Section 24: Threat and Vulnerability Management

Question 1

Lockheed Martin Cyber Kill Chain

Answer 1

Lockheed Martin Cyber Kill Chain

Reconnaissance
Weaponization
Delivery
Exploitation
Installation
CC
Action on Objectives

Older model, with a linear approach.

Question 2

MITRE ATTACK

Answer 2

Iterative Model, made to be less linear and rigid than the Cyber Kill Chain.

Question 3

Security Content Automation Protocol (SCAP)

Answer 3

Standardizes the formatting and naming conventions used for software flaws, misconfigurations, and vulnerabilities

Question 4

Open Vulnerability and Assessment Language (OVAL)

Answer 4

An XML schema for describing system security states and querying
vulnerability reports and information

Question 5

Extensible Configuration Checklist Description Format (XCCDF)

Answer 5

▪ An XML schema for developing and auditing best-practice configuration checklists and rules
▪ With XCCDF, scanning tools and automation can be used to check our systems