Cyber Security Landscape Flashcards
Cameron's flash cards from when he joined
Risk Management, ____________, ____________, and response are the four disciplines to cybersecurity
Protection and Detection
What is DAST?
Dynamic Application Security Testing (DAST) is the process of scanning a web application through the front-end to find vulnerabilities through simulated attacks.
What are business logic flaws?
Business logic flaws are flaws in the design and implementation of an application that allow an attacker to elicit unintended behaviour.
What is the downside of DAST?
They may miss business logic flaws which could only be picked up by a manual penetration test
What are the 2 methods for testing for vulnerabilities in a running application?
DAST and Manual Penetration tests
What is SAST?
Static Application Security Testing (SAST) is a tool that scans an application’s source code for security vulnerabilities
What are the 2 methods typically used to test for vulnerabilities in source code?
SAST and manual code review
How does Cytix fit into the “Protect” category?
Cytix fits into the ‘Protection’ element because our software aims to find vulnerabilities BEFORE they reach production. This reduces the friction between development and security
What is threat modelling?
Threat modelling is the process of analysing system changes before production, to identify potential vulnerabilities and how to mitigate them
What is penetration testing?
Penetration testing is a process that simulates cyberattacks on a system to identify security vulnerabilities. It helps organisations protect their data and systems from potential cyberattacks.
What are some typical vulnerabilities looked for in a penetration test?
Cross-Site Scripting (XSS, pronounced ex-ess-ess)
Business Logic Flaws
SQL injection (pronounced sequel)
Why does Cytix exist?
Cytix is the only continuous testing software that identifies all potential vulnerabilities before going into production.
Automatic scanners miss a lot of these vulnerabilities, and annual penetration tests are too slow to detect them promptly.
