2.4: Vulnerability Management Flashcards
What is the purpose of vulnerability Management
To identify and manage vulnerabilities in IT application and infrastructure
What can cause vulnerabilities
Errors in configuration, flaws in overall architecture, or form newly discovered weakness reported by security researchers.
Activities of the vulnerabilities Management
- Subscribing to security alerts
- Subscribing to security alerts
- Patch management
- Corrective action process
Purpose of threat management
The purpose of threat management is to acquire intelligence on credible threats that may be realized in the organization.
Threat Hunting
The activity of proactively looking for active threats
Threat modeling
The activity of looking for potential threats
Internal sources that provide information about threats
Security systems such as IPSs, firewall, data loss prevention systems, web-filtering system
External sources that provide information about threats
Subscription to threat intelligence feeds
System Hardening
is the process of changing the configuration of a system (which could be a server, subsystem, or network device) so that it is more resistant to malfunctions and attacks.
Risks caused by servers consolidations
Consolidation may reduce the number of servers and make an environment simpler, but it also increases risk.
sendmail program
Sendmail is a large, complex program that is the subject of ongoing security research, and new vulnerabilities are discovered from time to time.
Why should Nonessentiel user IDS be removed
Because hackers often exploit access privileges for nonessential user IDs such as guests accounts
What does virtualization permit
Virtualization permits two or more operating systems to run concurrently on a hardware system, each with its own share of resources, and each operating as though it were running on its own physical server.
User access provisioning
the process whereby user accounts are created for new employees and other personnel.
Employee transfers
employee’s old access rights should be rescinded when their new accesses are provisioned.
