Domain 6 -- Security Assessment and Testing Flashcards
What are the 8 steps to the Information System Security Audit Process?
- Determine goals
- Involve the right business unit leaders
- Determine the scope
- Choose the audit team
- Plan the audit
- Conduct the audit
- Document the results
- Communicate the results
What’s the difference between internal audits, external audits and third party audits?
- Internal audits – self evident. An organization audits itself
- External audit (aka second party audit) – an organization audits a business partner (Target and Fazio Mechanical services)
- Third Party audit – Bring in an outside company to conduct the audit
What is a technical control?
It’s a security control implemented through the use of an IT asset.
What are three types of vulnerability testing?
- Personnel testing – people, procedures, training
- Physical tesing – review the facility and perimeter protection
- System and network testing
What’s the difference between Black Box, white box and grey box testing?
- Black box testing - Tester has no a priori knowledge of the internal design or features of the system. All knowledge comes from the testing itself.
- White Box testing — auditor is given complete knowledge of the inner workings of the system before testing begins
- Better for insider threat
- Not as good for outsider threats
- Somewhere between Black and white box testing. The tester has some knowledge, but not all of the inner workings
What is penetration testing?
Penetration testing is the process of simulating attacks on a network and its systems at the request of the owner, senior management.
Pen tests are not restricted to information technology. Could be technical, physical or administrative
What are the capabilities of Vulnerability scanners?
- identify active hosts on the network
- identify active/vulnerable services (ports) on hosts
- identify applications and banner grabbing
- identify operating systems
- identify vulnerabiliites associated with discovered operating systems and apps
- Identify misconfigured settings
- Test for compliance with host applications usage/security policies
- The establishment of a foundation for penetration testing
What is the 5-step process used during penetration testing?
- Discovery – gathering info about target
- Enumeration - performing port scans and resource identification methods
- Vulnerability mapping - identifying vulnerabilities in identified systems and resources
- Exploitation – attempt to gain unauthorized access
- Report to management
What’s the difference between a blind, double blind or targeted pen test?
-
Blind test – assessors only have publicly available data to work with
- network security staff is aware that this type of test will take place
-
Double Blind (aka stealth assessment) – blind to assessors and the security staff is not notified
- Better for evaluting how good the security team is to identifying and responding to an attack
-
Targeted Tests - can be internal and/or external consultants carrying out focused tests on specific areas of interests
- Example is if a new application or web site is being rolled out
What’s the difference between a vulnerability test and a penetration test?
- Vulnerability test has a goal of identifying potential vulnerabilities
- Penetration test has a goal of exploiting one or more vulnerabilities to prove that a hacker actually can gain access to company resources
What is War Dialing?
- War dialing allows attackers and administrators to dial large blocks of phone numbers in search of available modems
What’s a kernel flaw and how do you protect against it?
- kernel flaws are problems that occur below the level of the UI, deep in the OS
- You protect against them by keeping patches up to date (after sufficient testing)
What are buffer overflows and how do you protect against them?
- Good programming practices
- Developer education
- automated source code scanners
- enhanced programming libraries
- strongly typed languages
What’s a symbolic link vulnerability and how do you protect against it?
- The vulnerability is that a program may follow a symbolic link and the attacker may be able to compromise that symbolic link to gain unauthorized access
- Countermeasures:
- Don’t use symbolic links. Use the full path name
What are file descriptor attacks and how do you protect against them?
- File descriptors are numbers many OS’s use to represent open files in a process.
- Certain file descriptors are universal – same to all programs
- If a program makes unsafe use of a file descriptor, an attacker may be ale to insert unexpected input into the program or cause output to go to an unexpected place with the privileges of the executing program
- Countermeasures:
- Good programming practices
- Developer education
- Source code scanners
- Application security testing
What’s a race condition and how do you protect against it?
Race conditions exist when the design of a program puts it in a vulnerable condition before ensuring that those vulnerable conditions are mitigated.
Countermeasures
- Good programming practices
- Developer education
- automated source code scanners
- app security testing
What are file and directory permission vulnerabilities and how do you protect against them?
Many attacks rely on inappropriate file or directory permissions
Countermeasures
- File integrity checkers
- These shoulda lso check expected file and directory permissions
What’s the Postmortem?
After the testing is complete – you should review the results, close gaps where possible and decide priorities moving forward.
What are Log Reviews?
- A log review is the examination of system log files to detect security events or to verify the effectiveness of security controls
- It’s important to have time synchronized in order for log analysis across multiple systems to be meaningful.
What is NTP?
NTP stands for Network Time Protocol
- It’s really important for keeping systems in synch and providing the ability to correlate log entries made by differrent systems
What are ways to prevent log tampering?
- Remote logging – putting log files on a separate box makes the attackers have to compromise that box, too.
-
Simplex Communication – only have a one-way path to the log repository
- You can sever the receive pairs on an Ethernet cable
- known as a data diode
- Replication – replicate log files someplace not on the network (e.g. removable device)
- Write Once Media
- Crytographic hash chaining – each event is appended to the cryptographic hash – ensures completeness and integrity of every event in the chain
What does SIEM stand for and how is it used?
- SIEM stands for Security Information and Event Manager
- They are systems that enable:
- Centralization
- Correlation
- Analysis
- Retention of event data
- Purpose is to generate automated alerts
- Typically, they provide a dashboard
What is a synthetic transaction and how are they useful in security?
- A synthetic transaction is a transaction that is generated by a script
- They allow us to systematically test the behavior and performance of citical services.
What’s the difference between real user monitoring and synthetic Transactions?
- Real User Monitoring is a passive way to monitor the interactions of real users with a web application system
- It uses agents to capture metrics such as delay, jitter and errors from a user’s perspective
- Can require more backend analysis to understand when a user may have changed his mind or lost mobile connectivity, rather than something to be concerned about
- Synthetic transactions are more consistent.
- Neither is better all the time
What is misuse case testing?
A misuse case is a use case that includes threat actors and the tasks they want to perform on the system.
What are the steps in the code review process?
- Identify the code to be reviewed
- Team leader organizes the inspection and makes sure everyone has access to it
- Everyone prepares by reading through the code and making notes
- All obvious errors are collated off-line so they don’t need to be discussed
- If all agree that code is ready for inspection, procedd with the meeting
- Team leader displays code and team discusses it. Scribe writes notes down
- Team decides on a disposition:
- Good to go
- Passed with rework
- Reinspect following fix of issues
- Following meeting author fixes (if needed)
- Re-review if needed
What is defensive coding?
- It means that during development or code review, you are constantly looking for opportunities for things to go badly
What is interface testing?
- Interface testing is the systematic evaluation of a given set of the “exchange points” that comprise the interface
- Interface testing is a special case of Integration Testing
What are 3 ways for attackers to become “normal, privileged users” of the systems they intend to compromise?
- Compromise an existing privileged account
- Create a new privileged account
- Elevate the privileges of a regular user account
What command do you use to switch to a different user in Windows, Linux and MacOS?
- Windows – use the runas command
- Linux – sudo command
- macOS - sudo
What are some points to keep in mind regarding testing Data Backups?
- Develop scenarios
- Develop a plan
- Leverage automation
- Minimize the impact on business processes
- Ensure coverage
- Document the results
- Fix or improve any issues you documented
What is a checklist test as it relates to DR/BCP? What is another name for it?
- Copies of the DRP or BCP are distributed to the different departments and functional areas for review.
- They make comments which are then incorporated back into the master copy.
- The checklist test is also called a desk check test
What is a Structured Walk-through test with regard to DR/BCP?
- People come together to review the plan for accuracy
What is a tabletop exercise with respect to DR/BCP?
- TTX’s do NOT involve a technical control infra
- Can happen at the executive level or team level
- Goal is to test out procedures and ensure that they actually do what they are supposed to do
- Ensures that everyone knows their role
- Goal is to ensure that the team is able to respond to the likeliest/most dangerous scenario
TTX’s are only as good as the people who show up to play.
What is a simulation test with respect to DR/BCP
- Takes a lot of planning and a lot of people
- Takes place up to the point of actual relocation to an offsite facility and actual shipment of replacement equipment
What is a Parallel test with respect to DR/BCP?
- In a parellel test, some systems are moved to the alternate site and processing takes place.
- Results are compared with regular processing done at the main site.
- Ensures that specific systems can perform adequately at the alternate offsite facility
- Will flush out any tweaking ro reconfiguration that is needed.
What is a full interruption test with respect to DR/BCP?
- Most intrusive to regular operations
- The original site is actually shut down
- All processing takes place at the alternate site
- Full-blown drill that takes a lot of planning and coordination, but it can reveal the most holes in the plan
What other types of training are needed withr respect to DR/BCP?
- cardiac pulmonary resuscitation (CPR)
- how to use a fire extinguisher
- emergency communication procedures
- how to shut down equipment when disasters strike
What are the main reasons DR/BCP plans become outdated?
- BC process not integrated into change management process
- Changes occur in the infra and environment
- Reorganization of the company, layoffs, mergers
- Changes in HW, SW and applications
- After the plan is constructed, people think their job is done
- Personnel turnover
- Large plans take a lot of work to maintain
- Plans do not have a direct line to profitability
What are steps a company can do to ensure that the plan stays updated?
- Make BC part of every business decision
- Insert maintenance responsibilities into job descriptions
- Include maintenance in personnel evaluations
- Perform internal audits that include DR/BCP
- Perform regular drills that use the plan
- Integrate BCP into the current change management process
- Incorporate lessons learned from actual incidents into the plan
What’s the difference between security training and Security awareness training?
Security training is teaching the skill or skills that will allow people to perform specific functions better
Security awareness training is the process of exposing people to security issues so that they can recognize them and better respond to them
What is social engineering?
Social engineering, in the context of Info Security, is the process of manipulating individuals so that they perform actions that violate security protocols.
Which of the following components of a TableTop exercise represents a branch?
See graphic
Which of the following components of a tabletop exercise indicates a sequel?
See graphic
