Domain 6. Security Assessment and Testing Flashcards
BAS
Breach Attack Simulation
A BAS simulates a penetration test. Programs, such as Infection Monkey are open-source and great for this.
Real User Monitoring AKA Passive monitoring
AKA Passive Monitoring
Real user monitoring (RUM) analyzes the traffic or status of transactions for real user traffic. This is also known as passive monitoring. RUM provides real-time updates on the status of user interactions for a given service.
Synthetic Monitoring
Same as Active Monitoring
Synthetic monitoring actively makes transactions against a website to evaluate performance.
Active Monitoring
Same as Synthetic Monitoring
Synthetic monitoring actively makes transactions against a website to evaluate performance.
Key Risk Indicator
KRIs, however, measure the organization’s risk and how its risk profile changes. This provides the ability to assess the likelihood of a negative event, as well as assess the risk level of an activity or situation. The risks, if realized, can typically profoundly impact the organization. Therefore, KRIs can strongly impact decision-making by senior-level executives.
Examples:
Vulnerability Metrics
Policy Exception Rates
Malware Infection Rates
Misuse Case Testing
Misuse case testing is used to help identify potential security flaws in a software’s design by examining how software could be abused or manipulated into doing something malicious.
SSAE 18 and ISAE 3402
The Statement on Standards for Attestation Engagements (SSAE 18) and the International Standard for Attestation Engagements (ISAE 3402) are service organization controls (SOC) audits.
SSAE 18 is an American national auditing system, while the ISAE 3402 is a very similar system used internationally. Both are standards used by companies to audit other companies in their jurisdiction.
DRP vs BCP
Disaster Recovery Plan, Business Continuity Plan
DRP = Business has ceased and needs to be recovered
BCP = Plans to operate THROUGH a disaster, NOT recover from one. Answers the question “How do we continue operating before DRP has been fully realized?”
KPI
Key Performance Indicator
helps to evaluate a process’s health
Fuzz Testing
Fuzz testing is a technique used to find flaws or vulnerabilities by sending randomly generated or specially crafted inputs into the software. There are two types of fuzzers: mutation (dumb) fuzzers and generational (Intelligent) fuzzers. Mutation fuzzers mutate input to create fuzzed input. Generational fuzzers create fuzzed input based on what type of program is being fuzzed.
Fuzz testing may not cover all of the code to be tested.
Synthetic Transactions
Synthetic transactions ensure that whatever text is expected comes out when requested. This is excellent practice to test code and validate input, especially against potential attacks.
Exposure Factor
Amount of asset that is at risk.
NIST SP-800-53a
“Assessing security and privacy controls in Federal Information Systems and orgs.”
Covers methods for assessing and measuring security controls
NIST 800-12
Intro to Computer Security
NIST 800-34
Covers contigency planning
