Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP2020 > Domain 6 - Security Operations > Flashcards

Domain 6 - Security Operations Flashcards

1
Q

concepts in security assets and testing

A
  1. Security control testing
  2. Collect security process data
  3. Analyze reports and test outputs
  4. Internal and third-party audits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

vulnerability assessment, penetration testing, log reviews, NIST SP 800-92, synthetic transactions, code review and testing, misses case testing, test coverage, interface testing

A

security control testing topics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

An absence or weakness of a countermeasure that is in place

A

vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Three categories:

  1. Personnel testing: review standard practices and procedures that users follow.
  2. Physical testing: review facility and perimeter protections.
  3. System and network testing: review systems, devices, and network topology.
A

vulnerability assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

These include Nessus, open vulnerability assessment system (Open VAS), Core Impact, Expose, GFI Lan Guard, Qualys Guard, Microsoft Baseline Security Analyzer (MBSA)

A

vulnerability assessment applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

metrics for vulnerability assessment tools

A

accuracy, reliably, scalability, and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This results in time spent researching a non-exisiting issue.

A

false positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

These are serious because it means the scanner failed to identify an issue that uses a serious security risk.

A

false negative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The goal of this ethical hacking test is to simulate an attack to identify any threats that can stem from internal or external resources planning to exploit the vulnerabilities of a system or device. Internal and external test should be performed.

A

penetration test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

penetration testing steps

A
  1. Document information about the target devices/system.
  2. Gather information about a hack method agains the target system/device. Perform port scans.
  3. Identify the known vulnerabilities of the target system/device.
  4. Execute attacks agains the target system/device to gain user and privilege access.
  5. Document the results of the findings and report the finding to management, with suggestions for remediation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Blind Test: limited or publicly available knowledge, known to the tester and the organization. It simulated the actual test.

Double-Blind Test: The organization and team does not know the test is coming. It requires equal effort by security and testing teams.

Target Test: Security and testing team both known about the test and have ben given all details about systems and devices. It is the easiest to complete but results in an incomplete picture.

A

penetration testing strategies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The team is given limited knowledge of the network systems and devices and publicly available information is known. The organization’s security team knows the attack/test is coming. The test requires more effort by t the testing team and the team must simulate an actual attack.

A

blind test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

This is the same as blind test but the organization doesn’t now the test is coming. Only a few senior people know the test will occur, and they do not share this information. The test requires both the security and testing teams to use more effort to simulate the attack.

A

double-blind test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Both the testing team and the organization security team are given the maximum information about the network and they type of attack that will occur. This is the easiest test to perform but it only gives a partial picture of the organization’s security.

A

target test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Zero-knowledge test: closed, black-box, no information on the organizations network, any means is used to test.

Partial-knowledge test: partial-limited testing with set boundaries; team has public knowledge.

Full-Knowledge tests: Full knowledge is known about the organization’s network. Focus is on what attacks can occur.

A

penetration test categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The team gets no information regarding the organization’s network. The testing team can use any means available to obtain information about he organization’s network. This is also referred to as “closed” or black-box testing.

A

zero-knowledge test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Team is given public knowledge about the organization’s network. Boundaries might be enforced or set for this type of test.

A

partial-knowledge test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The team is given all details about the organization’s network. Test is focused on what attacks can be carried out.

A

full-knowledge test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Penetration testing applications: Metasploit, Wireshark, Core Impact, Nessus, Back Track, Cain and Able, Kali Linux, John the Ripper. These are:

A
  1. Research tools need to carry out testing.
  2. Select the right individual to perform the test.
  3. Select the right individual to perform the test.
  4. Use manual as well as automated method to test.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q
  1. Recording of events that occur on an organizational asset, systems, devices, network or facilities.
  2. Different types of logs for different types of events.
  3. Logs help identify security incidents, policy violations, and fraud.
  4. logs are stored in detail for a specified amount of time for auditing.
  5. Available for: forensic analysis, investigations, baselines, trends, to identify long-term problems.
  6. NIST SP 800-92 and NIST SP 800-137 set the standards for this process
A

log reviews

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

This is referred to as effective log management. It is a guide to the security of log management. It establishes policies and procedures for log management. It prioritizes log management appropriately though the organization. It creates and maintains a log management infrastructure and provides proper support for all stuff with log management responsibilities.

A

NIST SP 800-92

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

General functions: log parsing, even filtering, and event organization.

Storage: log rotation, log archival, log reduction, log conversion, log normalization, and log file integrity checking.

Log Analysis: event correlation, log viewing, and log reporting.

Log Disposal: log clearing

A

common log management infrastructure components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

This is a simple framework for log entry, generation, storage, and transfer, that any operating system, security software, or application could us for log maintenance. There are three parts to the type of log:
Part I: Specifies the facility and severity as numeric values.
Part II: Time stamps and the host name or IP address of the source of the log.
Part III: The actual log message content.

IETF RFC 3195 describes implantation of greater syslog security and supporting of CIA.

A

syslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This allows administrator to consolidate all security logs so they can perform analysis in all logs from a single resource rather than having to analyze each log on its separate resources. Two type of this type of support include: Agentless and Agent-Based. It also supports log sources, operating systems, security software, application servers, we/email severs, physical security control devices, such as badge readers. It does not support syslog.

A

security information and event management (SIEM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Agents don’t need to be installed / configured on each host. However, there is a lack of filtering at the host level; causes more data to be transferred.

A

Advantages and disadvantages of SIEM-Agentless

26
Q

Hosts and data reside on the SIEM server. Some of these servers PULL data from host, with the server authenticating each host to regularly retrieve logs.
Some hosts PUSH data to the SIEM service; each host authenticates sever, transferring logs regularly. Servers perform event filtering and aggregation and log normalization and analysis in collected logs.

A

SIEM-Agentless

27
Q

An agent program is installed on the host to perform event filtering and aggregation and log normalization for a particular type of log. The host then transmits the normalized log data to a SIEM server, on a real-time, or near real-time basis for analysis/storage. Multiple agents may need to be installed if a host has multiple logs of interests. Some of these offer support for syslog and SNMP type logs. Some support for custom created agents to handle unsupported log sources.

A

SIEM-Agent-Based

28
Q

This is a type of proactive monitoring for website and user activity. It provides insight into the availability and performance of an application. It warns of potential issues before users experience any performance degradation. It uses external agents to run scripted transactions agains an application.

A

synthetic transactions

29
Q

This is passive monitoring. A type of monitoring that capture and analyzes eery transaction of very application or website user. It is the opposite of synthetic transaction and cuts through the guesswork to see exactly how users are interacting with the application.

A

real user monitoring (RUM)

30
Q

This must occur throughout the life-cycle of the entire system and application. The goal is to identify bad programming patterns, security misconfigurations, functional bugs, and logic flaws. The plan/design phase test architecture security and threat modeling. The development phase test/reviews static source code, manual code analysis, statistic binary code, manual binary review. Once an application is deployed, this process involves: penetration testing, vulnerability scanning, and fuzz testing.

A

code review and testing

31
Q

In these types each line of the code is reviewed before the software is deployed.
Over-the-shoulder: the developer literally looks over the shoulder as the author walks through the code line by line.
Email pass-around: Source code is emailed to reviewers automatically after the code is checked in.
Pair programming: Two authors develop code together at the same workstation.
Tool-assisted code review: Authors and reviewers use tools designed for peer code review.

A

formal code review types

32
Q

This is part of code review and testing. No internal details are known prior to this test.

A

black box testing

33
Q

This is part of code review and testing. Source code is known prior to the test

A

white box testing .

34
Q

This is also referred to as negative testing. This type of testing test an application to ensure the application can handle invalid input or unexpected behavior to ensure the application will not crash. It is also used to improve the quality of the application by identifying its weak points.

A

misuse case testing

35
Q

misuse case testing parameters

A
  1. Required fields must be populated.
  2. Fields with a defined data type can only accept data that is the required data type.
  3. Fields with character limits allow only the configured number of characters.
  4. Fields with a defined date range accept only data with that date range.
  5. Fields accept only valid data.
36
Q

Another term for misuse testing.

A

negative testing

37
Q

This uses test cases that are written against the application requirement specifications. Code doesn’t need to be seen by those writing the test case. Usually the test is performed by the application developer as part of the unit testing. Quality assurance groups use the test results to indicate test metrics and or coverage according to the test plan. The test can not test what has not been written.

A

test coverage analysis

38
Q

This type of testing evaluates whether an application systems or components correctly pass data control to one another. It verifies whether module interactions are working properly and errors are handled correctly. This type of testing should test interfaces for clients, servers, remote, GUI, APIs, external/internal, and physical.

A

interface testing

39
Q

NIST SP 800-137, account management, management review, key performance and risk indicators, backup verification data, training and awareness, disaster recovery and business continuity.

A

collect security process data - concepts

40
Q

This is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organization risk management decisions. [collect security process data]

A

NIST SP 800-137 Information Security Continuous monitoring (ISCM) for Federal Information Systems and Organizations

41
Q

A program that involves maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.

A

information security continuous monitoring (ISCM)

42
Q

This is important because it involves the addition and or deletion of accounts that are granted access to systems or networks. It involves change the permissions and or privileges granted to accounts. Non-monitored accounts can lead to fraudulent activities. Requirements include: two persons for controls, administrators alone create accounts, a second person assigns account the appropriate levels of permission or privileges. Escalation involves the user getting more permissions based on new job duties or a job change. Revocation involves an account being closed or deleted due to an employee leaving the organization.

A

accounts management

43
Q

This occurs when the user’s account is granted more permissions base one job duties, complete job change. It involves fully analyzing the user’s needs prior to changing current permissions and privileges so the user has only what they need for the job. This requires separation of duties. For example, a user retains permissions to print checks, then they promote and can write checks. Fraud can occur if they can both write and print check.

A

account management and escalation

44
Q

This occurs when the employee or user leaves the organization. Review what “object” belong to the account to avoid deleting objects that may be needed by other users; or users may lose access. Better to disable the account for a time of review before complete deletion. Review / distinguish between employees who leave or are terminated.

A

account management and revocation

45
Q

This requires a review of all process and should be mandatory. Guidelines and procedures should be established. This review should be timely and include minor issues, which could become major breaches.

A

management review

46
Q

Allows the organization to identify where risks are lily to occur. It is used to determine levels as normal, below normal, or above normal. This uses NIST frameworks: framework core, framework profiles, and framework implementation tiers.

A

key performance and risk indicators

47
Q

This is an NIST framework for improving critical infrastructure. It is a set of cybersecurity actives, outcome, and informative references that are common for guidance to develop organization profiles.

A

Framework Core

48
Q

This is an NIST framework for improving critical infrastructure. This helps to align cybersecurity activities with its business requirements, risk tolerance, and resources.

A

Framework Profiles

49
Q

This is an NIST framework for improving critical infrastructure. Provides a mechanism to view and or understand characteristics of their approach to managing cybersecurity risks.

A

Framework Tiers

50
Q

Back up all collected data. Have appropriate backup policies in place for backup and restore for all security processes. Backup correctly or lose data. Test the backup and restore procedures on a regular basis.

A

backup verification data

51
Q

Everyone in the organization needs to have an understanding of the importance of the security training and testing program.

A

Training and awareness, disaster recovery, and business continuity.

52
Q

Personnel should understand manual reporting can be done as part of the security assessment and testing. Personnel may need special training on how to run manual reports. Reports have to be done in a timely fashion.
High level management: Needs a summary of reports.
Technical Personnel: Need detailed reports to implement appropriate controls.

A

analyze reports and test outputs

53
Q

Guidelines to consider as part of the security plan include: SAS 70, SSAE 16, SOC1 Type 1 Report, and SOC1 Type 2 Report. The processes include:

  1. Perform annual audits to establish security baselines.
  2. Determine objectives for audits and share with auditors.
  3. Set ground rules for audit to include dates, times set for before and after the audit.
  4. Choose auditors who have security experience.
  5. Involve business unit managers early in the process.
  6. Ensure auditors rely on experience not just checklists.
  7. Ensure that the audit is conducted properly.
  8. Ensure the auditor’s reports reflects risks that the organization has identified.
  9. Ensures that the audit is conducted properly.
  10. Ensure that the audit covers all systems and all policies and procedures.
  11. Examine the report when the audit is complete.
A

internal and third-party audits considerations

54
Q

This provides auditors information / verification about data center controls and processors related to users and their financial reporting. Ensures controls and processes are actually being used. It is an older standard. SSAE 16 is the new standard resulting in SOC1, SOC2, and SOC3.

A

Statement on Audits 70 (SAS 70)

55
Q

Pertains to SOC Type 1 report and SOC Type 2 report. Audit guidelines that verifies the controls and processes and also requires a written assertion regarding the design an derating effectiveness of the controls being revived.

A

Statement on Standards for Attestation Engagement (SSAE) 16

56
Q

Focuses on the auditor’s opinion of the accuracy and completeness of the data center management’s design of controls, systems, and or service.

A

SSAE 16, SOC 1, Type 1 Report

57
Q

Includes the Type 1 report as well as an audit of the effectiveness of controls over a certain time period, between six months to a year.

A

SSAE 16, SOC 1, Type 2 Report

58
Q

Provides benchmarks for controls related to the security, availability, processing integrity, confidentiality, and or privacy of a system and its information. Includes service auditor testing and results. It is used by management and regulators and is shared under the NDA. It reports on security, availability, processing integrity, confidentiality, or privacy controls.

A

SSAE 16, SOC 2

59
Q

This reports on: security, availability, processing integrity, confidentiality, or privacy controls. It is publicly available to anyone. It benchmarks controls related to those mentioned above on a system and its information. This report provides the system description and auditor’s opinion. It is used for general purposes. It provides a level of certification for data center operators that assures data center users of facility security, high availability, and process integrity.

A

SSAE 16, SOC 3

60
Q

Occurs when a user changes jobs within an organization and gains more user permissions than is necessary for the job duties.

A

authorization creep

61
Q

Two most important configurations for all user accounts.

A

strong passwords and least privilege

CISSP2020 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions