542.1 Introduction and Information Gathering Flashcards
Why are web applications important?
- Are ubiquitous across all sizes and types of businesses
- Enable business-critical functionality
- Provide access to sensitive and/or critical data
Web application Pen Test provides one method of assessing an application’s security posture.
Understanding how web app pen testing fits into the overall
spectrum proves important
- Might not be the right or best tool for a given application
- Might need to be complemented by other approaches
Also, varied approaches to web app pen testing itself also exist and could be relevant
What are the different security testing methods?
Security testing methods:
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Interactive Application Security Testing (IAST2)
- Out-of-Band Application Security Testing (OAST3)
What is threat modelling?
Brainstorm potential vulnerabilities and realistic threats to the web
application, then think of mitigation strategies for each weakness:
- Consider using NIST 800-301, Appendix D, as a resource to assist with threat
modeling - Can help to prioritize limited resources to address the most likely attack vectors and weaknesses in the application
What are the Advantages of Threat Modeling?
- Practical attacker’s view of the
system
2.Flexible
3.Early in the SDLC
What are the Advantages of Threat Modeling?
1.) Relatively new technique
2.) Good threat models don’t automatically mean good software
What is Source Code Review?
- Certain vulnerabilities cannot be found without reading the source code
- The time necessary to develop a suitable exploit can be dramatically reduced
- Usually only performed under a full knowledge pen test, or if a vulnerability permits access to source code within the web root.
What are some advantages of a Source Code Review?
- Completeness and effectiveness
- Accuracy
- Fast (for competent reviewers)
What are some disadvantages of a Source Code Review?
- Requires highly skilled security developers
- Can miss issues in compiled libraries
- Cannot detect run-time errors easily
- The source code actually deployed might differ from the one being analyzed
What is Static Application Security Testing (SAST) ?
SAST involves scrutinizing application source code looking for security deficiencies.
Employs tools rather than relying simply on manual code review
- However, SAST can be seen simply as a more automated or efficient type of code review
- Characterized as a full knowledge testing technique due to source code
access being required for this type of testing
What are some strengths and weakness of SAST ?
Strengths: Identifies security deficiencies not readily apparent in deployed application
Weaknesses: Requires access to source code; might overlook APIs or libraries leveraged by the application; overlooks ops side of apps.
What is Dynamic Application of Security Test (DAST) ?
- Commonly used as the sole way to find vulnerabilities in applications
- Pen tests are not always the most efficient method of finding security weaknesses
o Certain classes of vulnerabilities (i.e., logic flaws) are much easier to detect in a DAST test.
What are some advantages and Disadvantage of DAST ?
Advantages
-Can be automated and fast (and therefore cheap)
-Requires a relatively lower skill set than source code review
-Tests the code that is actually being exposed
Disadvantages
-Too late in the SDLC
-Front impact testing only
Wielding DAST tools effectively proves much more challenging than merely pushing a button; at a minimum it requires ?
- Properly configuring scans for the target application
- Guiding scans to ensure comprehensive review
- Following up on results to reduce false positives
- Assessing true positives to understand potential impact
- Understanding and shoring up deficiencies in capabilities
What are Manual Inspections and Reviews ?
Manual inspections are human reviews that typically test the security implications of people, policies, and processes — WSTG v4.2, p. 18
- Involves reviewing documentation, as well as interviewing designers and system owners
- To ensure accuracy, be sure to verify the documentation and information related in
interviews are correct
