5.5 Explain types and purposes of audits and assessments

Question 1

Audits and Assessments

Answer 1

Internal

• Internal Audits: Systematic evaluations by the organization’s audit team to assess controls, compliance, and system integrity.
  
  • Focus: Data protection, network security, access controls, incident response.
  • Process: Review policies, check access, test controls, and document findings for improvements.
• Internal Assessments: Identify risks and vulnerabilities, often before new systems or major changes.
  
  • Types: Self-assessments, vulnerability assessments, threat modeling, risk assessments.
  • Process:
    
    • Threat Modeling: Identify threats (e.g., SQL injection, XSS).
    • Vulnerability Assessment: Use tools and testing to find weaknesses.
    • Risk Assessment: Evaluate threats by likelihood, impact, and mitigation costs.
    • Mitigation Strategies: Recommend fixes, new controls, or architectural changes.

External

• External Audits: Independent evaluations of systems, applications, and security controls.
  
  • Focus: Data protection, network security, access controls, incident response.
  • Ensures compliance with standards like GDPR, HIPAA, PCI DSS.
• External Assessments: Identify vulnerabilities using automated tools and manual tests.
  
  • Types: Risk assessments, vulnerability assessments, threat assessments.
• Examinations: External inspections of security infrastructure, including network security and access controls. May involve testing key personnel, certifications, and assessments.

Question 2

Penetration Testing

Answer 2

• Physical: Tests physical security.
• Offensive (Red Teaming): Proactively uncovers vulnerabilities.
• Defensive (Blue Teaming): Focuses on detecting and responding to attacks, improving incident response.
• Integrated (Purple Teaming): Combines offensive and defensive efforts, fostering collaboration between red and blue teams.

Question 3

Reconnaissance in Pentesting

Answer 3

• Reconnaissance: Initial phase where information about the target is gathered to plan the attack and improve success.
• Types of Reconnaissance:
  
  • Active: Direct interaction with the system (e.g., scanning with Nmap).
  • Passive: Collects data without direct interaction (e.g., WHOIS, open-source intelligence).
• Environment Types:
  
  • Known Environment: Testers have detailed knowledge, simulating insider threats.
  • Partially Known Environment: Testers have limited information, mimicking partial insider knowledge.
  • Unknown Environment: Testers start with no information, replicating an external attacker’s approach.

Question 4

Attestation of Findings

Answer 4

Confirms accuracy and authenticity of information.

• In Penetration Testing:
  
  • Validates tests and findings, required for compliance (e.g., HIPAA, PCI DSS).
  • Attestation: Includes evidence. Letter of attestation may be issued for third-party verification.
  • Report: Focuses on findings and recommendations.
• Types:
  
  • Software: Confirms software integrity.
  • Hardware: Verifies hardware integrity.
  • System: Validates system security and compliance.
• In Audits:
  
  • Internal: Checks compliance and controls.
  • External: Validates financials and operations.