Section 22 - Vulnerability Management Flashcards
What is a vulnerability assessment?
Seeks to identify any issues in a network, application, database, or other systems prior to it being used that might compromise the system
Vulnerability assessments are a formalized process that ____, _____, and _____ the security holes in an enterprise network architecture.
define, identify and classify
What is vulnerability management?
Practice of finding and mitigating the vulnerabilities in computers and networks
** This is the oversight process of vulnerability assessments
Vulnerability management is a cyclical process. Sometimes you’ll hear it referred to as…?
Scan, Patch, Scan
*** This is because you’ll scan the network for vulnerabilities to identify them (SCAN) then you’ll prioritize, fix and patch them (PATCH) and you’ll scan again. You repeat this until there are no vulnerabilities left.
How is a vulnerability assessment conducted?
Most commonly, a vulnerability management program will be used inside of an organization ad they’ll choose what software you’re going to use.
What are the five basic concepts you need to know to summarize the vulnerability management process?
- Define the desired state of security
- Create a baseline
- Prioritize the vulnerabilities
- Mitigate vulnerabilities
- Monitor the network and systems and conduct future scans
What is a penetration test?
A test conducted by a team of professionals to simulate an attack on your network, its systems or its applications
What is the difference between black box, gray box and white box testing?
Black box = zero knowledge (the pentesters have to hunt for any information that they need in order to be able to penetrate the network’s defenses)
Gray box = Some knowledge
White box = Full knowledge
What is the difference between a penetration test and a vulnerability assessment?
A vulnerability assessment is conducted as a credentialed scan, where the tool can be provided with a username and password for the systems.
Penetration tests are going to be conducted in the form of a test (black, white or gray) where pentesters will simulate being an attacker who will attempt to get into your network and after the test is complete they will provide a report telling you what vulnerabilities were found.
Penetration tests follow five basic steps. What are they?
- Get permission and document info
- Conduct reconnaissance
- Enumerate the targets
- Exploit the targets
- Document the results
What is a tabletop exercise (TTX)?
Exercise that uses an incident scenario against a framework of controls or a red team
*** This is a discussion of simulated emergency situations and security incidents
What is a red team vs a blue team?
Red team = attacking your system in a penetration test
Blue team = defending your system in a penetration test
*** Teams can be external or internal meaning they can either be employees (internal) conducting the test or a third party (external.)
What is a red team?
The hostile or attacking team in a penetration test or incident response exercise
What is a blue team?
The defensive team in a penetration test or incident response exercise
What is a white team?
Staff administering, evaluating, and supervising a penetration test or incident response exercise
