5 Security Assessment and Testing Flashcards
What are common sources of vulnerabilities in computing environments?
Improper or weak patch management, weak configuration settings
Weak configuration settings include open permissions, unsecured root accounts, errors, weak encryption settings, insecure protocol use, default settings, and open ports and services.
What is a false positive in vulnerability scanning?
A report that detects a vulnerability that does not exist.
What is a false negative in vulnerability scanning?
A report that does not detect a vulnerability that actually exists.
What is the primary goal of threat hunting?
To discover existing compromises within an organization.
What tools do threat hunters use?
Advisories, bulletins, and threat intelligence feeds.
What is the purpose of vulnerability scans?
To probe systems, applications, and devices for known security issues.
What standards are used to describe and rate vulnerabilities?
Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS).
What is penetration testing?
A simulated cyber attack conducted by security professionals.
What are the three types of environments in penetration testing?
Known environment, unknown environment, partially known environment.
What is the first step in penetration testing?
Reconnaissance efforts.
What is the purpose of bug bounty programs?
To incentivize external security professionals to report vulnerabilities.
What is the purpose of a security audit?
To formally examine an organization’s security controls.
Who can perform security audits?
Internal audit teams or independent third-party auditors.
What are the stages of the vulnerability life cycle?
Vulnerability identification, analysis, response and remediation, validation of remediation, reporting.
What is involved in the analysis stage of the vulnerability life cycle?
Confirming the vulnerability, prioritizing it using CVSS and CVE, considering organization-specific factors.
What are some responses to identified vulnerabilities?
- Applying patches
- Isolating affected systems
- Implementing compensating controls
- Transferring risk through insurance
- Formally accepting the risk.
What is the purpose of validation in the vulnerability life cycle?
To ensure the vulnerability is no longer present.
What does reporting in the vulnerability life cycle inform stakeholders about?
Findings, actions, trends, and recommendations for improvement.
