Module 1

Question 1

OSSTMM

Answer 1

Open Source Security Testing Methodology Manual. Maintained by ISECOM.

Question 2

ISECOM

Answer 2

Institute for Security and Open Methodologies

Question 3

OSSTMM Legislative Compliance

Answer 3

Deals with government regulations (Such as SOX and HIPAA)

Question 4

OSSTMM Contractual Compliance

Answer 4

Deals with industry / group requirement (Such as PCI DSS)

Question 5

OSSTMM Standards Based Compliance

Answer 5

Deals with practices that must be followed by members of a given group/organization

Question 6

OSSTMM Class A - Interactive Controls

Answer 6

Authentication - Provides for identification and authorization based on credentials
Indemnification - Provided contractual protection against loss or damages
Subjugation - Ensures that interactions occur according to processes defined by the asset owner
Continuity - Maintains interactivity with assets if corruption of failure occurs
Resilience - Protects assets from corruption and failure

Question 7

OSSTMM Class B - Process Controls

Answer 7

Non-repudiation - Prevents participants from denying its actions
Confidentiality - Ensures that only participants know of an asset
Privacy - Ensures that only participants have access to the asset
Integrity - Ensures that only participants know when assets and processes change
Alarm - Notifies participants when interactions occur