CISSP Domain 6 Flashcards
Security audit types
Internal: Org performs
External: big4
Third party: EY auditing your third party behalf of another organization
Soc1 , SoC 2 and SoC 3
Finance
Trust security - CIAP, nda to be signed
Trust security- can be shared public disclosure
Type 1 and Type 2 reports
Type 1: documentation review by auditor
Type 2: Effectiveness of controls over period of time , at least 6 months
4 types of vulnerability scans
Scan to be done on IP ranges and open ports
Network discovery scan
Network vulnerability scans
Web application scans
Database vulnerability scans
Network discovery scan techniques
TCP SYN scan- half open scanning
TCP connect scan- open a full connection in specified port
TCP ack scan- Determine rules enforced by the firewall technology
UDP scanning- remote system using UDP protocol and checking UDP services
X mas scanning- FIN, PSH and URG flags set “ lit up like a Christmas tree”
Network vulnerability scans
Database of known vulnerability instead of detection of open ports
Authenticated scans
improve scanning and accuracy to reduce false positives
Scanner has read only access to servers getting scanned and can read config info from the targeted system when analysis testing results
Vulnerability management flow
Detection
Validation
Remediation
Pen test process
Planning: Rules of engagement
Info gathering and discovery
Attack
Reporting
White box test
Known environment test
By-pass reconciance test
Testing your software principle
Never depend on users behaving properly. Software to expect the unexpected. This is known as exception handling
Code Review
Planning
Overview
Preparation
Inspection
Re-work
Follow-up
Code Review - Fagan
Peer review- manual walkthrough
Senior developer review
Automated review of tools
Static review
Without running and analysing source code
Dynamic testing
Software in runtime testing and can include *synthetic transactions**
Scripted transaction with known results
Fuzz testing and Categories
Different types of inputs to software to stress it’s limits and find previously undetected flaws
- Mutation (Dumb) fuzzing: Previous input from app
- Generational (Intelligent) fuzzing:
Develop data model and creates new fuzzed input
Interface testing
API
GUI
Physical interface
Misuse case testing
Ways that software users might attempt to misuse the application
Test coverage analysis
Estimate degree of testing conducted against New software
Test coverage= number of use cases tested / total number of use cases
Test coverage analysis - 5 common criteria
Branch coverage - If else conditions
Condition coverage - Logical based on inputs ?
Function coverage - returned results
Loop coverage - All loop
Statement coverage- every line of code executed ?
Website monitoring
Passive monitoring - real user monitoring
Synthetic monitoring - Artificial transaction WAF ?
Log reviews
Logging policy from gpo
Ntp sync
Siem
Need to know, least prevlige and SoD
Security clearance
Permission+ rights
Two persons control
Approval of two individuals for critical tasks
PAM solutions can create split password
Split knowledge
Segregation of duties+ Two persons control into a Single solution
PAM and MS PAM
Restrict access to privilege accounts or detect when accounts use elevated privilege
Ms pam is based on JIT ticket expires after 15 minutes of elevation of prevlige
SaaS
Gmail - everything handled by csp
PaaS
Customer will manage -App, data CSP provides platform like windows
IaaS
Basic computing resources to customers. Servers, storage and network resources
Customer install os and apps, performs maintenance on OS and apps
Public, private, community and hybrid
Private - SaaS, PaaS or IaaS
Community - Two or more org that have shared concern
Hybrid - two or more cloud bound together by a tech that provides data and app probability
Scalability Vs Elasticity
Scalability - Computing resources
Handle work load
Requires shutting down the system
Elasticity - Computing resources can be created and destroyed when needed
Doesn’t require shutting down
Configuration management
System deployed in secure, consistent state and stay secure, consistent throughout lifetime
Provisioning
Install and configure OS and needed apps
Harden it based on its use
Baselining
Starting point, In context of CM list of settings
Using images for baseline- steps
- Baseline system
- Image server deployed image
Change management and primary goal
Changes do not cause outages by unauthorised changes
It affects A of CIA
Change management steps
Request for change
Review the change
Approve / reject change
Test change
Schedule and implement change
Document change
Patch management steps
Evaluates
Test patch
Approve patch
Deploy patch
Verify that patches are deployed - Vulnerability scan
