1
00:00:00,270 --> 00:00:07,860
The first step of the risk analysis is to search for vulnerabilities on the target being analyzed,

2
00:00:08,760 --> 00:00:15,600
then we need to think about the possible threats that can exploit the detected vulnerabilities.

3
00:00:16,020 --> 00:00:22,790
Also quantifying the statistical probability on an annual basis of such exploitation.

4
00:00:23,970 --> 00:00:30,770
The next step is to quantify the economic damage resulting from the exploitation of the vulnerability

5
00:00:31,710 --> 00:00:35,110
once the damage quantification has been calculated.

6
00:00:35,310 --> 00:00:42,510
For example, ten thousand dollars, you will immediately know how much you can invest in counter measures,

7
00:00:43,080 --> 00:00:46,640
up, for example, to 10000 maximum.

8
00:00:47,760 --> 00:00:55,650
The risk is determined by the calculated damage and the probability of occurrence of the threat and

9
00:00:55,650 --> 00:01:01,710
is indicated in predetermined levels, for example, high, medium or low.

10
00:01:05,030 --> 00:01:11,990
We're seeing that the search for vulnerabilities plays an important role in risk analysis.

11
00:01:12,830 --> 00:01:19,190
Let's see how we can search for vulnerabilities inherent in certain targets.

12
00:01:21,630 --> 00:01:30,060
You can search for vulnerabilities manually through search sites, for example, one of the most famous

13
00:01:30,060 --> 00:01:37,980
sites is SecurityFocus, or use vulnerability scanners.

14
00:01:40,530 --> 00:01:46,350
Let's see a vulnerability search, simulate on with securityfocus.

15
00:01:47,410 --> 00:01:54,550
From the first combobox, you can select the vendor, then move on to select the product of interest,

16
00:01:55,120 --> 00:02:01,180
and at the end you will have the list of all known vulnerabilities of that product.

17
00:02:01,810 --> 00:02:09,250
By clicking on a specific vulnerability from the list found, you will access details of the selected

18
00:02:09,250 --> 00:02:10,180
vulnerability.

19
00:02:13,070 --> 00:02:22,220
The first card of the vulnerability provides general data on the vulnerability, such as whether it

20
00:02:22,220 --> 00:02:30,410
can be exploited locally or remotely, its CVE code and the versions of the vulnerable target.

21
00:02:32,380 --> 00:02:40,300
The discussion Tab provides a brief explanation of what the vulnerability consist and what

22
00:02:40,300 --> 00:02:43,030
effects it exploitation can cause.

23
00:02:46,520 --> 00:02:51,020
In the Exploit Tab, you can sometimes find a POC

24
00:02:52,210 --> 00:03:00,190
A proof of concept of the vulnerability that is a simple program that allows you to experiment with

25
00:03:00,190 --> 00:03:03,190
a possible exploitation of the vulnerability.

26
00:03:05,200 --> 00:03:15,040
The last two Tabs solution and references explain where to find patches to mitigate or eliminate the vulnerability.

27
00:03:17,670 --> 00:03:25,440
The Nist website allows you to create graphs that show the trend of the vulnerabilities over a certain

28
00:03:25,440 --> 00:03:34,670
period of time, for example, in this simulation, I simulated the search for cross site scripting

29
00:03:34,670 --> 00:03:36,420
vulnerabilities.

30
00:03:39,730 --> 00:03:45,040
The CVE Details site is also interesting for the search

31
00:03:46,040 --> 00:03:54,320
of vulnerabilities. In this simulation, for example, i simulated the search for Android vulnerabilities.

32
00:03:55,810 --> 00:03:58,350
Thank you for your kind attention.