Chapter 8 - Using Risk Management Tools Flashcards
SLE
Single Loss Expectancy
The cost of any single loss
ARO
Annual Rate of Occurrence
Indicates how many times the loss will occur in a year. If ARO is less than 1, the ARO is represented as a percentage (ie .5 = once every 2 years)
ALE
Annual Loss Expectancy
SLE x ARO
Risk register
Lists all known risks for a system or an organization, often in table format and also known as a risk log. Is a living document.E
Risk matrix
Plots risks onto a graph or chart. Can plot things like the likelihood of occurrence data against the impact of a risk. Includes marking acceptable risk vs unacceptable risk
Heat map
Similar to a risk matrix, except uses colors such as green and red.
Supply chain risk
Supply chain = all the elements required to produce and sell a product. Supply chain can become an attack vector if an attacker can disrupt the supply chain.
Threat hutning
The process of actively looking for threats within a network before an automated tool detects and reports on the threat.
-Gathering data on the threat through threat intelligence, ie info on the threat’s capabilities, motives, goals and resources coming from both internal and external sources.
OSINT
Open Source Intelligence.
Includes anything available on the internet such as blogs from researchers and vendors, media reports and more.
Threat feeds
Provide subscribers with up-to-date information on current threats. Many security organizations publish feeds and anyone with an email address can subscribe to them.
TTP
Tactics, techniques and procedures used by adversaries.
Refers to attacker methods when exploiting a target. Commonly included in threat feeds.
intelligence fusion
Combines all this intelligence data to create a pictures of likely threats and risks for an organization.
Password crackerth`
attempts to discover a password. PWs are normally hashed, some hashing algos are strong than others, such as MD5 which is now vulnerable.
Done online or offline.
Network scanner
Use various techniques to gather info about hosts within a network, ie nmap which is a popular scanning tool that gives you a lot of info about hosts within a network. Network scanners usually use the following methods:
-Arp ping scan
Any host that receives an ARP packet with its IP address responds with its MAC address. If the host responds, the network scanner knows that a host is operational with that IP address.
-Syn stealth can
Sends a single SYN packet to each IP address in the scan range. If a host responds, the scanner knows that a host is operational with that IP address. The scanner normally responds with a RST reply to close the connection instead of an ACK.
-Port scan
Checks for open ports on a system, each indicating the underlying protocol is running on the system, ie if port 443 is open we know the host is running HTTPS, meaning it’s probably a web server. A port scan normally uses the ports identified as well-known ports by the IANA.
-Service scan
Like a port scan, but goes a step further and verifies the protocol or service, ie is a port scan shows 443 is open, a service scan will send a HTTPS command such as “GET/.” If HTTPS is running on port 443, it will respond to the Get command verifying that it is a web server.
-OS detection
OS detection techniques analyze packets from an IP address to identify the OS. This is often referred to as TCP/IP fingerprinting.
EX: TCP window size (the size of the receive window in the first packet of the TCP session) is not fixed. Different OSs use different sizes, ie Linux uses 5,840 bytes, Cisco routers 4,128 bytes, Windows 8,192 and 65,535. OS detection techniques don’t rely on a single value but typically evaluate multiple values included in systems responses.
Identifying Vulnerabilities and Misconfigurations
-open ports and services
-unsecure root accounts
-default accounts and passwords
-default settings
-unpatched systems
-errors
-open permissions
-unsecure protocols
-weak encryption
-weak passwords
-sensitive data
