1.7 Summarize the techniques used in security assessments Flashcards
Intelligence Fusion
Taking big data and use data analytics to identify potential threats
Threat Feeds
Additional sources that provide information on attack vectors
Maneuvers
Automated system that combats threats. (Big data that is analyzed and if a threat is there, the system blocks it.)
Vulnerability Scanning
Scans data from a Threat Actor perspective on for weakness
Non-Intrusive Scan
Gather info on vulnerability but doesn’t act on it.
Intrusive Scan
Gather info on vulnerability but DOES act on it.
Non-credential Scans
Threat Actor that DOES NOT a login to access your network and looks for vulnerabilities
Credential Scans
Threat Actor that DOES HAVE RIGHTS to the network and will try to find vulnerabilities for a USER perspective
Where to Scan for Vulnerabilities
Apps, Web App, andNetwork
CVE Data Base
Common Vulnerability and Exposure. Data base that is a summary of vulnerabilities.
CVSS
A data base that scores the vulnerability on how severe it is.
CVSS Versions
2.0 and 3.0 both have different scoring
Vulnerability scan LOG REVIEW
A log that displays vulnerabilities with Security Controls, Misconfigurations, and Real vulnerabilities (newer ones)
False Positives
A vulnerability is identified but doesn’t really exist
False Negative
A vulnerability exists, but the scan didn’t detect it.
Config Review
Checking the device it self for Obvious vulnerabilities.
SIEM
Security Information and Event Management.
A system that logs security events from a network in real time.
Syslog
A standard that allows log files to be sent from many devices.
(Windows, Linux, router, switch)
SIEM Data Inputs
Types of information that SIEM would look for: Sever, VPN, Firewall, Traffic flows, Network, Packets
Security Monitoring on a SEIM
A way to track incoming information and annotate security exceptions.
SIEM Behavior Analysis
How people are using a network. If the user is a risk.
Sentiment Analysis
How much people HATE your organization. Attracts more Threat Actors to your organization.
SOAR
Security Orchestration automation and response
-Automated way to handle security task. (24hrs and instantly)
