Chapter 15 Flashcards
verifying a control is functioning properly; include scans, pen tests
security tests
comprehensive reviews of a system’s security; involves a risk assessment
security assessment
essentially an outsourced security assessment
security audit
two Third party audit standards
SSAE 18 - Statement on Standards for Attestation Engagements
ISAE 3402 - International Standard for Attestation Engagements
This level of SOC Engagement assesses the organization’s controls that might impact the accuracy of financial reporting
SOC 1
This level of SOC Engagement assesses the organization’s controls that affect the security and privacy of information - these are usually confidential
SOC 2
This level of SOC Engagement assesses the organization’s controls that affect the security and privacy of information and are intended for public disclosure
SOC 3
This kind of SOC report provide the auditor’s opinion on the description provided by management and the suitability of the design of the controls.
Type I Report
This kind of SOC report provides the auditor’s opinion on the operating effectiveness of the controls
Type II Report
A framework for conducting audits that is maintained by ISACA
COBIT - Control Objectives for Information and Related Technologies
NIST language for describing and evaluating vulnerabilities
Security Content Automation Protocol (SCAP)
a language for specifying security checklists
XCCDF - Extensible Configuration Checklist Description Format
a language for describing security testing procedures
OVAL - Open Vulnerability and Assessment Language
a scan that only sends a SYN message but never finishes the handshake
TCP SYN / half-open scan
a scan that completes a handshake, then closes the connection
TCP Connect Scanning
