Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 601 > Sec+ Chapter 05: Security Assessment and Testing > Flashcards

Sec+ Chapter 05: Security Assessment and Testing Flashcards

1
Q

Vulnerability management

A

Identifying, prioritizing, and remediating vulnerabilities in our environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Vulnerability scanning

A

How we detect new vulnerabilities and implement a remediation workflow that addresses the highest priorities first

Scanners look at a huge amount of information, but not everything

Looks at very specific signatures for known vulnerabilities that can be x-referenced online

Minimally invasive, unlike pentests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Asset inventory / map

A

The result of using scanning tools to search the network for connected systems, whether they were previously known or unknown

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Nessus

A

Created by Tenable, one of the first vulnerability scanners on the market that’s widely used today

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Configuration review

A

A process conducted on vulnerability scanners to ensure their settings match current requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Factors that influence how often vulnerability scans are run

A

1) Risk appetite

2) Regulatory requirements

3) Technical constraints

4) Business constraints

5) Licensing limitations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Credentialed scanning

A

When you provide the scanner with credentials that allow it to connect to a target server

Known environment scan, emulates insider attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Agent based scanning

A

Installed agents conduct scans for an inside-out view of a server

Reports info back to vulnerability management platform

Can cause performance and stability issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Scan perspectives

A

Conducting a scan from a different location on the network

EX: External vs internal scans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Controls that could affect scans

A

1) Firewall settings

2) Network segmentation

3) IDS

4) IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SCAP

A

Security content automation protocol

Effort led by NIST to create a standardized approach for communicating security-related info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CCE

A

Common configuration enumeration

SCAP standard for system configuration issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CPE

A

Common platform enumeration

SCAP standard for product names and versions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CVE

A

Common vulnerabilities and exposures

SCAP standard for security-related flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CVSS

A

Common vulnerability scoring system

SCAP standard for severity of security-related flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

XCCDF

A

Extensible configuration checklist description format

SCAP standard for checklists and reporting checklist results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

OVAL

A

Open vulnerability and assessment language

SCAP standard for specifying low-level testing procedures used by checklists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Scanning tools you need

A

1) Network vulnerability scanner

2) Application scanner

3) Web app scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Network vulnerability scanner

A

Tool that detects the presence of vulnerabilities on network-connected devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

4 commonly used network vulnerability scanners

A

1) Qualys

2) Rapid7 Nexpose

3) OpenVAS

4) Nessus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Application scanner

A

Tool that analyzes custom-developed software to identify common security vulnerabilities

Should always be integral to dev process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Static application testing

A

Analyzing code without executing it

Points devs at vulnerabilities and provides specific remediation suggestions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Dynamic application testing

A

Executes code as part of a test

Runs all interfaces that the code exposes a user to with a variety of inputs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Interactive application testing

A

Combination of static and dynamic testing

Analyzes the source code while testers interact with the application through exposed interfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Web app scanner

A

Specialized tools to examine the security of web apps

Can test for SQL injection, XSS, and CSRF

26
Q

How web app scanners work

A

Combines network scans of web servers with detailed web app probing

Sends known malicious input sequences and fuzzing in attempts to break the app

27
Q

Common web app scanners

A

1) Nikto: CLI-based

2) Arachni: Windows, Linux, macOS

28
Q

CVSS AV

A

Attack vector

How an attacker exploits a vulnerability

1) Physical (P)

2) Local (L)

3) Adjacent network (A)

4) Network (N)

29
Q

CVSS AC

A

Attack complexity

The difficulty of exploiting a vulnerability

1) High (H)

2) Low (L)

30
Q

CVSS PR

A

Privileges required

The type of account access an attacker needs to exploit a vulnerability

1) High (H)

2) Low (L)

3) None (N)

31
Q

CVSS U

A

User interaction

Whether the attacker needs to involve another human in the attack

1) None (N)

2) Required (R)

32
Q

CVSS C

A

Confidentiality

The type of information disclosure that may occur if an attacker successfully exploits

1) None (N)

2) Low (L)

3) High (H)

33
Q

CVSS I

A

Integrity

The type of information alteration that may occur if an attack successfully exploits

1) None (N)

2) Low (L)

3) High (H)

34
Q

CVSS A

A

Availability

The type of disruption that may occur if the attacker successfully exploits

1) None (N)

2) Low (L)

3) High (H)

35
Q

CVSS S

A

Scope

Whether or not the vulnerability can affect system components beyond the scope of the vulnerability

Value of the scope metric is reflected in the values for the privileges required metric

1) Unchanged (U)

2) Changed (C)

36
Q

CVSS Base score

A

Single number representing the overall risk posed by a vulnerability

37
Q

CVSS qualitative rating scale

A

CVSS based on risk categories instead of numeric value

1) None: 0.00

2) Low: 0.1 to 3.9

3) Medium: 4.0 to 6.9

4) High: 7.0 to 8.9

5) Critical: 9.0 to 10.0

38
Q

False positive error

A

When a vulnerability scanner reports a vulnerability that doesn’t exist

39
Q

Positive report

A

When a vulnerability scanner reports a real vulnerability

It could be a true positive (accurate) or false positive (inaccurate)

40
Q

Negative report

A

When a vulnerability scanner reports no vulnerability present

It could be a true negative (accurate) or false negative (inaccurate)

41
Q

Log review

A

Scouring logs to find possible attempts to exploit

42
Q

SIEM

A

Security information and event management systems

Collects real time information from anything on a network that can tell us what’s happening right now, like log files and security alerts

Central repository that correlates data from multiple sources to provide actionable intelligence on vulnerability exploits

43
Q

Configuration management system

A

Provides information on the OS and applications installed on a system to verify vulnerabilities and exploits

44
Q

Patch management

A

Core security practice

Consistently applying security patches to systems

45
Q

Legacy platform

A

Any product that’s been discontinued and no longer has support, massive security risk

46
Q

If you can’t update legacy platforms

A

Isolate the system

Don’t connect to network if possible

Apply compensating security controls

Increase monitoring

Strict firewall rules

47
Q

Weak configurations

A

1) Default settings

2) Unsecured accounts

3) Unnecessary open ports and services

4) Permissions that violate least privilege

48
Q

Debug mode and error messages

A

Gives crucial error info needed for troubleshooting

Also provides attackers info with the same details like db structure, authentication mechanisms, etc

49
Q

How to manage debug mode effectively

A

1) Disable it on public-facing systems

2) Give devs a dedicated environment for their work only accessible from private network – then you can enable

50
Q

White box tests

A

Known environment

Pentest where you have full knowledge of the underlying tech, configs, and settings

51
Q

Black box tests

A

Unknown environment

Pentest that seeks to replicate what an attacker encounters, no information or access

52
Q

Gray box test

A

Partially known environment

Pentest that blends white and black

Some info given, but not full info

53
Q

RoE

A

Rules of engagement for pen testing. Key elements include:

1) The timeline for the engagement and when testing can be conducted

2) What locations, systems, apps, or other targets are included or excluded (IPs, etc)

3) Data handling requirements for information gathered during the pen test

4) What behaviors to expect from the target (shunning, black-listing, or active defenses and how they can limit the value of a pen test)

5) What resources are committed to the test

6) Legal concerns

7) When and how communications will occur about the test

54
Q

War driving

A

When pentesters drive by facilities with high-powered antennae to eavesdrop and connect on wireless networks

55
Q

War flying

A

Same as war driving, but with UAVs

56
Q

Initial access

A

When an attacker exploits a vulnerability to gain access to an org’s network

57
Q

Privilege escalation

A

Shift to more advanced privileges like root access on the same system

58
Q

Pivot / lateral movement

A

Using initial system compromise to gain access to other systems on the target network

59
Q

Persistence

A

Install backdoors and other mechanisms on compromised networks that allow repeat access to the network, even if the initial vulnerability is patched

60
Q

Syslog

A

Standard method for transferring log files from one device to a centralized database, like a SIEM

SIEM has syslog compatible collectors that waitfor messages to be sent from all the devices on the network

When we send info via syslog, we label each log entry into the syslog destination with a facility code (program that created the log) and a severity level

Different syslog daemons:

1) Rsyslog: Rocket fast system for log processing

2) syslog-ng: Additional filtering and storage options

3) NXLog: Collection from many diverse log types

61
Q

SIEM data

A

Some examples of the types of data that are valuable to store in SIEM

1) Server authentication attempts

2) VPN connections

3) Firewall session logs

4) Denied outbound traffic flows

5) Network utilizations

6) Packet captures

Security+ 601 (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions