CISSP Domain 6 Flashcards
Security Assessment and Testing
Internal and Third Party Audits Vulnerability testing Penetration testing Log reviews Synthetic transactions Code reviews Misuse case testing Interface testing Account management
Audit
a systematic assessment of security controls of an information system
Audit drivers
Regulatory or compliance requirements
Significant change to the architecture
New threat developments
Scope of Assessments
Which subsets and systems
User artifacts like passwords, files, log entries
Privacy implications
Process evaluation
Audit scope
should be determined in coordination with business unit managers
Business managers should be included early and throughout the exercise
Never forget business cases
Information System Security Audit Process
Determine goals Involve the right business unit leaders Determine the scope Choose the Audit Team Plan the Audit Conduct the audit Document the results Communicate the results
Audit plan must be
repeatable
American Institute of Certified Public Accountants AICPA
Statement on Auditing Standards No 70
SAS 70
defined audits carried out by third parties to assess internal controls of a service organization
Third party ensuring best interests of the client corporation
AICPA new framework of auditing standards on
Service Organization Controls SOC
3 Service Organization Controls (SOC
SOC 1 Pertains to financial Controls
SOC 2 Pertains to trust services ( Security, Availability, Confidentiality, Process Integrity, Privacy
SOC 3 Also pertains to trust services
Difference between Service Organization Controls (SOC) 2 and 3
SOC 2 is very detailed
SOC 3 is less detailed and for general purpose
Technical Control
Security control implemented through the use of an IT asset.
Linkage between controls and risks to mitigate
to understand the context in which specific controls were implemented.
Why was the fence put up?
Goals of vulnerability assessments
Evaluate the true security posture of an environment
Identify as many vulnerabilities as possible
Test how systems react to certain circumstances and attacks
Consider testing ramifications. Could be knocked offline, production could be negatively affected
Black Box testing
no prior knowledge
knowledge comes from the assessment itself
White Box testing
complete knowledge of the inner workings of the system
Targets specific internal controls and features
Gray Box testing
somewhere between black and white
Penetration testing
process of simulating attacks on a network and its systems at the request of the owner
Goal is to measure an organization’s level of resistance to attack and uncover weaknesses within the environment.
Vulnerability Scanning
Identification of active hosts on a network
Identification of active and vulnerable services (ports) on hosts
Identification of applications and banner grabbing
identification of operating systems
Identification of vulnerabilities
Misconfigured settings
Establish foundation for penetration testing
Five steps of a penetration test
- Discovery
- Enumeration
- Vulnerability mapping
- Exploitation
- Report to management
Penetration testing degrees of knowledge
Zero Knowledge
Partial Knowledge
Full Knowledge
Blind test
assessors only have publicly available data to work with. Network staff is aware
Double blind test
Network staff is unaware
Targeted
Focused test on specific areas of interest
Vulnerability vs Penetration testing
Vulnerability assessment identifies a wide range of vulnerabilities in the environment. Often uses a scanning tool
Penetration test exploits one or more vulnerabilities
Use Cases
Structured scenarios used to describe required functionality. Describes the sequence of interaction
Fraggle Attack
Similar to Smurf. Instead of using ICMP, It uses datagrams Attacker broadcasts a spoofed UDP packet to the amplifying network
Misuse cases
a use case that includes threat actors and tasks they want to perform on a system
Normally depicted as stick figures with shaded heads
UML diagram
Code Reviews
systematic examination of instructions that comprise software.
Preferred technique of attackers
become normal “privileged users” in one of 3 ways
create a new privileged account
compromise an existing privileged account
elevate privileges of an normal account
Checklist test
DRP or BCP distributed to different departments and functional areas for review
Structured walkthrough test
Each department or functional area reviews objectives, scope, and assumptions of the plan
Walks through different scenarios from beginning to end to make sure nothing was left behind.
Simulation Test
takes more planning and people All employees who participate come together to practice
Only uses materials that will be available in an actual disaster
Continues up to the point of actual relocation to an offsite facility and shipment of replacement equipment
Parallel Test
some systems are move to the alternate site and processing takes place. Results are compared to the regular site
Full interruption test
Most intrusive to regular operations and business productivity
Original site is shut down, processing takes place at the alternate site.
Security training is
process of teaching a skill or set of skills that will allow people to perform specific functions better
Security Awareness training is
process of exposing people to security issues that they may be able to recognize
Social engineering
Process of manipulating individuals so they perform actions that violate security protocols
Phishing
social engineering conducted through a digital communication
Spear phishing
target specific individuals or groups
Whale phishing or whaling
target is a senior executive
Drive by download
site will invisibly redirect the user to a malware distribution server
Pretexting
form of social engineering practiced in person or over the phone persuades target to violate a security policy
Telephone Records and Privacy Protection Act of 2006
Imposes stiff criminal penalties on anyone who uses pretexting to obtain confidential information
Instituted after HP scandal to identify leaks
Key performance indicators
Metrics for ISMS
- Choose factors the can show the state of our security
- Define baselines for some or all of the factors under consideration
- Develop a plan for periodically capturing the values of these factors
- Analyse and interpret the data
- Communicate the indicators to all stakeholders
Key Risk Indicators
tell us where we are today in relation to our risk appetite.
SUS
System Under Study
Key Elements of a good technical audit
Threats Vulnerabilities probability of exploitation Impact of exploitation Recommended actions
Fuzzing
Technique for detecting flaws in the code by bombarding it with massive amounts of random data.
