Chap 1 Sybex Flashcards
Authorized legal attempts to defeat an organization’s security controls and perform unauthorized activities
Pen test
CIA triad
Confidentiality: seek to prevent unauthorized access to info or systems
Integrity: prevent unauthorized modification of info or systems
Availability: seek to ensure that legitimate use of info and systems remains possible
DAD triad
Disclosure: attacks seeks to gain unauthorized access to info or systems
Alternation: seek to make unauthorized changes to info or systems
Denial: attacks seek to prevent legitimate use of info and systems
Using hacking tools and techniques in a code of ethics
Ethical hacking
When to pentest you must adopt the ____ ____
Hacker mindset
Benefits of pen testing
-provides knowledge that you can’t obtain elsewhere
-blueprint for remediation
-essential, focused information about specific targets
Uses the attacker mindset to search the organization’s tech infrastructure for the artifacts of a successful attack on “presumption of compromise”
Threat hunter
Incident response plan (NIST)
-preparation
-detection and analysis
-containment and eradication and recovery
-post incident activity
4 pen test requirements of PCI DSS
-perform external pen test at least annually and after any significant infrastructure or application upgrade or modifications
-perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification
-exploitable vulnerabilities found during pen test are corrected and testing is repeated
-if segmentation is used to isolate CDE (cardholder data environment) from other networks, perform pen test at least annually and after any changes to segmentation controls/methods to verify segmentation methods are operational and effective
2 pros and 2 cons of using internal pen test team
Pros:
-they have contextual knowledge of the organization that can improve effectiveness of testing by providing enhanced subject matter expertise
-less expensive
Cons:
-using internal employees who designed and implement security controls. Can create bias
-more difficult for them to detect flaws
Tests conducted by ____ team or to tests conducted from ____ network perspective
Both are Internal or external
If possible, pen test meme era should be separate from cybersecurity team that designs and operates controls
Separation of duties
3 reasons to do pen testing on periodic basis
-tech environment changes
-attack techniques evolve and updated tests should reflect changing attack techniques
-each team member brings unique set of skills, and talents. Can discover different vulnerabilities
CompTIA pen test stages
Planning and scoping
Information gathering and vulnerability scanning
Attacking and exploiting
Reporting and communication results
What stage of pen test:
Outline clear rules of engagement, decide what systems, data, processes and activities are within the authorized scope of the test
Planning and scoping
What stage of pentest:
Gather information about target, vulnerability scans
Information gathering and vulnerability scanning
What stage of pentest:
Exploit vulnerabilities
Attacks and exploits
Phase of pentest:
Actionable recommendations
Reporting and communication
Cyber kill chain by Lookheed Martin (7 items)
-reconnaissance
-weaponization
-delivery
-exploitation
-installation
-command and control (C2C)
-actions on objectives
What stage is this in the cyber kill chain:
Information gathering (OSINT) and vulnerability scanning
Reconnaissance
What stage of the kill chain is this:
Attackers develop specific tool to exploit vulnerabilities
Weaponization
What stage of the kill chain is this:
Could be exploiting a network or application vulnerability, conducting a social engineering attack, distributing malware on a USB or sending an email
Delivery
What stage of the kill chain is this:
Attacker or victim takes some action that triggers the malware payload
Exploitation
What stage of the kill chain is this:
The attacker uses the initial access provided by the malware to establish permanent or persistent access to the target system. Example: back door
Installation
