1.7 Summarize the techniques used in security assessments

Question 1

Threat hunting

Answer 1

A dynamic process of seeking out cybersecurity threats inside your network from attackers and malware threats

Question 2

Intelligence fusion

Answer 2

Fusion Centers are state-owned and operated centers that serve as focal points in states and major urban areas for the receipt, analysis, gathering and sharing of threat-related information between State, Local, Tribal and Territorial (SLTT), federal and private sector partners.

Involves Industry and government

Question 3

Advisories and bulletins

Answer 3

Advisories and bulletins provide good advice on how to keep you company safe.

The advisories tend to be released government-funded agencies

Bulletins tend to be released by vendors or private companies.

Question 4

Maneuver

Answer 4

A cybersecurity maneuver, then, refers to a company’s efforts to defend itself by disguising its systems, thereby making it difficult to successfully infiltrate.

Question 5

Vulnerability scans

Answer 5

A vulnerability scanner is a program specifically designed to scan a system via the network to determine which services the system is running and whether any unnecessary open network ports, unpatched operating systems and applications, or backdoors can be exploited.

Network administrators can use the same vulnerability scanner software to take preventive measures to close vulnerabilities that exist on their systems.

Vulnerability scanner typically include a few scanning and security assessment capabilities, such as configuration scanning, port scanning, network scanning and mapping, and OS and application server scanning.

Question 6

False positives (Vulnerability scans)

Answer 6

A false positive occurs when a vulnerability scan reports a vulnerability that does not actually exist.

It’s worth looking at each result to be sure it is legitimate, especially if you plan to use the results to make enterprise wide changes.

Question 7

False negatives (Vulnerability scans)

Answer 7

A false negative occurs when a vulnerability indeed exists but it is not detected by the scanner.

Question 8

Log reviews (Vulnerability scans)

Answer 8

Log reviews from servers, applications, network devices and other sources that might contain information about possible attempts to exploit detected vulnerabilities.

Question 9

Credentialed vs. non-credentialed (Vulnerability scans)

Answer 9

A credentialed scan is a much more powerful version of the vulnerability scanner. It has higher privileges than a non-credentialed.

Credentialed scans may access operating systems, databases, and applications, among other sources.

A non-credentialed scan has lower privileges than a credentialed scan. It will identify vulnerabilities that an attacker would easily find.

Question 10

Intrusive vs. non-intrusive (Vulnerability scans)

Answer 10

Non-intrusive scans are passive and merely report vulnerabilities. They do not cause damage to your system.

Intrusive scans can cause damage as they try to exploit the vulnerability and should be used in a sandbox and not on your live production system.

Question 11

Application (Vulnerability scans)

Answer 11

Before applications are released, coding experts perform regression testing that will check code for deficiencies

There are three techniques to this scan:

*Static testing = analyzes code without executing it. This approach points developers directly at vulnerabilities and often provides specific remediation suggestions.

*Dynamic testing = executes code as part of the test, running all the interfaces that the code exposes to the user with a variety of inputs, searching for vulnerabilities.

*Interactive testing = combines static and dynamic testing, analyzing the source code while testers interact with the application through exposed interfaces.

Question 12

Web Application (Vulnerability scans)

Answer 12

Web application scanners are specialized tools used to examine the security of web applications. These tools test for web-specific vulnerabilities, such as SQL injection, xss, and xsrf or csrf vulnerabilities.

Question 13

Network (Vulnerability scans)

Answer 13

These scans look at computers and devices on your network and help identify weaknesses in their security.

Question 14

Common Vulnerabilities and Exposures or CVE/ Common Vulnerability Scoring System or CVSS (Vulnerability scans)

Answer 14

The Common Vulnerability Scoring System CVSS is an industry standard for assessing the severity of security vulnerabilities. It provides a technique for scoring each vulnerability on a variety of measures

Common Vulnerabilities and Exposures CVE is simply a list of all publicly disclosed vulnerabilities that includes the CVE ID, a description, dates, and comments.

CVSS score:

• 0.0 = none
• 0.1 - 3.9 = low
• 4.0 - 6.9 = medium
• 7.0 - 8.9 = high
  *9.0 - 10.0 = critical

The CVSS sore is not reported in the CVE listing - you must use the National Vulnerability Database NVD to find assigned CVSS scores.

The National Vulnerability Database NVD is a database, maintained by NIST, that is synchronized with the MITRE CVE list

Question 15

Configuration review (Vulnerability scans)

Answer 15

Configuration compliance scanners and desired state configuration in PowerShell ensure that no deviations are made to the security configuration of a system.

Question 16

Syslog/Security information and event management (SIEM)

Answer 16

SIEM system that collects data from many other sources within the network

Provides real-time monitoring, analysis, correlation and notification of potential attacks

Question 17

Review reports (Syslog/Security information and event management or SIEM)

Answer 17

A SIEM typically includes dashboard and collects reports that can be reviewed regularly to ensure that the policies have been enforced and that the environment is complaint.

Also highlight whether the SIEM system is effective and working properly.

Question 18

Packet capture (Syslog/Security information and event management or SIEM)

Answer 18

Can capture packets and analyze them to identify threats as soon as they reach your network, providing immediate alert to security team if desired.

Question 19

Data inputs (Syslog/Security information and event management or SIEM)

Answer 19

The SIEM system collects a massive amount of data from various sources

May include network devices, IDM, MDM, CASB, XDR, and more.

Question 20

User behavior analysis (Syslog/Security information and event management or SIEM)

Answer 20

This is based on the interaction of a user that focuses on their identity and the data they would normally access on a normal day.

It tracks the devices that the user normally uses and the servers that they normally visit.

Question 21

Sentiment analysis (Syslog/Security information and event management or SIEM)

Answer 21

Artificial intelligence AI and Machine Learning ML to identify attacks.

Cybersecurity sentiment analysis can monitor articles on social media, look at the text and analyze the sentiment behind the articles.

Over time, can identify a users’ attitudes to different aspects of cybersecurity.

Question 22

Security monitoring (Syslog/Security information and event management or SIEM)

Answer 22

Real-time protection and event monitoring system that correlates the security events from multiple resources, identifies a breach, and helps the security team to prevent the breach.

Question 23

Log aggregation (Syslog/Security information and event management or SIEM)

Answer 23

Can correlate and aggregate events so that duplicates are filtered and a better understanding network events is achieved to help identify

Question 24

Log collectors (Syslog/Security information and event management or SIEM)

Answer 24

SIEM has built-in log collector tooling that can collect information from both the syslog server and multiple other servers. An agent is placed on the device that can collect log information, parse and restructure data, and pass to SIEM for aggregation.

Question 25

Security orchestration, automation, and response (SOAR)

Answer 25

Security Orchestration, automation, and response system is a centralized alert and response automation with threat- specific playbooks.

Response may be fully automated or single-click