Chapter 15 Flashcards
verifying a control is functioning properly; include scans, pen tests
security tests
comprehensive reviews of a system’s security; involves a risk assessment
security assessment
essentially an outsourced security assessment
security audit
two Third party audit standards
SSAE 18 - Statement on Standards for Attestation Engagements
ISAE 3402 - International Standard for Attestation Engagements
This level of SOC Engagement assesses the organization’s controls that might impact the accuracy of financial reporting
SOC 1
This level of SOC Engagement assesses the organization’s controls that affect the security and privacy of information - these are usually confidential
SOC 2
This level of SOC Engagement assesses the organization’s controls that affect the security and privacy of information and are intended for public disclosure
SOC 3
This kind of SOC report provide the auditor’s opinion on the description provided by management and the suitability of the design of the controls.
Type I Report
This kind of SOC report provides the auditor’s opinion on the operating effectiveness of the controls
Type II Report
A framework for conducting audits that is maintained by ISACA
COBIT - Control Objectives for Information and Related Technologies
NIST language for describing and evaluating vulnerabilities
Security Content Automation Protocol (SCAP)
a language for specifying security checklists
XCCDF - Extensible Configuration Checklist Description Format
a language for describing security testing procedures
OVAL - Open Vulnerability and Assessment Language
a scan that only sends a SYN message but never finishes the handshake
TCP SYN / half-open scan
a scan that completes a handshake, then closes the connection
TCP Connect Scanning
a scan that sends an ACK message to test firewall configurations
TCP ACK Scan
a scan that looks for open UDP ports
UDP scan
a scan with the FIN, PSH, and URG flags set
Xmas Scan
the most formal code review process, containing 6 steps
Fagan inspections
6 steps of Fagan inspections
- Planning
- Overview
- Preparation
- Inspection
- Rework
- Follow-Up
evaluating the security of software without running it by analyzing either the source code or the compiled application
static application security testing (SAST)
evaluating the security of a software in a runtime environment
dynamic application security testing (DAST)
scripted transactions with known expected results
synthetic transactions
real-time analysis of runtime behavior, application performance, HTTP/HTTPS traffic, framework, components, and backend connections
IAST - Interactive Application Security Testing
a tool that runs on a server and intercepts calls to and from an application and validates data requests
RASP - Runtime Application Self-Protection
assessing the performance of modules against the interface specifications to ensure they are working together properly when development efforts are complete
interface testing
