Chapter 1 key terms

Question 1

Ethical hacker

Answer 1

A person who hacks into a computer network in order to test or evaluate its security rather than with malicious or criminal intent.

Question 2

vulnerability

Answer 2

A weakness in an information system or in system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

Question 3

penetration testing

Answer 3

Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, a system, or a network.

Question 4

threat actor

Answer 4

A person or group who is responsible for a security incident. The main categories of threat actors are organized crime, insider threat, state sponsored, and hacktivist.

Question 5

insider threat

Answer 5

A threat that occurs when an entity has authorized access and could potentially harm an information system or enterprise through destruction, disclosure, modification of data, and/or DoS.

Question 6

Open Web Application Security Project (OWASP)

Answer 6

A nonprofit organization with local chapters around the world that provides significant guidance on how to secure applications.

Question 7

MITRE ATT&CK

Answer 7

A penetration testing framework/methodology.

Resource for learning about an adversary’s tactics, techniques, and procedures

Question 8

National Institute of Standards and Technology (NIST)

Answer 8

The National Institute of Standards and Technology, which is a part of the U.S. Department of Commerce that helps provide organizations with guidelines on planning and conducting information security testing.

Question 9

Open Source Security Testing Methodology Manual (OSSTMM)

Answer 9

A document that lays out repeatable and consistent security testing.

Question 10

Penetration Testing Execution Standard (PTES)

Answer 10

A penetration testing methodology standard/guidance document that provides information about types of attacks and methods and also provides information on the latest tools available to accomplish the testing methods outlined.
seven phases

Question 11

Information Systems Security Assessment Framework (ISSAF)

Answer 11

A penetration testing methodology that consists of the following phases: information gathering, network mapping, vulnerability identification, penetration, gaining access and privilege escalation, enumerating further, compromising remote users/sites, maintaining access, and covering the tracks.
9 phases

Question 12

vulnerability scanning

Answer 12

A technique used to identify hosts or hosts’ attributes and associated vulnerabilities.