Security Plus - Chapter 5 Flashcards

Question

Extensible Configuration Checklist Description Format (XCCDF)

Answer 1

A language for specifying checklists and reporting checklist results.

Answer 2

A language for specifying low-level testing procedures used by checklists.

Answer 3

Tenable Nessus - Widely respected and one of the first products introduced Qualys - Commercially available and more recent product Rapid 7 Nexpose - Commercially available and more recent OpenVAS free alternative to commercially available

Answer 4

Analyzes code without executing the code.

Answer 5

Executes the code as part of the test, running the interfaces that the code exposes to the user with a variety of inputs, searching for vulnerabilities.

Answer 6

Analyzes the source code while testers interact with the application through exposed interfaces.

Answer 7

Tools that examine the security of web applications that test for web-specific vulnerabilities like SQL injection, cross site scripting (XSS), and cross-site request forgery (CSRF) vulnerabilities.

Answer 8

Nessus - Vulnerability Name, Overall Severity, Detailed Description, Solution, See Also (References), Output (Description of the remote section), Portal/Hosts (Details on the server that contains the vulnerability), Vulnerability Information (Miscellaneous information about the vulnerability, Risk Information (Useful information for assessing the severity of the vulnerability.

Answer 9

An industry standard for assessing the severity of security vulnerabilities. It scores vulnerabilities on a variety of measures: Attack Vector Metric - Evaluates the exploitability Attack Complexity Metric - Evaluates the exploitability Privileges Required Metric - Evaluates the exploitability User Interaction Metric - Evaluates the exploitability Confidentiality Metric - Evaluates the impact of the vulnerability CVSS Confidentiality Metric - Evaluates the impact of the vulnerability Integrity Metric - Evaluates the impact of the vulnerability Availability Metric - Evaluates the impact of the vulnerability Scope Metric - Scope of the vulnerability

Answer 10

Describes how an attacker would exploit the vulnerability.

Answer 11

Describes the difficulty of exploiting the vulnerability.

Answer 12

Describes the type of account access that an attacker needs to exploit the vulnerability.

Answer 13

Describes whether the attacker needs to involve another human in the attack.

Answer 14

Describes the type of information disclosure that might occur if an attacker successfully exploits the vulnerability.

Answer 15

Describes the type of information alteration that might occur if an attacker successfully exploits the vulnerability.

Answer 16

Describes the type of disruption that might occur if an attacker successfully exploits the vulnerability.

Answer 17

Describes whether the vulnerability can affect system components beyond the scope of the vulnerability.

Answer 18

Single-line format to convey the ratings of a vulnerability on all eight of the metrics described.

Answer 19

CVSS Score Rating 0.0 None 0.1-3.9 Low 4.0-6.9 Medium 7.0-8.9 High 9.0-10.0 Critical

Answer 20

When a scanner reports a vulnerability that does not exist.

Answer 21

When a scanner reports a vulnerability.

Answer 22

When a scanner reports there are no vulnerabilities.

Answer 23

When a scanner reports there are no vulnerabilities when there actually are some on the system.

Answer 24

Log Reviews Security Information and Event Management systems Configuration Management systems

Answer 25

The process of applying updates to operating systems, applications, and other systems and tools.

Answer 26

Systems that are no longer supported by the vendors that produced those systems.

Answer 27

A cause of vulnerabilities due to the below poor security practices: -Using default settings for setup/configuration pages -Using default credentials or unsecured accounts of standard user and administrator accounts -Leaving open service ports that are not necessary to support normal system operations -Leaving open permissions that allow users to access that violates the principle of least privilege

Answer 28

Gives the developer crucial error information needed to troubleshoot applications in the development process. This could provide an attacker the ability to gain information of the inner workings of an application, on the structure of a database, authentication mechanisms, or other details.

Answer 29

Early protocols utilized without security controls established. TelNet and FTP are two examples.

Answer 30

Utilizing broken cryptographic algorithms which are easily defeated by an attacker.

Answer 31

A review of an organizations systems to determine if the security controls established by the organization are sufficient enough to maintain the security while a sophisticated attacker attempts to defeat those controls.

Answer 32

Understanding the process of an attacker, knowing that they only need one vulnerability to be able to compromise an entire network of an organization. To find these vulnerabilities, security professionals must think like the mind of an adversary.

Answer 33

-Provides the organization with an understanding of an attacker, if successful what security controls were not properly configured or established and if they are unsuccessful that we are confident that we have established the proper security controls to thwart the advances of an attacker. -If the attackers are successful, it provides the blueprint for remediation of the attack. The organization would be able to trace the actions of the attacker through the network as they progressed and close the series of open doors and establish the necessary security controls to block future attacks. -The tests can provide the organization with essential, focused information on specific attack targets.

Answer 34

Searching the organizations technology infrastructure for the artifacts of a successful attack. This assumes attackers have already gained access to the system and the organization finding evidence of this successful attack.

Answer 35

Identifying and exploiting vulnerabilities in an organization's physical security controls.

Answer 36

A proactive approach where security professionals act as an attacker to identify and exploit vulnerabilities in an organization's networks, systems, and applications.

Answer 37

Evaluating an organization's ability to defend against cyberattacks. Testing the defenses that are established.

Answer 38

Combines both offensive and defensive testing to provide a comprehensive assessment of an organization's security posture.

Answer 39

Performed with full knowledge of the underlying technology, configurations, and settings that make up the target.

Answer 40

Intends to replicate what an actual attacker would encounter.

Answer 41

A blend of known and unknown testing. The tester may be provided some information about the environment without giving full access, credentials, of configurations.

Answer 42

The agreed upon testing process and permission that the testing firm is given to attack the organizations networks.

Answer 43

Timeline - When the testing is permitted to be performed. What targets - What locations, systems, applications, and other potential areas that are permitted to be tested. Data handling requirements - How information gathered during the testing will be collected, maintained, provided to the organization, and destroyed at the end of the testing agreement. Behaviors - What the organization can perform in regards to defensive controls for the testers to perform sufficient testing to the organizations satisfaction. What Resources - Understanding what time commitment may be required from administrators, developers, engineers, operations center, and other experts of the targets that may be included in working through the testing. Legal Concerns - Include a review of the laws that cover the target organization, any remote locations, and any service providers that may be in scope. Communications - How often will the testing firm communicate with the organization engaging in the tests. How should testers respond if they are successful in breaching the organization. How should the testers respond in the case of finding evidence that a breach has already occurred. Limitations - Including what systems or targets the testing firm is permitted to access and where they are not permitted to access. Problem handling and resolution - Understanding how the testing firm will provide assistance in the case that the testing causes disruption to systems and services.

Answer 44

Techniques used to seek to gather information without directly engaging with the target.

Answer 45

Techniques used that directly engage the target in intelligence gathering. Port Scanning Footprinting - Identifying operating systems and applications in use Vulnerability Scanning

Answer 46

The use of vehicles or unmanned vehicles to drive or fly near an organization to identify unsecured wireless network that the attacker may be able to utilize to gain access.

Answer 47

Initial Access - When the attacker exploits a vulnerability Privilege Escalation - Using hacking techniques to shift from initial access to establishing advanced privileges. Pivoting (Lateral Movement) - Occurs when the attacker moves from one system if the initial access to additional systems within the network. Persistence - Attacker establishes backdoors into the systems and using other mechanisms to regain access to the network even if the initial vulnerability is patched.

Answer 48

Security tests Security assessments Security audits

Answer 49

Verify that a control is functioning properly. - Automated scans - Tool-assisted penetration tests - Manual attempts to undermine security

Answer 50

- Availability of security testing resources - Criticality of systems and applications being protected by the controls. - Sensitivity of information contained on tested systems - Likelihood of a technical failure of the mechanism implementing the control - Likelihood of a misconfiguration of the control - Risk that the system will come under attack - Rate of change of the control configuration - Other changes in the technical environment that may affect performance - Difficulty and time required to perform a control test - Impact of the test on normal business operations

Answer 51

Comprehensive reviews of the security of a system, application, or other tested environment. This can be performed by internal staff members or an authorized external third-party.

Answer 52

Comprehensive, impartial, and unbiased view of the security controls of a system, application, or other tested environment performed by an authorized third-party of independent auditors.

Answer 53

Audits performed by internal staff members that are members of the organizations audit team. The reports are intended for internal audiences.

Answer 54

Audits performed by an outside auditing firm who serves as an independent third party.

Answer 55

Audits performed by an external firm on behalf of another organization. Example, a regulatory body may have the authority to initiate an audit of a regulated firm under contract or law.

Answer 56

Accounting group that provides a common standard to be used by auditors performing assessments of service organizations.

Answer 57

Framework of the common requirements that organizations should have in place surrounding their information systems.

Answer 58

Identification, Analysis, Response and remediation, Validation of remediation, Reporting

Answer 59

The first stage where the organization becomes aware of the vulnerability that exists within the organization. Ways orgs are made aware of a vulnerability: - Vulnerability scans of the environment - Penetration tests of the organization - Reports from responsible disclosures - Results of system and process audits

Answer 60

The second stage of the life cycle where the cybersecurity professionals perform an analysis of the report.

Answer 61

- Confirm there is a vulnerability and it is not a false positive - Prioritize and categorize the vulnerability using tools such as CVSS and CVE - Supplement the external analysis with the organization's specific details for risk assessment. Assess using the exposure factor, environmental variables, industry and organizational impact, and the organizations risk tolerance.

Answer 62

Using the outcome of the report to guide the organization to identify the vulnerabilities that are most in need of remediation.

Answer 63

- Apply a patch or other corrective measure to correct the vulnerability - Use network segmentation to isolate the affected system so that the probability of an exploit becomes remote. - Implement other compensating controls, such as application firewalls or intrusion prevention systems, to reduce the likelihood that an attempted exploit will be successful. - Purchase insurance to transfer the financial risk of the vulnerability to an insurance provider. - Grant an exception or exemption to the system as part of a formal risk acceptance strategy.

Answer 64

After completion of the remediation, the cybersecurity professionals should perform a validation that the vulnerability is no longer present.

Answer 65

Communicating the findings, action taken, and lessons learned to relevant stakeholders within the organization.