Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sunflower Notes > Domain 6 - Security Assessment and Testing > Flashcards

Domain 6 - Security Assessment and Testing Flashcards

1
Q

Security Testing

A

verifies that a control is functioning properly. These tests include automated scans, tool-assisted penetration tests and manual attempts to undermine security. When scheduling security controls for review, information security managers should consider the following factors:

  • Availability of security testing resources
  • Criticality of the systems and applications protected by the tested controls Sensitivity of information contained on tested systems and applications
  • Likelihood of a technical failure of the mechanism implementing the control
  • Likelihood of a misconfiguration of the control that would jeopardize security
  • Risk that the system will come under attack
  • Rate of change of the control configuration
  • Other changes in the technical environment that may affect the control performance
  • Difficulty and time required to perform a control test
  • Impact of the test on normal business operations

After assessing each of these factors, security teams design and validate a comprehensive assessment and testing strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Verification

A

objective evidence that the design outputs of a phase of the SDLC meet requirements. 3rd party sometimes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Validation

A

develop “level of confidence” that the software meets all requirements and expectations, software improve over time Find back doors thru structured walk through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Network Flow logs

A

captured to provide insight into network traffic for security, troubleshooting, and performance management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Audit logging

A

provides information about events on the routers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

NTP

A

Network Time Protocol, One important consideration is ensuring that logs have accurate time stamps and that these time stamps remain consistent throughout the environment. A common method is to set up an internal NTP server that is synchronized to a trusted time source such as a public NTP server. Other systems can then synchronize with this internal NTP server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Syslog

A

message logging standard commonly used by network devices, Linux and Unix systems and other devices (firewalls)

Reboot – generates an information log entry

  • Errors – significant problem
  • Warnings – future problem - Information – successful operations
  • Success Audits – successful security accesses
  • Failure Audits – failed security access attempts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Inconsistent Time Stamps

A

often caused by improperly set time zones or due to differences in how system clocks are set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Modified logs

A

often a sign of intrusion or malicious intent NetFlow is a feature that was introduced on Cisco routers that provides the ability to collect IP network traffic as it enters or exits an interface. a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Antimalware and Antivirus

A

records instances of detected malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IDS/IPS

A

security testing, NIST 800-4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

War driving

A

driving a car with notebook to find open access points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

IDS

A

intrusion detection system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IDS: NETWORK BASED

A
  • Detects intrusions on the LAN behind a firewall.
  • Is passive while it acquires data.
  • Reviews packets and headers
  • Problem with network based is that it will not detect attacks by users logged into hosts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IDS: HOST BASED

A
  • monitoring servers through EVENT LOGS AND SYSTEM LOGS
  • as good as the completeness of the host logging

easier to discover and disable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Signature based method (AKA Knowledge based)

A

compared with signature attack database (aka misuse detector)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Statistical anomaly based

A

defines a ‘normal’ behavior and detects abnormal behaviors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Response box

A

is a part of an IDS that initiates alarm or activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IDS Components

A

Information source/sensor, centralized monitor software, data and even report analysis, database components and response to an event or intrusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IPS

A

Intrusion prevention system - detect attack and PREVENT that attack being successfu

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Remote Access Software

A

granted and secured through VPNs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Web Proxies

A

intermediate hosts, restrict access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Vulnerability Management Software

A

patching

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Authentication Servers

A

SSO servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Routers

A

permit or block traffic based on policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Firewalls

A

more sophisticated than routers to examine traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Monitoring and auditing

A

Companies can set predefined thresholds for the number of certain types of errors that will be allowed before the activity is considered suspicious. This baseline is referred to as clipping level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Breaches

A

protect from breaches of confidentiality and integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Protecting Logs : Availability

A

archival process to prevent loss by overwritten logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Log Analysis

A

study logs for events of interest Set maximum size. If too small, attacker can make little changes and push them out of window

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Real User Monitoring

A

aims to capture and analyze every transaction of a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Synthetic Performance Monitoring

A

uses scripted or recorded data. Traffic capture, Db performance monitoring, website performance monitoring can be used. NOT User Session

Monitoring Types

  • Proactive monitoring involves having external agents run scripted transactions against a web application
  • Db monitoring; availability of Db
  • TCP port monitoring; availability of website, service, or application
    Code
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Code Review and Testing

A

Code review is the foundation of software assessment programs. During a code review, also known as a “peer review,” developers other than the one who wrote the code review it for defects.

The most formal code review processes, known as Fagan inspections, follow a rigorous review and testing process with six steps:

  • Planning
  • Overview
  • Preparation
  • Inspection
  • Rework
  • Follow-up
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Code Coverage Report

A

information on the functions, statements, branches, and conditions covered in testing. Use cases – used as part of test coverage calculation that divides the tested use case by total use cases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Code Review Report

A

generated if the organization was manually reviewing the application’s source code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Black-box testing

A

observes the system external behavior, no internal details known

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Dynamic Testing

A

does not require access to source code, evaluates code in a runtime environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

White-box testing

A

(crystal) is a detailed exam of a logical path, checking the possible conditions. Requires access to source code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Static Testing

A

requires access to source code, performs code analysis

40
Q

CSV

A

Comma Separated Values

41
Q

CVE

A

Common Vulnerability and Exposures dictionary. The CVE dictionary provides a standard convention used to identify vulnerabilities, list by MITRE

42
Q

CVSS

A

Common Vulnerability Scoring System, metrics and calculation tools for exploitability, impact, how mature exploit code is, and how vulnerabilities can be remediated, also to score vulnerabilities against unique requirements.

43
Q

NVD

A

National Vulnerability Db

44
Q

Compiled code

A

poses more risk than interpreted code because malicious code can be embedded in the compiled code and can be difficult to detect.

45
Q

Regression testing

A

the verification that what is being installed does not affect any portion of the application system already installed. It generally requires the support of automated process to repeat tests previously undertaken. Known inputs against an application then compares results to earlier version results

46
Q

nonRegression testing

A

code works as planned

47
Q

Code comparison

A

normally used to identify the parts of the source code that have changed.

48
Q

Integration testing

A

aimed at finding bugs in the relationship and interfaces between pairs of components. It does not normally test all functions.

49
Q

Attack surface

A

exposure

50
Q

STRIDE

A

is often used in relation to assessing threats against applications or operating systems, threat categorization scheme,

STRIDE:
Spoofing, 
Tampering, 
Repudiation,
Information disclosure, Denial of service,
Elevation of privilege.
51
Q

Spoofing

A

An attack with the goal of gaining access to a target system through the use of a falsified identity. Spoofing can be used against IP addresses, MAC address, usernames, system names, wireless network SSIDs, and other types of logical identification.

52
Q

Tampering

A

Any action resulting in the unauthorized changes or manipulation of data, whether in transit or in storage. Tampering is used to falsify communications or alter static information. Such attacks are a violation of integrity as well as availability.

53
Q

Repudiation

A

The ability for a user or attacker to deny having performed an action or activity.

54
Q

Information disclosure

A

The revelation or distribution of private, confidential, or controlled information to external or unauthorized entities.

55
Q

Elevation of privilege

A

An attack where a limited user account is transformed into an account with greater privileges/powers/ access

56
Q

Key Performance and Risk Indicators

A

Security managers should also monitor key performance and risk indicators on an ongoing basis. The exact metrics they monitor will vary by organization but may include the following:

  • Number of open vulnerabilities
  • Time to resolve vulnerabilities
  • Number of compromised accounts
  • Number of software flaws detected in preproduction scanning & Repeat audit findings
  • User attempts to visit known malicious sites
57
Q

Vulnerability scans

A

automatically probe systems, applications, and networks, looking for weaknesses that may be exploited

58
Q

Network discovery scanning

A

uses a variety of techniques to scan a range of IP addresses, searching for systems with open ports.

59
Q

TCP SYN Scanning

A

Sends a single packet to each scanned port with the SYN flag set. This indicates a request to open a new connection. If the scanner receives a response that has the SYN and ACK flags set, this indicates that the system is moving to the second phase in the three-way TCP handshake and that the port is open. TCP SYN scanning is also known as “half-open” scanning.

60
Q

TCP Connect Scanning

A

Opens a full connection to the remote system on the specified port. This scan type is used when the user running the scan does not have the necessary permissions to run a half-open scan.

61
Q

TCP ACK Scanning

A

Sends a packet with the ACK flag set, indicating that it is part of an open connection.

62
Q

Xmas Scanning

A

Sends a packet with the FIN, PSH, and URG flags set. A packet with so many flags set is said to be “lit up like a Christmas tree,” leading to the scan’s name.

63
Q

Passive Scanning

A

user scan wireless to look for rogue devices in addition to IDS

64
Q

Bluetooth Scans

A

time consuming, many personal devices

  • Active; strength of PIN, security mode
  • Passive; only active connections, multiple visits
65
Q

Authenticated scans

A

read-only account to access config files

66
Q

Static Testing

A

evaluates the security of software without running it by analyzing either the source code or the compiled application. Static analysis usually involves the use of automated tools designed to detect common software flaws, such as buffer overflows.

67
Q

Dynamic Testing

A

evaluates the security of software in a runtime environment and is often the only option for organizations deploying applications written by someone else. In those cases, testers often do not have access to the underlying source code. One common example of dynamic software testing is the use of web application scanning tools to detect the presence of cross-site scripting, SQL injection, or other flaws in web applications. Testing may include the use of synthetic transactions to verify system performance.

68
Q

Fuzz Testing

A

a specialized dynamic testing technique that provides many different types of input to software to stress its limits and find previously undetected flaws. Fuzz testing software supplies invalid input to the software, either randomly generated or specially crafted to trigger known software vulnerabilities. Often limited to simple errors, does find important, exploitable issues, don’t fully cover code

69
Q

Mutation (Dumb) Fuzzing

A

Takes previous input values from actual operation of the software and manipulates (or mutates) it to create fuzzed input. It might alter the characters of the content, append strings to the end of the content, or perform other data manipulation techniques.

70
Q

Generational (Intelligent) Fuzzing

A

develops inputs based on models of expected inputs to perform the same task. The zzuf tool automates the process of mutation fuzzing by manipulating input according to user specifications.

71
Q

Misuse Case testing

A

Software testers use this process or abuse case testing to evaluate the vulnerability of their software to known risks.

72
Q

Misuse Case diagrams

A

threats and mitigate

73
Q

Test Coverage Analysis

A

method used to assess how well software testing covered the potential use of an application Interface testing - is an important part of the development of complex software systems. In many cases, multiple teams of developers work on different parts of a complex application that must function together to meet business objectives. The handoffs between these separately developed modules use well-defined interfaces so that the teams may work independently. Interface testing assesses the performance of modules against the interface specifications to ensure that they will work together properly when all of the development efforts are complete.

74
Q

Application Programming Interfaces (APIs)

A

Offer a standardized way for code modules to interact and may be exposed to the outside world through web services. Developers must test APIs to ensure that they enforce all security requirements.

75
Q

User Interfaces (UIs)

A

Examples include graphic user interfaces (GUIs) and command-line interfaces. UIs provide end users with the ability to interact with the software. Interface tests should include reviews of all user interfaces to verify that they function properly.

76
Q

Physical Interfaces

A

Exist in some applications that manipulate machinery, logic controllers, or other objects in the physical world. Software testers should pay careful attention to physical interfaces because of the potential consequences if they fail.

77
Q

Unit testing

A

testing small piece of software during a development stage by developers and quality assurance, ensures quality units are furnished for integration into final product

78
Q

Integration level testing

A

focus on transfer of data and control across a programs interfaces

79
Q

System level testing

A

demonstrates that all specified functionality exists and that the software product is trustworthy

80
Q

SAS 70

A

outdated 2011, based on ISAE 3402

81
Q

SOC Reports

A

service organization control report

82
Q

SOC-1

A

report, covers only internal controls over financial reporting. SSAE 16 is the same most common synonym SOC 1 - Finances

83
Q

SOC-2

A

(design and operational effectiveness) If you want to verify the security, integrity, privacy, and availability controls, in detail for business partners, auditors @security

84
Q

SOC-3

A

report; shared with broad community, website seal, support organizations claims about their ability to provide CIA

Type 1 – point in time covering design

Type 2 – period of time covering design and operating effectiveness

85
Q

Log Management System

A

volume of log data, network bandwidth, security of data, and amount of effort to analyze. NOT enough log sources

86
Q

OPSEC process

A

Understanding your day-to-day operations from the viewpoint of a competitor, enemy, or hacker and then developing and applying countermeasures.

87
Q

Pen-test

A

testing of network security as would a hacker do to find vulnerabilities. Always get management approval first

88
Q

Port scanner

A

program that attempts to determine whether any of a range of ports is open on a particular computer or device

89
Q

Ring zero

A

inner code of the operating system. Reserved for privileged instructions by the OS itself

90
Q

War dialer

A

dials a range of phone numbers as in the movie wargames

91
Q

Superzapping

A

system utility or application that bypasses all access controls and audit/logging functions to make updates to code or data

92
Q

Operational assurance

A

Verification that a system is operating according to its security requirements
• Design & development reviews
• Formal modeling
• Security architecture
• ISO 9000 quality techniques
• Assurance – degree of confidence that the implemented security measures work as intended

93
Q

Piggybacking

A

when an unauthorized person goes through a door behind an authorized person.

94
Q

Tailgating

A

authorized person circumventing controls

95
Q

Supervisor mode

A

processes running in inner protected ring

Sunflower Notes (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions