Chapter 15: Security Assessment and Testing Flashcards
_____ assessment and testing programs perform regular checks to ensure that adequate security controls are in place and that they effectively perform their assigned functions.
Security
Security ___ verify that a control is functioning properly. These tests include automated scans, tool-assisted penetration tests, and manual attempts to undermine security.
tests
Security ____ are comprehensive reviews of the security of a system, application, or other tested environment. They also include a thoughtful review of the threat environment, current and future risks, and the value of the targeted environment.
assessments
Security ____ use many of the same techniques followed during security assessments but must be performed by independent auditors.
audits
_____ audits are performed by an organization’s internal audit staff and are typically intended for internal audiences.
Internal
______ audits are performed by an outside auditing firm.
External
______ audits are conducted by, or on behalf of, another organization. For example, a regulatory body might have the authority to initiate an audit of a regulated firm under contract or law.
Third-party
SOC ____ Engagements Assess the organization’s controls that might impact the accuracy of financial reporting.
1
SOC __ Engagements Assess the organization’s controls that affect the security (confidentiality, integrity, and availability) and privacy of information stored in a system.
2
SOC __ Engagements Assess the organization’s controls that affect the security (confidentiality, integrity, and availability) and privacy of information stored in a system.
3
Type __ Reports These reports provide the auditor’s opinion on the description provided by management and the suitability of the design of the controls.
I
Type __ Reports These reports go further and also provide the auditor’s opinion on the operating effectiveness of the controls.
II
_____ scans and penetration tests provide security professionals with a perspective on the weaknesses in a system or application’s technical controls by identifying technical vulnerabilities that they contain.
Vulnerability
The security community depends on a common set of standards to provide a common language for describing and evaluating vulnerabilities. NIST provides the community with the ____ to meet this need.
Security Content Automation Protocol (SCAP)
____ provides a naming system for describing security vulnerabilities.
Common Vulnerabilities and Exposures (CVE)
______ provides a standardized scoring system for describing the severity of security vulnerabilities.
Common Vulnerability Scoring System (CVSS)
____ provides a naming system for system configuration issues.
Common Configuration Enumeration (CCE)
_____ provides a naming system for operating systems, applications, and devices.
Common Platform Enumeration (CPE)
_____ provides a language for specifying security checklists.
Extensible Configuration Checklist Description Format (XCCDF
______ provides a language for describing security testing procedures.
Open Vulnerability and Assessment Language (OVAL)
_____ scans automatically probe systems, applications, and networks, looking for weaknesses that may be exploited by an attacker.
Vulnerability
____ scanning uses a variety of techniques to scan a range of IP addresses, searching for systems with open network ports.
Network discovery
_____ Scanning Performs a scan of the remote system using the UDP protocol, checking for active UDP services.
UDP
_____ Scanning Sends a packet with the FIN, PSH, and URG flags set.
Xmas
True or False
Traditional vulnerability scans are able to detect zero-day vulnerabilities that have not yet been identified by the scanner vendor.
False; unable
______ scanners are special-purpose tools that scour web applications for known vulnerabilities.
Web vulnerability
What are the 3 steps of vulnerability management workflow?
- Detection
- Validation
- Remediation
The _____ test goes beyond vulnerability testing techniques because it actually attempts to exploit systems.
penetration
IST defines the penetration testing process as consisting of the four phases:
Planning
Information gathering and discovery
Attack
Reporting
These tests are sometimes called “known environment” tests.
White-Box Penetration Test
These tests are sometimes called “partially known environment” tests.
Gray-Box Penetration Test
These tests are sometimes called “unknown environment” tests.
Black-Box Penetration Test
These checks verify that all of the controls listed in a compliance plan are functioning properly and are effectively meeting regulatory requirements.
Compliance checks
This process of handling unexpected activity is known as ____ handling.
exception
These procedures provide third-party reviews of the work performed by developers before moving code into a production environment.
Code Review
The most formal code review processes, known as Fagan inspections, follow a rigorous review and testing process with six steps:
Planning
Overview
Preparation
Inspection
Rework
Follow-up
_____ evaluates the security of software without running it by analyzing either the source code or the compiled application.
Static application security testing (SAST)
_____ evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else.
Dynamic application security testing (DAST)
___ testing is a specialized dynamic testing technique that provides many different types of input to software to stress its limits and find previously undetected flaws.
Fuzz
____ Fuzzing Takes previous input values from actual operation of the software and manipulates (or mutates) it to create fuzzed input. It might alter the characters of the content, append strings to the end of the content, or perform other data manipulation techniques.
Mutation (Dumb)
____ Fuzzing Develops data models and creates new fuzzed input based on an understanding of the types of data used by the program.
Generational (Intelligent)
True or False
Fuzz testing typically doesn’t result in full coverage of the code and is commonly limited to detecting simple vulnerabilities that do not require complex manipulation of business logic. For this reason, fuzz testing should be considered only one tool in a suite of tests performed
True
In ____ case testing, testers first enumerate the known misuse cases. They then attempt to exploit those use cases with manual and/or automated attack techniques.
misuse
Software testing professionals often conduct a ____ analysis to estimate the degree of testing conducted against the new software.
test coverage
What is the test coverage analysis formula?
test coverage = (number of use cases tested)/(total number of use cases)
_____ monitoring analyzes actual network traffic sent to a website by capturing it as it travels over the network or reaches the server.
Passive
