[Autogenerated] Hello everyone.
My name is Pedro most months and welcome to this
course risk assessment with open C V.
I'm a lead ___________ tester and security consultant,
former software developer.
Let's assume for a moment that you use or run one or
several operating systems frameworks,
development languages or for party libraries.
Do you also have difficulties staying on top of
knowing what is the most secure version?
Do you know if or actually how many published
vulnerability each of those products contain?
If a new vulnerability for one of those products is published or
actually when a new vulnerability is published,
Do you automatically get an alert or, more importantly?
Which framework or for a party library version?
You should immediately upgrade or at least mitigate its known vulnerabilities.
Are you curious whether there's an easy way to get notified when a new
vulnerability of a certain product is published.
Allow me to introduce you to open C V A C V alerting platform.
C V stands for common vulnerabilities and exposures.
Its unique designator for vulnerabilities, but we'll get to that in a bit.
It was created by Nicholas Crock for and the first version.
Version 1.0, was published at the end of 2020.
It locally imports all CV entries and stores them in a database.
This allows you to perform searches over it to see whether a
specific product contains a vulnerability.
The power lies in its alerting function.
It notifies you when a cV of a specific vendor or
product is published or changed.
Open C v e itself is written in the python programming language.
It's actually a flask web application and it can be built from source.
The source is up on github as we shall see under the hood.
It requires post grass as database storage back end and read this in memory,
key value store, there's a hosted instance available.
So theoretically speaking, you do not need to install and host it yourself.
However, it is very easy to self host and of course that has numerous advantages.
There's also a Docker compose file available which makes self hosting a breeze.
The source code itself can be found on guitar dot
com slash opencV slash open C V.
In this course first we're going to install openCV on our own
server using Docker and Docker compose those are the
prerequisites actually for this course as well.
Then we're going to configure open C V and then we're going to
take a look at several use cases in particular.
We're going to look at how to get notified of new or
modified CVS for specific vendors and products,
how to follow the progress of a specific c.
Ve entry and how to search for existing CVS of products using the API
because openCV exports and API which you can use but before we start this
course with our first demo on how to install openCV.
It makes sense to briefly look at C v itself.
C v stands for common vulnerabilities and exposures and
it's actually a unique identifiers of a disclosed
vulnerability within this CV entry.
You have a type of vulnerability.
Often there is a description of what exactly the vulnerability entails
and then which is important for this course you have a product as well
as the vendor of the product usually,
but not always a specific version is mentioned for
which the C V entry is applicable.
More information about CV itself can be found on their
website on www dot c ve dot org.
To round off the introduction to open C V let's take a look at
its place in the nist cybersecurity framework.
The cyber security framework is developed with the goal to reduce cyber risks.
It is voluntary guidance based on existing standards guidelines and
practices to help companies improve their security.
The framework core itself is split up into multiple functions.
If we look at the cyber security framework or CSF,
we see that open CV fits in the identify function and within
functions you have several categories and subcategories.
Open CV fits into the risk assessment category and the subcategories asset
vulnerabilities are identified and documented as well as internal and
external threats are identified and documented.
That was it for the introduction in the next clip, let's go and install openCv