Domain 6 - Security Assessment

Question 1

Three components of a security testing program

Answer 1

1. Security tests: such as automated scans, and tool assisted penetrtion testing
2. Security assessments:
3. Security audits:

Question 2

Categories of vulnerability scans

Answer 2

1. Network discovery scans

Question 3

network discovery scanning

Answer 3

Nmap

Question 4

Network vulnerability

Answer 4

Nessus, Qualys

Question 5

Web Vulnerability

Answer 5

Nessus, Wapti

Question 6

Database vulnerability scanning

Answer 6

SQLMap

Question 7

Vulnerability Management Workflow

Answer 7

1. Detection: initial identification
2. Validation: admins confirm a detected vulnerability is not a false positive
3. Remediation: such as applying a vendor supplied security patch.

Question 8

Penetration Test Process

Answer 8

1. Planning: includes scoping the engagment, and defining the rules of the engagement
2. Information gathering and discovery: Uses manual and automated tools to collect information about the targeted environment. This includes basic reconnaissance to determine system function, conduct network discovery tests.
3. Vulnerability scanning: perform vulnerability scan
4. Exploitation: Look to defeat security
5. Reporitng: Summarise results of the test and make recommendations for improvements to system security

Question 9

White box testing

Answer 9

Bypasses many of the reconnaissance steps

Question 10

Grey box testing

Answer 10

Commonly used when black box results are desired but costs or time constraints mean that ome knowledge is needed to complete the testing

Question 11

Black box testing

Answer 11

Does not provide attackers with any information prior to attack, other than publically available information.

Question 12

Fuzz Testing

Answer 12

Provides many different types of input to stress test and find previously undetected flaws. Supplies invalid input,

Question 13

Mutation (dumb) Fuzzing

Answer 13

Takes previous input values and mutates it to create fuzzed input. Such as alter the characters

Question 14

Generational (smart) fuzzing

Answer 14

Develops data models, and creates new fuzzed input based on an understanding of the types of data used by the programs

Question 15

Limitations of fuzz testing

Answer 15

Does test full code, and limited to detecting simple vulnerabilities

Question 16

Test Coverage

Answer 16

Number of use cases tested / total number of use cases

Question 17

Attack methodology

Answer 17

1. Reconnaissance: whois database, company website
2. Footprinting: all about learning the network, including NMap scans for mapping the network
3. Fingerprinting: identifying host information, port scanning
4. Vulnerability assessment: identifying weakness in system configuration
5. Attack: Penetration, including privilege escalation and rootkits.

Question 18

Port state

Answer 18

Open: an application is actively accepting connections on that port.
Closed: Port is accessible, meaning firewall is granting access, but no application is accepting connections on that port.
Filtered: Nmap is unable to determine whether a port is open or closed because a firewall is interfering with the connection attempt.

Question 19

Penetration Test Output

Answer 19

Should determine effectiveness of safeguards and identify areas of improvment, not recommendatons.

Question 20

IDS

Answer 20

Needs an interface in ‘promiscuous mode’. Port mirroring/span needs to be enabled to view traffic on a switch.

Question 21

Where should you put a NIDS

Answer 21

In the DMZ, behind the firewall and router.

Question 22

Disadvantages of NIDS

Answer 22

1. Data must be unencrypted
2. if only on the perimeter, it can miss things on the inside
3. It does not see what’s going on a server directly.

Question 23

Profile Matching

Answer 23

Create baseline, and look for changes in “normal” behaviour. The anamoly based system will then look for traffic types and volume that is outside of the normal behaviour.

Question 24

Attacks to bypass IDS

Answer 24

• Evasion attack: many small attacks from different directions
• Insertion attack (for signature based system): adding meaningless information (without modifying the payload) to a known attack.

Question 25

Disadvantages of profile matching

Answer 25

• Lots of false positives

- Requires a much more skilled analyst

Question 26

Entrapment

Answer 26

When someone is persuaded to commit a crime they had no intention to commit and is then charged with it.

• Openly advertising sensitive data and then charging people when they access them.
• Entrapment is a solid legal defense.

Question 27

Enticement

Answer 27

• Making committing a crime more enticing, but the person has already broken the law or at least has decided to do so. Honeypots can be a good way to use Enticement.
• Have open ports or services on a server that can be attacked.
• Enticement is not a valid defense.

Question 28

Padded cell

Answer 28

Similar to honeynet, a fake environment that the IPS transfers you to