Domain 6 - Security Assessment and Testing

Question 1

Sec assessment and testing programs

Answer 1

mechanism for validating ongoing effectiveness of sec controls, with a variety of tools to validate controls ie vuln assessments, pentests, software testing, audits, sec management tasks, every org should have a sec assessment and testing program defined and operational

Question 2

Vulnerability assessments

Answer 2

• use automated tools to search for known vulnerabilities in systems/ apps/ networks, flaws may include missing patches, misconfigurations, or faulty code, will often call out the CVE

Question 3

Penetration tests

Answer 3

• assessor attempts to exploit vulnerabilities and gain access to the system, done by external companies

Question 4

Pentest strategies

Answer 4

• war dialing (bank of modems, legacy), sniffing (monitor the network), eavesdropping (listening), dumpster diving, social engineering (human manipulation), tests that involve human interaction and analysis will increase cost but are more thorough

Question 5

Security process data

Answer 5

• employment policies and practices (term process and background checks), roles and responsibilities (management sets standard and verbalizes policy), security awareness training (prevents social engineering, helps with phishing), WRITE COMMUNICATE TRAIN

Question 6

Software testing

Answer 6

• validate code before moving to production, verifies it functions as designed and doesn’t contain security flaws, test APIs, UIs, and Physical interfaces

Question 7

Code review

Answer 7

• peer review process to validate code before deploying to production

Question 8

Interface testing

Answer 8

• assesses interactions between components and users with API testing, user interface testing, and physical interface testing, how an interface interacts with a database or an API, can be automated, sometimes user experience testing

Question 9

Static software testing

Answer 9

• evaluate security of software without running it. Code review. Analyzing source code or the compiled application

Question 10

Dynamic software testing

Answer 10

• evaluate sec of software in a runtime environment, often the option for orgs deploying apps written by someone else

Question 11

Fuzzing

Answer 11

• uses modified inputs to test software under unexpected circumstances, ie changing input around to see how the application responds, can flush out things like SQL injection vulns, modifies known inputs to generate synthetic inputs that may trigger unexpected behavior, generational fuzzing develops inputs BASED ON models of expected inputs to perform the same task

Question 12

Log reviews

Answer 12

• particularly for admin/ privileged activities, ensures that systems are not misused

Question 13

Account management reviews

Answer 13

• ensure that only authorized users retain access to information systems, typically uses a RANDOM SAMPLING of accounts

Question 14

Backup verification

Answer 14

• ensures that the organizations data protection process is functioning properly, VERY IMPORTANT

Question 15

Key performance and risk indicators

Answer 15

• high level review of sec program EFFECTIVENESS, evolving sec controls over time

Question 16

Security audit

Answer 16

• 3rd party performs an assessment of the sec controls protecting an orgs information Assets

Question 17

Internal audits

Answer 17

• performed by an organization’s internal staff and are intended for management use, make sure we are ready for 3rd party audits, make sure controls are effective

Question 18

Chief Audit Executive (CAE)

Answer 18

report to most senior possible leader to avoid conflicts of interest

Question 19

SSAE 18

Answer 19

Type 1=auditors opinion on description of controls provided by management and the design of the controls

Type 2=go further than type 1 by providing auditors opinion on the operating effectiveness of the controls over an extended period of time

ONLY 2 TYPES

Question 20

branch coverage

Answer 20

evaluates whether every if statement has been executed under all if and else conditions

Question 21

condition coverage

Answer 21

tests whether every logical test in the code has been executed under all sets of input

Question 22

function coverage

Answer 22

verifies that every function in the code has been called and returned results

Question 23

loop coverage

Answer 23

verifies that every loop in the code has been executed under conditions that cause code execution multiple times, only once, and not at all