Domain 6 - Security Assessment Flashcards
Three components of a security testing program
- Security tests: such as automated scans, and tool assisted penetrtion testing
- Security assessments:
- Security audits:
Categories of vulnerability scans
- Network discovery scans
network discovery scanning
Nmap
Network vulnerability
Nessus, Qualys
Web Vulnerability
Nessus, Wapti
Database vulnerability scanning
SQLMap
Vulnerability Management Workflow
- Detection: initial identification
- Validation: admins confirm a detected vulnerability is not a false positive
- Remediation: such as applying a vendor supplied security patch.
Penetration Test Process
- Planning: includes scoping the engagment, and defining the rules of the engagement
- Information gathering and discovery: Uses manual and automated tools to collect information about the targeted environment. This includes basic reconnaissance to determine system function, conduct network discovery tests.
- Vulnerability scanning: perform vulnerability scan
- Exploitation: Look to defeat security
- Reporitng: Summarise results of the test and make recommendations for improvements to system security
White box testing
Bypasses many of the reconnaissance steps
Grey box testing
Commonly used when black box results are desired but costs or time constraints mean that ome knowledge is needed to complete the testing
Black box testing
Does not provide attackers with any information prior to attack, other than publically available information.
Fuzz Testing
Provides many different types of input to stress test and find previously undetected flaws. Supplies invalid input,
Mutation (dumb) Fuzzing
Takes previous input values and mutates it to create fuzzed input. Such as alter the characters
Generational (smart) fuzzing
Develops data models, and creates new fuzzed input based on an understanding of the types of data used by the programs
Limitations of fuzz testing
Does test full code, and limited to detecting simple vulnerabilities
Test Coverage
Number of use cases tested / total number of use cases
Attack methodology
- Reconnaissance: whois database, company website
- Footprinting: all about learning the network, including NMap scans for mapping the network
- Fingerprinting: identifying host information, port scanning
- Vulnerability assessment: identifying weakness in system configuration
- Attack: Penetration, including privilege escalation and rootkits.
Port state
Open: an application is actively accepting connections on that port.
Closed: Port is accessible, meaning firewall is granting access, but no application is accepting connections on that port.
Filtered: Nmap is unable to determine whether a port is open or closed because a firewall is interfering with the connection attempt.
Penetration Test Output
Should determine effectiveness of safeguards and identify areas of improvment, not recommendatons.
IDS
Needs an interface in ‘promiscuous mode’. Port mirroring/span needs to be enabled to view traffic on a switch.
Where should you put a NIDS
In the DMZ, behind the firewall and router.
Disadvantages of NIDS
- Data must be unencrypted
- if only on the perimeter, it can miss things on the inside
- It does not see what’s going on a server directly.
Profile Matching
Create baseline, and look for changes in “normal” behaviour. The anamoly based system will then look for traffic types and volume that is outside of the normal behaviour.
Attacks to bypass IDS
- Evasion attack: many small attacks from different directions
- Insertion attack (for signature based system): adding meaningless information (without modifying the payload) to a known attack.
Disadvantages of profile matching
- Lots of false positives
- Requires a much more skilled analyst
Entrapment
When someone is persuaded to commit a crime they had no intention to commit and is then charged with it.
- Openly advertising sensitive data and then charging people when they access them.
- Entrapment is a solid legal defense.
Enticement
- Making committing a crime more enticing, but the person has already broken the law or at least has decided to do so. Honeypots can be a good way to use Enticement.
- Have open ports or services on a server that can be attacked.
- Enticement is not a valid defense.
Padded cell
Similar to honeynet, a fake environment that the IPS transfers you to
