Domain 6 Flashcards
What is a security assessment?
It is a complete view of a company’s network security to assess your security posture. It analyzes the entire network from the inside and tires to find the weaknesses and gives a complete list of risks against critical assets.
What are types of security testing?
1) Penetration Test
2) Vulnerability Assessment
3) Network Pen Test
4) Web application Pen Test
5) Source Code analysis
6) Phishing exercises
7) Password assessments
Goal - assess risk due by discovering and understanding flaws that persist in systems and applications
Full knowledge - I have access to internal documents before the test
Zero knowledge - I come in blind with no internal knowledge
What is the purpose of security testing?
To look for flaws that exist in spite of security processes.
Assessing the security processes themselves is also necessary.
What is auditing?
Function that will verify the security of systems and resources and whether or not a system has been compromised or misused. Also tests the effectiveness of the operation controls implemented throughout the network.
Internal and external audits
- compliance checks
- internal and external
- frequency of review
- standard of due care
What is server side vs. client side attacks?
Server side attack is initiated by the attacker against a listening services
- it is an attack initiated by an attacker
Client side attack is when the victim initiates the attack by downloading malicious content.
What is the difference between the attack surface for server side vs. client side attacks?
Server side attack surface is much smaller because you can just look at all of your points of entry (e.g., think about a house, you look at the doors and windows).
For a client side attack surface, it is much larger and there are many more variables of what a client might do that enables an attack.
Server side - limit by:
- disable unnecessary services
- host hardening
- firewalls
Client side exploitation:
- browser
- browser plugin
- email clients
- chat clients
- flash
- java
- PDF readers
- microsoft office
- itunes
- realplayer
- etc.
What is the server side exploitation process?
1) perform reconnaissance - collect as much information publicly available you can on the company (e.g., look at job postings to figure out what servers and DB they use (e.g., need Linux team), building and harvesting email names).
- resource - google, facebook. linkedin
- it is offline research performed by an attacker before launching an attack - includes public records research
2) Network enumeration - host discovery
3) port scanning - once a host is discovered, a port scanner cans all TCP and UDP ports and attempts to determine which are open (Nmap is a known tool for this)
4) determine version of OS and services
5) determine vulnerable service versions
6) exploit vulnerable services
What is host discovery?
Attempts to determine live systems on the network
These can be discovered by:
- ARP scans (for systems on the same LAN)
- ICMP sweeps (echo request, netmask request, timestamp request) - point is to receive any type of response to see the system is live
- TCP or IDP traffic sent to common ports (looking to get a response back)
- IPv6 neighbor discovery
- Sniffing packets and reviewing contents
What is OS or service fingerprinting?
Fingerprinting seeks to identify the version of the OS or services running on a target system.
- active fingerprinting sends packets to determine OS and service versions
- passive fingerprinting is read-only and uses TTLs, IPIDs, sequence numbers and even layer 7 packet data to determine system details - read a live network feed, determine the OS is a certain way
**nmap is a scanner - just know it is used to do scanning
What is a vulnerability assessment?
Occurs when you scan key servers to look for a set list of vulnerabilities. It is usually done to look for common or known vulnerabilities and done using a vulnerability scanner tool.
This can be done in house or by a third party
Be careful not to crash stuff**
Focuses on weaknesses in a system but does not include exploitation.
Tools:
- Nessus (Tenable) - Open VAS (Open Source)
- Nexpose (Rapid7) - Retina (BeyondTrust)
What are vulnerability scanners?
Vulnerability scanners go beyond port scanning
- determine available applications and services
- determine their versions
- determine if they are vulnerable to exploitation
Methods to determine vulnerabilities:
- determine version information, look up vulnerability in database
- interrogate the system, modeling insecure behavior
What is a penetration test?
Picks up where vulnerability assessment stops . It seeks to exploit vulnerabilities
- simulates an attacker trying to break into a network
- determines whether a site is susceptible to an attack
- are only as good as the person/tool behind the test
They are narrow - the scope is so important - they cannot fully simulate an attacker.
What are types of penetration testing?
1) war dialing - attack the system via dialing all the phone numbers in an exchange
2) sniffing - passively monitors network traffic for network knowledge such as passwords
3) eavesdropping - involves listening to phone conversations
4) radiation monitoring - receiving images, data or audio from an unprotected source by listening - tempest
5) dumpster diving - see what they threw away
6) social engineering - lies, impersonation, tricks, bribes, blackmail, etc. confusing the human mind to bypass security
What is the process for performing a pen test?
1) business process:
- determine scope, rules of the engagement
- e.g., client side attacks, server side attacks, social engineering, etc.
- sign explicit legal permissions and contracts and lawyers
2) reconnaissance
3) scanning (vulnerability assessment)
4) exploitation
5) post exploitation
What are some additional security testing methods?
- black box and white box testing
- code review
- fuzzing
- web application testing
- interception proxies
- phishing campaigns
- password assessments
These can be used independently or parts of other tests
