Audits and Assessments Flashcards
Internal Audit
evaluation of the effectiveneness of internal (controls, complicance, integrity) of systems
Internal Audit Focuses (Dp Ns Ac Ir)
Data Protection, Network Security, Access Controls, and Incident Response
What does it mean to be compliant
the checkee met standards, regulations, and laws
Audit Commitee
the group responsible for supervising the org’s audit
Internal Assessment
In-depth analysis to identify/access potential risks and vulnerabilities internally
Self Assessment
internal review conducted by an org to gauge adherance to specific standards
Minnesota Counties Intergovernmental Trust (MCIT)
checklist to help aid/guidline the interal assessment
External Audit
systematic evaluation carried out by external entities
External Assessment
analysis conducted by independent entities to identify vulnerabilities and risks
Regulatory Compliance
the objective that orginzations aim to reach in adherance to (laws, policies, and regulations)
System Examination
comprehensive security infrastructure inspections
Internal Third-Party Audit
offers validation of security pratices and helps give trust to an org (Has to be reputable themselves first)
Physical Penetration Testing
testing an org’s physical security such as locks, access cards, security cameras, and other protective measures
Offensive Penetration Testing
proactive approach using attack techniques of real cyber threats
Defensive Penetration Testing
reactive approach that entails fortifying systems, identifying attack space
Integrated Pen Testing
Both offensive and defensive pen testing in one
Reconnaissance
An initial phase where critical information about a target system is gathered to enhance an attack success rate
Active Reconnaissance
Direct engagement with the target system to pull information
Passive Reconnaissance
Doesn’t interact with the target system to get information
Reconnaissance Environment
The targeted infrastructure information known prior to the test
Metasploit
Computer security and pen-testing frameworks that help evaluate pen testing
Reconnaissance Environment Types
Known, partially known, and unknown
Software Attestation
Validating the integrity of software by checking that it hasn’t been tampered with
Hardware Attestation
Validating the integrity of hardware components
