Domain 6 Security Assessment and Testing Flashcards
Which of the following would be the best reason for separating the test and development environments?
To control the stability of the test environment.
Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?
Regression testing
Which of the following statements pertaining to software testing approaches is correct?
The test plan and results should be retained as part of the system’s permanent documentation.
There are several types of penetration tests depending upon the scope, objective and nature of a test. Which of the following describes a penetration test where you attack and attempt to circumvent the controls of the targeted network from the outside, usually the Internet?
External Testing
For the CISA exam you should know penetration test types listed below:
External Testing - Refers to attack and control circumvention attempts on a target’s network perimeter from outside the target’s system, usually the Internet
Internal Testing – Refers to attack and control circumvention attempt on target from within the perimeter. The objective is to identify what would occur if the external perimeter was successfully compromised and/or an authorized user from within the network wanted to compromise security of a specific resource on a network.
Blind Testing - Refers to the condition of testing when the penetration tester is provided with limited or no knowledge of the target’s information systems. Such testing is expensive, since penetration tester have to research the target and profile it based on publicly available information.
Double Blind Testing - It is a extension of blind testing, since the administrator and security staff at the target are also not aware of test. Such a testing can effectively evaluate the incident handling and response capability of the target and how well managed the environment is.
Targeted Testing – Refers to attack and control circumvention attempts on the target, while both the target’s IT team and penetration tester are aware of the testing activities. Penetration testers are provided with information related to target and network design. Additionally, they are also provided with a limited privilege user account to be used as a starting point to identify privilege escalation possibilities in the system.
Which of the following statement correctly describes the difference between black box testing and white box testing?
The correct answer is: Black box testing focuses on functional operative effectiveness where as white box assesses the effectiveness of software program logic
For your exam you should know below mentioned types of testing
Alpha and Beta Testing - An alpha version is early version is an early version of the application system submitted to the internal user for testing. The alpha version may not contain all the features planned for the final version. Typically software goes to two stages testing before it consider finished.The first stage is called alpha testing is often performed only by the user within the organization developing the software. The second stage is called beta testing, a form of user acceptance testing, generally involves a limited number of external users. Beta testing is the last stage of testing, and normally involves real world exposure, sending the beta version of the product to independent beta test sites or offering it free to interested user.
Pilot Testing - A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests – usually over interim platform and with only basic functionalities.
White box testing - Assess the effectiveness of a software program logic. Specifically, test data are used in determining procedural accuracy or conditions of a program’s specific logic path. However testing all possible logical path in large information system is not feasible and would be cost prohibitive, and therefore is used on selective basis only.
Black Box Testing - An integrity based form of testing associated with testing components of an information system’s “functional” operating effectiveness without regards to any specific internal program structure. Applicable to integration and user acceptance testing.
Function/validation testing – It is similar to system testing but it is often used to test the functionality of the system against the detailed requirements to ensure that the software that has been built is traceable to customer requirements.
Regression Testing - The process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.
Parallel Testing - This is the process of feeding test data into two systems – the modified system and an alternative system and comparing the result.
Sociability Testing - The purpose of these tests is to confirm that new or modified system can operate in its target environment without adversely impacting existing system. This should cover not only platform that will perform primary application processing and interface with other system but , in a client server and web development, changes to the desktop environment. Multiple application may run on the users desktop, potentially simultaneously , so it is important to test the impact of installing new dynamic link libraries (DLLs ) , making operating system registry or configuration file modification, and possibly extra memory utilization.
Once a penetration tester has gained a basic account on the system, what is his next step?
Escalate privileges
In regards to testing of Software, which of the following is an advantage in using a bottom-up versus a top-down approach to software testing?
Errors in critical modules are detected earlier.
Which of the following test makes sure the modified or new system includes appropriate access controls and does not introduce any security holes that might compromise other systems?
Security testing
The server has been built, locked down, patched and scanned for baseline security and there’s another step you want to take to actively ensure it is resistant to attack and the controls are performing as they should.
What could it be?
Penetration Test
Which of the following is a penetration test where the penetration tester is provided with limited or no knowledge of the target system(s)?
Blind Testing
Which of the following is the process of feeding test data into two systems – the modified system and alternative system and comparing the result?
Parallel Test
What would a significant benefit be from conducting an unannounced penetration test?
The pen test would be a more realistic analysis of the target network
One risk of being a penetration tester and security analyst is liability when things go wrong and something is damaged. What is a primary defense against such liability?
Insurance
zero-knowledge (also called black box) test is “blind”;
.
the penetration tester begins with no external or trusted information, and begins the attack with public information only.
A full-knowledge test (also called crystal-box)
provides internal information to the penetration tester, including network diagrams, policies and procedures, and sometimes reports from previous penetration testers.
Security Audit
A security audit is a test against a published standard.
ie; Organizations may be audited for PCI-DSS
Security Assessments
Security assessments are a holistic approach to assessing the effectiveness of access control.
Security assessments view many controls across multiple domains, and may include the following:
• Policies, procedures, and other administrative controls
• Assessing the real world-effectiveness of administrative controls
• Change management
• Architectural review
• Penetration tests
• Vulnerability assessments
• Security audits
Static testing
tests the code passively; the code is not running.
This includes walkthroughs, syntax checking, and code reviews. Static analysis tools review the raw source code itself looking for evidence of known insecure practices, functions, libraries, or other characteristics having been used in the source code.
Dynamic testing
tests the code while executing it. With dynamic testing, security checks are performed while actually running or executing the code or application under review.
White box software testing
gives the tester access to program source code, data structures, variables, etc.
