Sec + Flashcards
A new E- commerce company is interested in being PCI DSS compliant. What are the three most common rules?
Testing security systems and processes regularly
All user accounts must be unique
Never store CVV
What is ISO 27001
Information Security Management Systems
What is ISO 27701
Privacy Information Management
What is ISO 27002
Information Security Best Practices
What is ISO 31000
Risk Management Best Practices
An Employee installed a new service on the domain controller without consent or approval from the IT department and change managment. What is this type of threat?
Shawdow IT: refers to information technology syustems deployed by departments othert than the central IT department
What kind of threat compromises a system and maintains a long term remore access without being detected
APT Advanced Persistent Threat
MITRE ATT&CK
globally accessible knowledge base of adversary tatics and techniques based on real-word observations
which should a security manager review that would allow them to remain proactive in understanding the types of threats their company faces
ISAC Industry specific groups on sharing threat information
What does Netstat do?
shows all active connections and open/listening ports
can show what is currently running prcoiesses/services opened those connections/ports (-o)
Attacker uses one comprosed network device to access another network device
pivoting
attacker gains permissions/access to files, folders or systems they shouldnt have access to
Privaliage escaltion
walking around a building to discover where security devices are or scanning a network to deteremine what computers/devices are on it
footprinting
hides malware on the device in such a way that it wil remain after a restart or after basic attempts are made to remove it
Persistence
What type of scan can access the device and see how it is configured. Giving a detailed and accurate scan, with minimal risk
Credentialed
List of known vulerabilities and attributes, including affected platforms
CVE Common Vulnerability Enumerations
assigns severity scores to vulerabilities which allows prioritization of response and manage resouces
CVSS Common Vulnerability Scoring System
Packet scans =
Wireshark
Red Team
Attackers
Blue Team
defenders
White team
monitors and rule makers
Purple team
but attack and defend collaboration
Service/SW that gathers network and application logs in real-time and analyzes them
SIEM Security Information and Event Management
autoamtes and improves response time when a SIEM detects a threat/anomaly on the network
SOAR Security Orchestration Automation and response (Next gen SIEM)
