6. Security Assessment And Training

Question 1

Define Vulnerability Testing.

Answer 1

Identifying weaknesses in physical, administrative and logical systems

Question 2

Define penetration testing

Answer 2

Ethics hacking to validate discovered weaknesses.

Question 3

Define black box testing

Answer 3

Zero knowledge of network at start of penetration testing.

Question 4

Define grey box testing

Answer 4

Partial knowledge at start of penetration testing

Question 5

Define white box testing

Answer 5

Full knowledge of network at start of penetration testing

Question 6

What are the steps of Attack Methodology?

Answer 6

1. Reconnaissance
2. Foot printing - mapping network (Nmap)
3. Fingerprinting - identifying host info.
4. Vulnerability assessment - identifying weaknesses in system configuration.
5. Attack - penetration and privilege escalation.

Question 7

What are the 3 basic requirements of penetration testing?

Answer 7

1. Meet with senior management to determine the goal.
2. Document rules of engagement.
3. Get sign off from senior management.

Question 8

What is the purpose of penetration testing?

Answer 8

To determine subjects ability to withstand an attack and determine effectiveness of current security measures.

Question 9

What are the 3 types of penetration testing?

Answer 9

1. Physical - get into physical area/remove materials or place marker in.
2. Administrative - get sensitive information from users.
3. Logical security - attacks on systems, networks or communications.

Question 10

Which IDS can read encrypted data?

Answer 10

HIDS

Question 11

Define NDS

Answer 11

Network based Intrusion Detection System.
Focuses on the whole network and the machines on it. Acts as a traffic collector.
Disadvantages: data must be decrypted. Switches cause issues because of port spans.

Question 12

Define HIDS

Answer 12

Host based IDS.

Disadvantages: only protects one machine, can be disabled, scalability is costly, uses local resources.

Question 13

Define the two types of Analysis Engines?

Answer 13

1. Pattern matching - signature based on data from attacker to victim.
2. Profile Matching - looks for change in “normal” behavior. System builds profile from watching work for a few weeks and then goes into action.

Question 14

What are issues with each type of analysis engine?

Answer 14

1. Pattern matching - must pay for signature subscription, does not stop 0 day attacks.
2. Profile matching - lots of false- positives, often ignored due to frequency of false positives. Requires someone very skilled to use it.

Question 15

What is the damager of honey pots?

Answer 15

Enticement vs entrapment.