CISSP Flashcards
(38 cards)
what is Verification?
The verification process is similar to the certification process in that it validates security controls. Verification may go a step further by involving a third-party testing service and compiling results that may be trusted by many different organizations.
The process of evaluating software to determine whether the products of a given development phase satisfy the conditions imposed at the start of that phase.
Verification is a static practice of verifying documents, design, code and program. It includes all the activities associated with producing high quality software: inspection, design analysis and specification analysis. It is a relatively objective process.
Verification will help to determine whether the software is of high quality, but it will not ensure that the system is useful. Verification is concerned with whether the system is well-engineered and error-free.
Methods of Verification : Static Testing
Walkthrough
Inspection
Review
Verification is the process of checking that the software meets the specification.
“Did I build what I need?”
What is Validation?
The process of evaluating software during or at the end of the development process to determine whether it satisfies specified requirements.
Validation is the process of evaluating the final product to check whether the software meets the customer expectations and requirements. It is a dynamic mechanism of validating and testing the actual product.
Methods of Validation : Dynamic Testing
Testing End Users
Validation is the process of checking whether the specification captures the customer’s needs.
Accreditation
is the act of management formally accepting an evaluating system, not evaluating the system itself.
management evaluates the capacity of a system to meet the needs of the organization. If management determines that the needs of the system satisfy the needs of the organization, they will formally accept the evaluated system, usually for a defined period of time or set of conditions. If the configuration is changed or the accreditation expires, the new configuration must be certified. Recertification must normally be performed either when the time period elapses or when significant configuration changes are made.
Assurance
Assurance is the degree of confidence that an organization has that its security controls are correctly implemented. It must be continually monitored and reverified.
Certification
Certification - product or system is tested to see whether it meets the documented requirements (including any security requirements). It considers the system in context, including the other systems around it, the network it is running on, and its intended use.
process of evaluating the security architecture of the software or system against a predetermined set of security standards or policies. Certification also examines how well the system performs its intended functional requirements.
The term certification indicates. A technical review of security mechanism of the product. Or (a technical evaluation of a product)
Transposition
Transposition ciphers use an encryption algorithm to rearrange the letters of a plaintext message, forming the ciphertext message. The decryption algorithm simply reverses the encryption transformation to retrieve the original message.
a simple transposition cipher was used to reverse the letters of the message so that apple became
elppa.
Rearranges the position of the characters of the plaintext.
Transposition ciphers provide diffusion (obscures the relationship between message units)
Transposition ciphers use an encryption algorithm to rearrange the letters of the plain text message to form a cipher text message.
Substitution
Substitution ciphers use the encryption algorithm to replace each character or bit of the
plaintext message with a different character.
Replaces the plaintext characters with other characters, numbers and symbols.
Substitution ciphers provide confusion (obscures the identity of the message unit)
Multitasking
In computing, multitasking means handling two or more tasks simultaneously.
handles multiple processes on a single processor by switching between them using the operating system.
Multiprocessing
uses multiple processors to perform multiple processes simultaneously.
Multithreading
runs multiple threads within a single process
Multithreading permits multiple concurrent tasks to be performed within a single process
Due Dilligence
The due diligence principle is a more specific component of due care that states an individual assigned a responsibility should exercise due care to complete it accurately and in a timely manner.
Investigate, learn, research
What I need to ensure the issue never happens again
Due Care
The due care principle states that an individual should react in a situation using the same level of care that would be expected from any reasonable person. It is a very broad standard.
Do it, Make it happen
What I need to do right now to fix an issue
***Auditing is an aspect of due care.
Confinement
confinement allows a process to read from and write to only certain memory locations and resources.
Also called sandboxing
Bounds
The bounds of a process consist of limits set on the memory addresses and resources it can access.
The bounds state the area within which a process is
confined or contained.
In most systems, these bounds segment logical areas of memory for each process to use.
Isolation
Process isolation ensures that any behavior will affect only the memory and resources associated with the isolated process.
Isolation is used to protect the operating environment, the kernel of the operating system (OS), and other independent applications.
Security Models
SCAN => Signed NDA, Clearance, Approval, Need to Know
Did Sally Call Me => Dedicated, System High, Compartmented, Multilevel.
IPSec
IPSec:
Works on Layer 3. Standard Architecture for VPN. (P A I N)
Setting up secure channel between 2 parties.
Modes:
a. Tunneling: Whole Packet is encapsulated (Security) b. Transport: Only Payload is encapsulated (Performance)
Authentication Header (AH): A I N. Prevents against replay attack Encapsulated Security Payload (ESP): P A I
Security Association: Unique Identifier of a secure connection.
Destination address + secure parameter index
It has simplex connection —> 2-way channel needs 2 security association.
Incident Response
DRMR3L
- Detection - Awaiting for things to happen (Get an alert or user report)
IDS, IPS, AV, Continuous Monitoring - Response - You have to verify it actually is an incident.
The use of (CSIRT) or (CIRT) is a formalized response.
A formal incident response plan documents who wold activate the team - Mitigation - Once you verify you want to contain it. Mitigate the threat from spreading across the network or systems.
(Mitigation - time to stop the spread) - Reporting - Once it’s contained you can let upper management know or whoever is above you.
- Recovery - Recover all that was lost during the incident or threat
- Restore system to normal/full operational status. - Remediation - Fixing the source of the threat (modify the firewall or something like that)
- examination of the incident to identify what allowed it to happen, and figure what needs to be changed so it does not happen again.
- Root cause analysis - Lessons Learned - Documenting the incident and how to go forward
examination of the incident to gather important info from a broad range of people.
what happened? what did we learn? how can we do it better next time?
Cipher Modes
ECB => worst and weak (Do not use)
CBC => is very common
CFB => is stronger and faster than CBC.
CTR => Is fastest of them all and stronger than CBC.
CC Evaluation Assurance
EAL1 => Functionally tested
EAL2 => Structurally tested
EAL3 => Methodically tested and Checked
EAL4 => Methodically designed, tested and reviewed
EAL5 => semi formally designed and tested
EAL6 => semi formally designed, verified, designed and tested.
EAL7 => Formally verified, designed
EAL 3 vs. EAL4…. 3 has 2 words (skip and) and 4 has 4 (skip and). Then between 5 and 6.. it is almost the same.. 6 has more words than 5
Penetration testing phases
PIVER
- Planning (Scope of the test, Management approval, rule of engagement)
- Information Gathering or discovery (Network discovery scan, enumeration, perform reconnaissance)
- Vulnerability Scanning (Network/Web vulnerability scan, probs systems for weaknesses)
- Exploitation ( automated tool or manual)
- Reporting (summarize the results and make recommendation for improvements)
Mutation fuzzing VS Generational fuzzing
Generational fuzzing relies on models for application input and conducts fuzzing attacks based on that information.
Mutation based fuzzers are sometimes called “dumb” fuzzers because they simply mutate or modify existing data samples to create new test samples
Change Management
- Request Change: Request is made by the team who would like to make changes in the
system - Review the change: Requirement is reviewed by the designated person.
- Approve/Reject: Based on the review, the change will be approved/rejected
- Test: Once the change is approved, it should be tested in non-prod environment
- Schedule for implementation: Mainly on off hours (weekends)
- Document: All the findings should be documented. Versioning of document is also import
ant
-------------------------- 1-Request and Impact Assessment 2-Approved Build and Test 3-Notification Process 4-Implementation 5-Validation process 6-Structure Documentation
Patch Management
- Evaluate –> Release Patches
- Test–> Test on isolated systems
- Approve–> Use of change management to approve
- Deploy–> Deployment of patches on affected systems.
- Verify–> Verify if patches are deployed.
