1. CULLEN ACHESON Samuel Garcia Zachary Blum
Vulnerabilities
CULLEN ACHESON
Samuel Garcia
Zachary Blum

2. Vulnerabilities Basic Information
What's different from an exploit?
Common Vulnerabilities and Exposures (CVE)
Vulnerability is a flaw in a system, or in some software within a system, that could provide an attacker with a way to bypass the security infrastructure. While an exploit is the act of trying to turn a vulnerability into an actual way to breach a system.
CVE is a reference-method for publicly known Information-security vulnerabilities and exposures. 

3. NIST CVE/Website
NIST = National Institute for Standards and Technology
NVD =  National Vulnerability Database - sponsored by the depart

4. How? Accidental Programming Errors

5. Defense?
Scan
Update
Secure Coding ( geId=637)
Bug Bounty Programs? (
The reality we must face is that Internet security vulnerabilities are never going away. Every year the number of identified vulnerabilities increases at an alarming rate.
There are a few steps needed to be taken to defend against vulnerabilities.
Step 1: Identification/Discovery of Systems
gives you, the security admin, a view of the network through the use of an assessment tool or network mapping software, which will be able to determine used tcp/ip addresses.
Step 2: Vulnerability Assessment
Vulnerability assessment tools or scanners are used to identify vulnerabilities within the network. 
Step 3: Vulnerability review
Vulnerability scanners generate reports that can be hundreds or even thousands of pages long. They provide details such as names, descriptions and assessments of severity. Some scanners provide remedies that can be manually applied to effectively neutralize the vulnerability.
Step 4: Vulnerability remediation
Can be done in many different ways: Manual remediation, patch deployment tools, and automated remediation tools.
Step 5: Ongoing vulnerability management
The need for ongoing management of network vulnerabilities is often overlooked at the onset of a vulnerability remediation project. However, its very important to scan regularly, after updates, and installs of programs to prevent new vulnerabilities from popping up.

6. Bug Bounty Market Vupen Google Facebook
Zerodium (
DJI
They were able to obtain the private key for its SSL certificate, which DJI had accidentally published on GitHub, allowing them access to sensitive customer information stored on DJI’s servers. He asked DJI if this problem was within the scope of its bug bounty, and the company confirmed it was. So Finisterre wrote up and submitted a detailed report. DJI approved of the work and offered him a $30,000 bounty, their highest reward.

8. Vulnerability Scanners
Nessus
OpenVAS
Burp Suite

9. Fuzzing Random Input Dumb, Smart, Black-Box, White-Box
Burp Intruder (Both Scanner and Fuzzer)
Fuzz testing (fuzzing) is a quality assurance technique used to discover coding errors and security loopholes in software, operating systems or networks. It involves inputting massive amounts of random data, called fuzz, to the test subject in an attempt to make it crash.

10. Hackers: Asset or Detriment?

11. Questions?