1.7 Security Assessment Techniques

Question 1

Define Threat Hunting: Intelligence Fusion

Answer 1

Combining internal security log data with threat feeds from external sources to identify attacks

Question 2

Define Threat Hunting: Advisories & Bulletins

Answer 2

Monitoring resources provided by external entities listing new and emerging threats and vulnerabilities

Question 3

Define Threat Hunting: Maneuver

Answer 3

Thinking like an attacker to identify trends/patterns that may indicate an attack or breach

Question 4

Define Vulnerability scan: false positive

Answer 4

Detection of a vulnerability when one doesn’t actually exist, an error

Question 5

Define vulnerability scan: false negative

Answer 5

When a vulnerability scan fails to detect an existing vulnerability, this is dangerous

Question 6

Define vulnerability scan: credentialed

Answer 6

Running the scan as a logged in user to determine vulnerabilities that a non-credentialed scan might not detect

Question 7

Define vulnerability scan: non-credentialed

Answer 7

Running the scan as an external user that does not have any permissions to the systems

Question 8

Define vulnerability scan: intrusive vs non-intrusive

Answer 8

1. non-intrusive scan simply identifies vulnerabilities
2. intrusive scan actually tries to exploit any vulnerabilities found

Question 9

Define vulnerability scan: application

Answer 9

Specific desktop applications, such as MS Word, may have vulnerabilities that need to be patched

Question 10

Define vulnerability scan: web application

Answer 10

Web-application software, such as Python, might have vulnerabilities and need to be patched

Question 11

Define vulnerability scan: network

Answer 11

Vulnerabilities within network hardware/devices, such as open ports or a misconfigured firewall

Question 12

How can Common Vulnerabilities & Exposures (CVE) data help with vulnerability scans?

Answer 12

CVE (common vulnerabilities and exposures) are databases of threats that can be referenced by vulnerability scanners for more information on vulnerabilities found by scanner

Question 13

What is CVSS?

Answer 13

Common Vulnerability Scoring System, a scoring system from 1-10 to indicate how serious a vulnerability is

Question 14

Define Vulnerability scan: Configuration review

Answer 14

Review of configurations, such as accounts on a workstation or server, firewall ACLs, to check for any misconfigurations

Question 15

Define Security Information and Event Management (SIEM

Answer 15

A central repository where all logging information, such as security logs, network traffic logs, etc.. is aggregated for analysis

Question 16

How does SIEM help from a security stand-point?

Answer 16

It can create reports summarizing information from logs to allow easier identification of anomalies or potential attacks/threats

Question 17

Define user behavior analysis relative to SIEM

Answer 17

Establishes a baseline of how users normally interact with systems in order to identify anomalies that might represent a threat/attack

Question 18

Define sentiment analysis

Answer 18

Understanding how the public feels about your organization which may provide motivation for attackers

Question 19

Define log collectors relative to SIEM

Answer 19

The log collector is able to collect logs from disparate systems, such as Linux, Windows, and include them in the SIEM database

Question 20

Define log aggregation relative to SIEM

Answer 20

The combination of log information from different systems into a single database for analysis

Question 21

Define Security Orchestration Automation and Response (SOAR), 2 capabilities

Answer 21

1. Automate manual and tedious tasks to ensure security is applied en masse
2. Dynamically apply security in response to real-time events