CISSP ch 15 Flashcards
Security tests
verify that a control is functioning properly
Security assessments
comprehensive reviews of the security of a system, application or other tested environment
Identifies vulnerabilities in the tested environment. does not usually include actual mitigation of those vulnerabilities
Thoughtful review of the threat environment, current and future risks, and the value of the targeted environment
hould be addressed to the organization’s management
NIST SP 800-53A
Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans = best practices in conduct security and privacy assessments
Specifications (NIST SP 800-53A)
documents associated with the system being audited (e.g., policies, procedures, requirements and designs)
Mechanisms (NIST SP 800-53A)
controls used within an information system to meet the specifications
Activities (NIST SP 800-53A)
actions carried out by people within an information system
Individuals (NIST SP 800-53A)
people who implement specifications, mechanisms and activities
Security audits
use many of the same techniques followed during security assessments but must be performed by independent auditors
Less routine than tests or assessments
Purpose of demonstrating the effectiveness of controls to a third party (as opposed to purely internal distribution)
Internal audits
performed by an organization’s internal audit staff and are typically intended for internal audiences
Reporting line that is completely independent of the functions they evaluate
CAE
Chief Auditing Executive = may have reporting responsibility directly to the organization’s governing board
SSAE 18
Statement on Standards for Attestation Engagements, document 18 ‘Reporting on Controls’ (produced by the American Institute of Certified Public Accountants / AICPA)
Provides a common standard to be used by auditors performing assessments of service organizations with the intent of allowing the organization to conduct an external assessment instead of multiple third-party assessments and then sharing the resulting report with cutomers and potential customers
ISAE 3402
International Standard for Attestation Engagements 3402 ‘Assurance Reports on Controls at a Service Organization’ = SSAE 18 equivalent used outside of U.S.
SOC aduits
Service organization controls audit = SSAE 18 and ISAE 3402
SOC 1 engagements
asses the organization’s controls that might impact the accuracy of financial reporting
SOC 2 engagements
Assess the organization’s controls that affect the security (confidentiality, integrity and availability) and privacy of information stored in a system
SOC 2 audit results are confidential and normally are only shared outside the organization under and NDA
SOC 3 Engagements
Assess the organization’s controls that affect the security (confidentiality, integrity and availability) and privacy of information stored in a system
SOC 3 audit results are intended for public disclosure
Type I Reports
provide the auditor’s opinion on the description provided by management and the suitability of the design of the controls
Cover only a specific point in time, rather than an extended period
More of a documentation review
Type II reports
provide the auditor’s opinion on the operating effectiveness of the controls
The auditor actually confirms that the controls are functioning properly
Covers an extended period of time, at least six months of operation
COBIT
Control Objectives for Information and Related Technologies, maintained by ISACA
Common framework for conducting audits and assessments
Describes the common requirements that organizations should have in place surrounding their information systems
ISO 27001
standard approach for setting up an information security management system
ISO 27002
goes into more detail on the specifics of information security controls
SCAP
NIST’s Security Content Automation Protocol = common framework for describing and evaluating vulnerabilities, and facilitates the automation of interactions between different security systems
CVE (SCAP)
Common Vulnerabilities and Exposures = naming system for describing security vulnerabilities
CVSS (SCAP)
Common Vulnerability Scoring System = standardized scoring system for describing the severity of security vulnerabilities
CCE (SCAP)
Common Configuration Enumeration = naming system for systems configuration issues
CPE (SCAP)
Common Platform Enumeration = naming system for operating systems, applications and devices
XCCDF (SCAP)
Extensible Configuration Checklist Description Format = language for specifying security checklists
OVAL (SCAP)
Open Vulnerability and Assessment Language = language for describing security testing procedures
Vulnerability scans
automatically probe systems, applications and networks looking for weaknesses that may be exploited by an attacker
Network discovery scanning
variety of techniques to scan a range of IP addresses, searching for systems with open network ports
TCP SYN Scanning = half-open scanning (network discovery)
Sends a single packet to each scanned port with the SYN flag set, indicating a request to open a new connection
If the scanner receives a response that has the SYN and ACK flags set, this indicates that the system is moving to the second phase in the three-way TCP handshake and that the port is open
TCP Connect Scanning (network discovery)
Opens a full connection to the remote system on the specified port
Used when the user running the scan does not have the necessary permissions to run a half-open scan (i.e., user cannot send hand-crafted packets)
TCP ACK Scanning (network discovery)
Sends a packet with the ACK flag set, indicating that it is part of an open connection
May be done in an attempt to determine the rules enforced by a firewall and the firewall methodology
UDP scanning (network discovery)
Performs a scan of the remote system using the UDP protocol, checking for active UDP services
Does not use the three way handshake, because UDP is a connectionless protocol
Xmas scanning (network discovery)
Sends a packet with the FIN, PSH and URG flags set
A packet with so many flags is said to be ‘lit up like a Christmas tree’
nmap
most common tool used for network discovery scanning = provides the current status of ports
Open (nmap)
the port is open on the remote system and there is an application that is actively accepting connections on that port
Closed (nmap)
the port is accessible on the remote system, meaning that the firewall is allowing access, but there is no application accepting connections on that port
Filtered (nmap)
Nmap is unable to determine whether a port is open or closed because a firewall is interfering with the connection attempt
Banner grabbing
technique used by port scanners, network vulnerability scanners and web vulnerability scanners to identify the variant and version of a service running on a service
Opens a connection to the service and reads the details provided on the welcome screen or banner to assist with version fingerprinting
netstat command
useful tool for examining the active ports on a system = lists all active network connections on a system as well as those ports that are open and awaiting new connections
network vulnerability scans
go deeper than discovery scans, don’t stop at detecting open ports but continue to probe a targeted system or network for the presence of known vulnerabilities
These tools contain databases of thousands of known vulnerabilities along with tests they can perform to identify whether a system is susceptible to each vulnerability in the system’s database
