1.7 Techniques used in security assessments

Question 1

Intelligence fusion

Answer 1

This combines information from threat feeds, security advisories and bulletins and other sources

Question 2

Threat feeds

Answer 2

These are intended to provide up to date detail about threats in a way that your organization can leverage.

Question 3

Advisorie and bulletins

Answer 3

This is part of threat hunting

Question 4

maneuver

Answer 4

this is part of threat hunting

Question 5

False positives

Answer 5

When a scanner reports a vulnerability that doesnt exist

Question 6

false negatives

Answer 6

When a vulnerability scanner reports an inaccurate report

Question 7

log reviews

Answer 7

These are from servers, applications etc, that might contain information about possible attempts to exploit detected vulnerabilities

Question 8

credentialed vs. non credentialed

Answer 8

Credentialed scan can check whether the update is installed on the system before reporting a vulnerability

Question 9

application

Answer 9

These are commonly used as part of the software development process to identify common security vulnerabilities

Question 10

web application

Answer 10

Specialized tools used to examine the security of web applications. They test for SQL injections, XSS etc.

Question 11

network

Answer 11

Vulnerability scan that runs over a network, probing the system from a distance

Question 12

common vulnerabilities and exposures (CVE)

Answer 12

Provides a standard nomenclature for describing security-related software flaws

Question 13

common vulnerability scoring system (CVSS)

Answer 13

Provides a standardized approach for measuring and describing the severity of security related software flaws

Question 14

Syslog/Security information and event management (SIEM)

Answer 14

Systems that correlate log entries from multiple sources and provide actionable intelligence

Question 15

Packet Capture

Answer 15

The ability to capture and analyze raw packet data from network traffic can be useful for incident analysis

Question 16

Data inputs

Question 17

sentiment analysis

Answer 17

A process by which they look at text using natural language processing and other text analysis tools to determine emotions from textual data

Question 18

security monitoring

Answer 18

This is a tool that organizations use called SIEM

Question 19

log aggregation

Answer 19

Taking data from a variety of sources and then performing correlation and analysis activities with that data.

Question 20

log collectors

Answer 20

This is an open source and commercially supported syslog tool that can parse and generate log files in many common formats.

Question 21

Security orchestration, automation, and response (SOAR)

Answer 21

These help with the mitigation and recovery processes that often reconfigure endpoint security solutions to ensure organizations are secure.