1.7 - Summarize the techniques used in security assessments.

Question 1

Threat hunting

Answer 1

-proactive approach to finding perp b4 alerts r triggered
-find perp b4 they find u
-not reactive or detective

Question 2

Intelligence fusion

Answer 2

-too much data to properly detect, analyze, and react
-separate teams (sec.ops, sec. intel, threat response
-fuse sec. data with big data analytics
->analyze large + diverse data sets
->pick out interesting data pts + correlations

Breakdown
-gathering + merging various sources of threat intel data
->open source intel, internal logs, internal feeds
-combine diverse data pts to identify emerging threats + patterns that might go unnoticed when examining individual sources

Fusing data
-collect data = logs, sensors, net. info, internet events, intrusion detection
-add external sources = threat feeds, govt alerts, advisories/bulletins, social media
-correlate wth big data analytics = focuses on predictive analytics + usr behavior analytics, mathematical analysis of unstructured data

Question 3

Threat feeds

Answer 3

-regularly updated streams of info about known threats + vulns. + emerging threats + IOCs
-provides sec. teams wth realtime/near realtime info about mal. IPs, malware signatures, other IOCs
-integrating TFs into sec. sys. orgs can proactively block + detect threats based on latest intel.
-provides orgs wth timely + actionable info to defend
-enables proactive threat detection + response
->helps mitigate risks + protect assets effectively

Question 4

Advisories and bulletins

Answer 4

-

Question 5

Maneuver

Question 6

Vulnerability scans

Question 7

False positives

Answer 7

False positive (106)
-scanner reports vuln. that doesn’t exist

Positive report
-when vuln scanner reports vuln

True positive
-report is accurate

False positive report
-inaccurate report

Question 8

False negatives

Answer 8

Negative report
-scanner reports that a vuln isn’t present

True negative report
-negative report is accurate

False negative report
-negative report is inaccurate

Question 9

Log reviews

Answer 9

-might contain info about possible attempts to exploit detected vuln.

Question 10

Credentialed vs. non-credentialed

Answer 10

• Credentialed scan
  – You’re a normal user,
  emulates an insider attack

Non-credentialed scans
– The scanner can’t login to the remote device

Question 11

Intrusive vs. non-intrusive

Question 12

Application scanning

Answer 12

-commonly used as part of software dev.
-tools analyze custom developed software to identify common sec. vulns.
-occurs using 3 techniques;
-> static testing = analyzes code wthout executing it
->dynamic testing = executes code as part of test.
->interactive testing = combine static/dynamic. analyzes source code while testers interact with app

Question 13

Web application scanners

Answer 13

-tools used to examine sec. of web apps
-test 4 web specific vulns.
->SQL injection, XSS (cross site scripting), CSRF (cross site request forgery) vulns.

Question 14

Network scanners

Answer 14

-prob wide range of net. connected devices 4 known vulns.
-try to determine type of device + its config and then launch targeted tests designed to detect presence of known vulns.
-EX: tenables Nessus, Qualys, Rapid7, OpenVAS

Prevention
-every org. should have at least one scanner
-many orgs choose to deploy two diff. vuln scanning products in same environ as a Defense in depth ctrl

Question 15

Common Vulnerabilities and
Exposures (CVE)/Common
Vulnerability Scoring System (CVSS)

Answer 15

CVSS
-industry standard 4 assessing severity of sec. vuln.
-provides technique 4 scoring each vuln.
-use CVSS ratings to prioritize response actions
-rate vuln on 8 measures
-each measure given:
->descriptive rating + numeric score
-1st four = evaluate exploitability of vuln.
->metrics = attack vector, attack complexity, privileges required, user interaction
-last three = evaluate impact of vuln.
->metrics = confidentiality, integrity, availability
-8th = discusses scope of vuln.
->metric = scope

Question 16

Configuration review

Answer 16

Chapple
Weiss
Gibson

Question 17

Syslog/Security information and event management (SIEM)

Answer 17

-sys that correlate log entries from multiple sources + provide actionable intel

Question 18

Review reports

Answer 18

Chapple
Weiss
Gibson

Question 19

Packet capture

Answer 19

Chapple
Weiss
Gibson

Question 20

Data inputs

Answer 20

Chapple
Weiss
Gibson

Question 21

User behavior analysis

Answer 21

Chapple
Weiss
Gibson

Question 22

Sentiment analysis

Answer 22

Chapple
Weiss
Gibson

Question 23

Security monitoring

Answer 23

Chapple
Weiss
Gibson

Question 24

Log aggregation

Answer 24

Chapple
Weiss
Gibson

Question 25

Log collectors

Answer 25

Chapple
Weiss
Gibson

Question 26

SOAR

Answer 26

Security orchestration, automation, and response

-automate routine/tedious/time intensive activities
->connect many diff tools together (firewalls, acct mgmt, email filters, etc)

-mitigation/recovery tool + incident response

-use playbooks + runbooks (4.4)

-automation
->handle sec tasks automatically
->allow automation of remediation + restoration workflows

-response
->make changes immediately

-Pros
->improve efficiency of threat mitigation + detection
->allow u to quickly assess;
~attck surface of org
~state of systems
~where issues may exist
->frees up admins to focus on other admin tasks
-reduce ammt of time needed to investigate
-can be forwarded to other tools to investigate further
-verify if threat is real or not

Chapple 474
Gibson 408-409
Weiss 108-109, 546-548