (CORRECT)

Identifying a target, determining how they can be accessed, and evaluating their attack vectors are steps that are applied when using an attacker mindset.

4. How can businesses reduce the number of attack vectors they must defend? Select three answers.

  • By educating users so they can participate in preventing attacks (CORRECT)
  • By controlling access and authorization to assets (CORRECT)
  • By totally restricting information from being shared
  • By implementing security controls that protect information (CORRECT)

Business can reduce the number of attack vectors they have by controlling access and authorization to assets, implementing security controls that protect information, and educating users so they can participate in preventing attacks.

5. Which of the following is an example of an organization’s digital attack surface?

  • A disgruntled employee
  • A restricted filing cabinet
  • The organization’s website (CORRECT)
  • The organization’s server room

The organization’s website is an example of its digital attack surface. An attack surface refers to all the potential vulnerabilities that a threat actor could exploit. The digital attack surface consists of everything that’s connected to an organization’s network.

6. Fill in the blank: ____ refer to the pathways attackers use to penetrate security defenses.

  • Vulnerability analyses
  • Attack vectors (CORRECT)
  • Vulnerability assessments
  • Attack surfaces

Attack vectors refer to the pathways attackers use to penetrate security defenses. Threat actors use attack vectors to exploit vulnerabilities and exposures.

MODULE 3 CHALLENGE

1. An application has broken access controls that fail to restrict any user from creating new accounts. This allows anyone to add new accounts with full admin privileges.

The application’s broken access controls are an example of what?

  • A security control
  • A threat
  • An exploit
  • A vulnerability (CORRECT)

2. What security strategy uses a layered approach to prevent attackers from gaining access to sensitive data?

  • Defense in depth (CORRECT)
  • Kerchoff’s principle
  • Caesar’s cipher
  • Triple DES (3DES)

3. What is the difference between the application and data layers of the defense in depth model?

  • The data layer includes controls like encryption and hashing to secure data at rest. The application layer protects individual devices that are connected to a network.
  • The data layer only allows employees to access information. The application layer secures information with controls that are programmed into the application itself.
  • The application layer secures information with controls that are programmed into the application itself. The data layer maintains the integrity of information with controls like encryption and hashing. (CORRECT)
  • The application layer maintains the integrity of information with controls like encryption and hashing. The data layer blocks network traffic from untrusted websites.

4. What is the main purpose of the CVE® list?

  • To provide organizations with a framework for managing cybersecurity risk
  • To share a standard way of identifying and categorizing known vulnerabilities and exposures (CORRECT)
  • To create a dictionary of threats to organizational assets that must be addressed
  • To keep a record of the coding mistakes of major software developers

5. What is the purpose of vulnerability management? Select three answers.

  • To review an organization’s internal security systems (CORRECT)
  • To identify exposures to internal and external threats (CORRECT)
  • To track assets and the risks that affect them
  • To uncover vulnerabilities and reduce their exploitation (CORRECT)

6. What is the main goal of performing a vulnerability assessment?

  • To catalog assets that need to be protected
  • To practice ethical hacking techniques
  • To pass remediation responsibilities over to the IT department
  • To identify weaknesses and prevent attacks (CORRECT)

7. Fill in the blank: All the potential vulnerabilities that a threat actor could exploit is called an attack _____.

  • vector
  • network
  • surface (CORRECT)
  • database

8. Fill in the blank: An attack _____ refers to the pathways attackers use to penetrate security defenses.

  • vector (CORRECT)
  • landscape
  • vulnerability
  • surface

9. What are ways to protect an organization from common attack vectors? Select three answers.

  • By keeping software and systems updated (CORRECT)
  • By not practicing an attacker mindset
  • By educating employees about security vulnerabilities (CORRECT)
  • By implementing effective password policies (CORRECT)

10. Consider the following scenario:

A cloud service provider has misconfigured a cloud drive. They’ve forgotten to change the default sharing permissions. This allows all of their customers to access any data that is stored on the drive.

This misconfigured cloud drive is an example of what?

  • An exploit
  • A security control
  • A vulnerability (CORRECT)
  • A threat

11. Why do organizations use the defense in depth model to protect information? Select two answers.

  • Security teams can easily determine the “who, what, when, and how” of an attack.
  • Each layer uses unique technologies that communicate with each other.
  • Threats that penetrate one level can be contained in another. (CORRECT)
  • Layered defenses reduce risk by addressing multiple vulnerabilities. (CORRECT)

12. An organization’s firewall is configured to allow traffic only from authorized IP addresses. Which layer of the defense in depth model is the firewall associated with?

  • Endpoint
  • Network (CORRECT)
  • Data
  • Application

13. Which of the following are criteria that a vulnerability must meet to qualify for a CVE® ID? Select all that apply.

  • It must be independent of other issues. (CORRECT)
  • It must pose a financial risk.
  • It must be submitted with supporting evidence. (CORRECT)
  • It must be recognized as a potential security risk. (CORRECT)
  • It can only affect one codebase. (CORRECT)

14. A security team is preparing new workstations that will be installed in an office.

Which vulnerability management steps should they take to prepare these workstations? Select three answers.

  • Consider who will be using each computer. (CORRECT)
  • Configure the company firewall to allow network access. (CORRECT)
  • Download the latest patches and updates for each system. (CORRECT)
  • Install a suite of collaboration tools on each workstation.

15. What are the two types of attack surfaces that security professionals defend? Select two answers.

  • Intellectual property
  • Brand reputation
  • Digital (CORRECT)
  • Physical (CORRECT)

16. An online newspaper suffered a data breach. The attackers exploited a vulnerability in the login form of their website. The attackers were able to access the newspaper’s user database, which did not encrypt personally identifiable information (PII).

What attack vectors did the malicious hackers use to steal user information? Select two answers.

  • The online login form (CORRECT)
  • The user database
  • The newspaper’s website (CORRECT)
  • The unencrypted PII

17. A security team is performing a vulnerability assessment on a banking app that is about to be released. Their objective is to identify the tools and methods that an attacker might use.

Which steps of an attacker mindset should the team perform to figure this out? Select three answers.

  • Determine how the target can be accessed. (CORRECT)
  • Evaluate attack vectors that can be exploited. (CORRECT)
  • Identify a target. (CORRECT)
  • Consider potential threat actors.

18. Consider the following scenario:

You are working as a security professional for a school district. An application developer with the school district created an app that connects students to educational resources. You’ve been assigned to evaluate the security of the app.

Using an attacker mindset, which of the following steps would you take to evaluate the application? Select two answers.

  • Evaluate how the app handles user data. (CORRECT)
  • Identify the types of users who will interact with the app. (CORRECT)
  • Ensure the app’s login form works.
  • Integrate the app with existing educational resources.

19. What phase comes after identifying a target when practicing an attacker mindset?

  • Evaluate the target’s attack vectors.
  • Determine how the target can be accessed. (CORRECT)
  • Find the tools and methods of attack.
  • Prepare defenses against threats.

20. A hotel chain has outdated WiFi routers in their guest rooms. An attacker hacked into the devices and stole sensitive information from several guests.

The outdated WiFi router is an example of what?

  • A threat
  • An exploit
  • A vulnerability (CORRECT)
  • An access control

21. Fill in the blank: According to the CVE® list, a vulnerability with a score of _____ or above is considered to be a critical risk to company assets that should be addressed right away.

  • 11
  • 1
  • 4
  • 9 (CORRECT)

22. Which of the following are characteristics of the vulnerability management process? Select two answers.

  • Vulnerability management is a way to limit security risks. (CORRECT)
  • Vulnerability management should consider various perspectives. (CORRECT)
  • Vulnerability management is a way to discover new assets.
  • Vulnerability management should be a one-time process.

23. A security team is conducting a periodic vulnerability assessment on their security procedures. Their objective is to review gaps in their current procedures that could lead to a data breach. After identifying and analyzing current procedures, the team conducts a risk assessment.

What is the purpose of performing a risk assessment?

  • To simulate attacks that could be performed against each vulnerability
  • To score vulnerabilities based on their severity and impact (CORRECT)
  • To adjust current security procedures
  • To fix vulnerabilities that have been identified

24. Which of the following are types of attack surfaces? Select three answers.

  • Cloud servers (CORRECT)
  • Malicious software
  • Network routers (CORRECT)
  • Computer workstations (CORRECT)

25. What is not a step of practicing an attacker mindset?

  • Evaluate attack vectors that can be exploited.
  • Determine how a target can be accessed.
  • Identify ways to fix existing vulnerabilities. (CORRECT)
  • Find the tools and methods of attack.

26. Which layer of the defense in depth model relates to user devices that have accessed a network?

  • Endpoint (CORRECT)
  • Application
  • Data
  • Perimeter

27. Which of the following are reasons that security teams practice an attacker mindset? Select three answers.

  • To exploit flaws in an application’s codebase
  • To find insights into the best security controls to use (CORRECT)
  • To uncover vulnerabilities that should be monitored (CORRECT)
  • To identify attack vectors (CORRECT)

CONCLUSION – Vulnerabilities in Systems

The participants of this module have embarked on a comprehensive exploration of the vulnerability management process, delving into the intricate realm of identifying, assessing, and mitigating vulnerabilities to fortify organizational cybersecurity. By examining common vulnerabilities and cultivating an attacker mindset, learners have gained invaluable insights into the dynamic landscape of cybersecurity threats. Practical exercises and case studies have provided a hands-on dimension to the theoretical knowledge, enabling participants to apply their understanding to real-world scenarios.

As a result of this immersive journey, participants are now well-versed in the nuanced strategies employed in vulnerability management, equipped with the analytical skills necessary to safeguard organizational assets. This module serves as a pivotal resource in the broader context of cybersecurity education, offering a robust foundation for individuals aspiring to navigate and excel in the multifaceted field of vulnerability management.

Previous Module
Next Module

Subscribe to our site

Get new content delivered directly to your inbox.

Quiztudy Top Courses

Popular in Coursera

Liking our content? Then, don’t forget to ad us to your BOOKMARKS so you can find us easily!

Subscribe