1.7 Security Assessment Techniques

Question 1

Threat hunting is a game of cat and mouse. Why is it important to fight back against the adversaries?

Answer 1

Intelligence data is reactive. You can’t stop an attack off of info alone.

Question 2

This is the process of combining multiple sources of intelligence in order to analyze massive amounts of data and find correlations.

Answer 2

Intelligence fusion

Question 3

What are the 3 main steps of intelligence fusion?

Answer 3

Collect the data

Add external sources

Correlate with big data analytics

Question 4

This process involves moving firewalls, operating systems, setting firewall rules, and more to combat the constant change from multiple enemy fronts in the cyber realm.

Answer 4

Cybersecurity maneuvers

Question 5

Less invasive than penetration testing. Involves scanning things like port security in order to detect possible vulnerabilities in your systems.

Answer 5

Vulnerability scanning

Question 6

Name the 4 main vulnerability scan types and their purposes.

Answer 6

Non-intrusive - gather info

intrusive - exploit a vulnerability

non-credentialed - emulates external

credentialed - internal threat

Question 7

This is what happens when a vulnerability scan indicates a problem when there really wasn’t one.

Answer 7

False positive

Question 8

This is when a vulnerability does exist but your scanner does not detect it.

Answer 8

False Negative

Question 9

Whats the best way to mitigate vulnerabilities without having to use a vulnerability scanner?

Answer 9

Configuration reviews

Question 10

The process for logging security events and information.

Answer 10

Security information and event management (SIEM)

Question 11

This is the standard used for security message logging, often integrated into a SIEM server. Requires lots of disk space to store logs.

Answer 11

Syslog

Question 12

Name a few data inputs that are logged thorugh SIEM.

Answer 12

– Server authentication attempts
– VPN connections
– Firewall session logs
– Denied outbound traffic flows
– Network utilizations

-Packet caputures

Question 13

This method has the goal of taking manual tasks in security management and automating them.

Answer 13

Security orchestration, automation, and response (SOAR)

Question 14

What is oen of the biggest advantages of implementing SOAR for security management?

Answer 14

It is much faster and changes take place immediately