Module 5 Flashcards
define vulnerability assessment
the process of identifying, quantifying and prioritizing (or ranking) the security issues (vulnerabilities) in a system or network
3 items every organization needs to perform
- risk assessment
- vulnerability assessment
- penetration testing
what is a vulnerability
weakness or other issues that create a risk if exploited
4 ways to address risk - out of ISO 270001
- eliminate the risk
- reduce the risk to an acceptable level (mitigate)
- transfer the risk to a third party - (insurance)
- accept the risk
what is the main objective of a pen test
the main objective of pet testing is to determine security weaknesses
what is the primary goal of an external pen test
to gain unauthorized elevated access to an externally accessible system
what is a secondary goal of an external pen test
to gain unauthorized access to other systems utilizing the primary goal system
2 goals to web app pen testing
- gain anonymous access to authenticated sections of the application
- gain access to other client data within the application
vulnerability scans - how often
run internal and external scans at least quarterly and after significant changes in the network (new system components, changes in network topology, firewall rule modifications, product upgrades).
pen testing goals
- determine whether and how a malicious user can gain unauthorized access
- to confirm the applicable controls are in place
- identify ways to exploit vulnerabilities to circumvent or defeat the security features of system components
what to do after a vulnerability test
correct any vulnerabilities found. testing is repeated to verify corrections.
change-detection mechanism – what does it do
- – alert personnel to unauthorized modifications of critical system files, configuration files or content files.
- – configure this software to perform the actions at least weekly
4 steps to risk assessment process
- prepare for assessment
- conduct assessment
- communicate results to senior leadership
- maintain assessment
define vulnerability assessment
process of identifying, quantifying and prioritizing (or ranking) the security issues (vulnerabilities) in a system or network
how often should you do internal pen testing
at least annually and after any significant infrastructure or application upgrade or modification
what actions must be done once you find exploitable vulnerabilities found during pen test
- they must be reviewed and corrected
- - testing should be repeated to verify corrections
when placing IDS/IPS where are ideal locations to place these nodes
- at the perimeter of the sensitive data environment
- - at critical points in the sensitive data environment
change detection is for what
to alert personnel to unauthorized modifications of critical systems files, configuration files, or content files.
how often should change detection perform critical file comparisons
at least weekly
review firewall configurations how often
at least every 6 months
identify the tool used for change-detection
file-integrity monitoring (FIM)
who is responsible for the protection of individual assets and sensitive information
information security officer (ISO)
