CISSP Domain 6 Flashcards
Security Assessment and Testing
Internal and Third Party Audits Vulnerability testing Penetration testing Log reviews Synthetic transactions Code reviews Misuse case testing Interface testing Account management
Audit
a systematic assessment of security controls of an information system
Audit drivers
Regulatory or compliance requirements
Significant change to the architecture
New threat developments
Scope of Assessments
Which subsets and systems
User artifacts like passwords, files, log entries
Privacy implications
Process evaluation
Audit scope
should be determined in coordination with business unit managers
Business managers should be included early and throughout the exercise
Never forget business cases
Information System Security Audit Process
Determine goals Involve the right business unit leaders Determine the scope Choose the Audit Team Plan the Audit Conduct the audit Document the results Communicate the results
Audit plan must be
repeatable
American Institute of Certified Public Accountants AICPA
Statement on Auditing Standards No 70
SAS 70
defined audits carried out by third parties to assess internal controls of a service organization
Third party ensuring best interests of the client corporation
AICPA new framework of auditing standards on
Service Organization Controls SOC
3 Service Organization Controls (SOC
SOC 1 Pertains to financial Controls
SOC 2 Pertains to trust services ( Security, Availability, Confidentiality, Process Integrity, Privacy
SOC 3 Also pertains to trust services
Difference between Service Organization Controls (SOC) 2 and 3
SOC 2 is very detailed
SOC 3 is less detailed and for general purpose
Technical Control
Security control implemented through the use of an IT asset.
Linkage between controls and risks to mitigate
to understand the context in which specific controls were implemented.
Why was the fence put up?
Goals of vulnerability assessments
Evaluate the true security posture of an environment
Identify as many vulnerabilities as possible
Test how systems react to certain circumstances and attacks
Consider testing ramifications. Could be knocked offline, production could be negatively affected
Black Box testing
no prior knowledge
knowledge comes from the assessment itself
White Box testing
complete knowledge of the inner workings of the system
Targets specific internal controls and features
Gray Box testing
somewhere between black and white
Penetration testing
process of simulating attacks on a network and its systems at the request of the owner
Goal is to measure an organization’s level of resistance to attack and uncover weaknesses within the environment.
Vulnerability Scanning
Identification of active hosts on a network
Identification of active and vulnerable services (ports) on hosts
Identification of applications and banner grabbing
identification of operating systems
Identification of vulnerabilities
Misconfigured settings
Establish foundation for penetration testing
Five steps of a penetration test
- Discovery
- Enumeration
- Vulnerability mapping
- Exploitation
- Report to management
Penetration testing degrees of knowledge
Zero Knowledge
Partial Knowledge
Full Knowledge
Blind test
assessors only have publicly available data to work with. Network staff is aware
Double blind test
Network staff is unaware
Targeted
Focused test on specific areas of interest
