1.7 - Security Assessments

Question 1

Define Threat Hunting.

Answer 1

The practice of proactively searching for cyber threats that are lurking undetected in a network.

Question 2

Define Vulnerability Scans.

Answer 2

The process of identifying security weaknesses and flaws in systems and software running on them. They are usually minimally invasive. This is not the same as a penetration test.

Question 3

Define Port Scan.

Answer 3

A vulnerability scans that focuses on ports. It can discover vulnerable ports that are open.

Question 4

Define a Non-Intrusive scan.

Answer 4

A type of vulnerability scan that gathers information but does not try to exploit vulnerabilities.

Question 5

Define an Intrusive Scan.

Answer 5

A type of vulnerability scan that focuses on exploiting vulnerabilities.

Question 6

Define a Non-Credentialed scan.

Answer 6

A type of vulnerability scan that attempts to gain access from the perspective of someone who does not have access to the network.

Question 7

Define a Credentialed scan.

Answer 7

A type of vulnerability scan that attempts to emulate an insider attack (an attack from someone who does have access to the network).

Question 8

List some of the places that a Vulnerability Scan could find vulnerabilities.

Answer 8

1) Applications
2) Web Applications
3) Network (devices, firmware, ports, etc.)

Question 9

Where can you go to do Vulnerability Research?

Answer 9

1) National Vulnerability Database
2) Common Vulnerabilities and Exposures (CVE)
3) Microsoft Security Bulletins

Question 10

What might a Vulnerability Scan find?

Answer 10

1) Lack of Security Controls
2) Misconfigurations
3) Real Vulnerabilities

Question 11

Define Security Information and Event Management (SIEM).

Answer 11

A database that logs security events and information. It can line diverse data types. Allows for forensic analysis.

Question 12

Define Syslog (System logging protocol).

Answer 12

A protocol that facilitates the transfer of information from network devices to a central server, known as syslog server, in a particular message format.

Question 13

Define Security Monitoring.

Answer 13

Involves collecting and analyzing information to detect suspicious behavior or unauthorized system changes on your network, defining which types of behavior should trigger alerts, and taking action on alerts as needed.