1C: Compare Standards and Methodologies

Question 1

An organization aimed at increasing awareness of web security and provides a framework for testing during each phase of the software development process. Among other listed tools, they list the top 10 vulnerabilities.

Answer 1

Open Web Application Security Application Project (OWASP)

Question 2

An organization founded in 1901, they exist to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. One such publication includes SP 800-115.

Answer 2

The National Institute of Standards and Technology (NIST)

Question 3

Written in 2000, this is a methodology to test the operational security of physical locations, workflow, human security testing, physical security testing, wireless security testing, telecommunication security testing, data networks security testing and compliance.

Answer 3

Open Source Security Testing Methodology Manual (OSSTMM)

Question 4

This is a framework written in 2005 that details structured guidelines and best practices to accomplish a PenTesting exercise. The framework is obtained by downloading a RAR file containing 14 documents.

Answer 4

Information Systems Security Assessment Framework (ISSAF)

Question 5

Developed by business professionals as a best practice guide to PenTesting, this framework has seven main sections that provide a comprehensive overview of the proper structure of a complete PenTest.

Answer 5

The Penetration Testing Execution Standard (PTES)

Question 6

This is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations including attack paths exploited by APTs.

Answer 6

MITRE ATT&CK Framework

Question 7

CompTIA defines this as: a risk management approach to QUANTIFYING VULNERABILITY DATA and then taking into account the degree of risk to different types of systems or information (AKA a system that provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity).

Answer 7

Common Vulnerability Scoring System (CVSS)

Question 8

A scheme for identifying publicly disclosed vulnerabilities developed by MITRE and adopted by NIST. Each entry refers to specific vulnerability of a particular product and iscataloged with the name and description of the vulnerability.

Answer 8

Common Vulnerabilities and Exposures (CVE)

Question 9

A community-developed database that is a dictionary of software-related vulnerabilities maintained by the MITRE Corporation.

Answer 9

Common Weakness Enumeration (CWE)