Topic 8C Flashcards
Vulnerability scanning tools
openVAS and Nessus are popular tools offering a broad range of features designed to analyze network equipment, operating systems, databases, patch compliance, configuration, and many other systems.
While these tools are very effective, application security analysis warrants much more specialized approaches.
non-credentialed scan
one that proceeds by directing test packets at a host without being logged on to the OS or application. The view is the one the host exposes to an unprivileged user on the network.
The test routines may be able to include things such as using default passwords for service accounts and device management interfaces, but they are not given privileged access
credentialed scan
given a user account with login rights to various hosts, plus whatever other permissions are appropriate for the testing routines. This sort of test allows much more in-depth analysis, especially in detecting when applications or security settings may be misconfigured.
It shows what an insider attack, or an attack with a compromised user account, may be able to achieve
static analysis
(reviewing application code without executing it)
dynamic analysis
(testing running applications)
Is application scanning usually handled with general vulnerability scans?
No, it is handled differently due to the unique nature of software applications and the specific types of vulnerabilities they introduce. General vulnerability scanning is designed to detect system-wide or network-wide weaknesses, such as out-of-date software or misconfigured firewalls.
application vulnerability scanning evaluates the coding and behavior of individual software applications. It looks for issues like cross-site scripting (XSS), SQL injection, and insecure direct object references unique to software applications
package monitoring
associated with vulnerability identification because it tracks and assesses the security of third-party software packages, libraries, and dependencies used within an organization to ensure that they are up to date and free from known vulnerabilities that malicious actors could exploit.
is associated with the management of software bill of materials (SBOM) and software supply chain risk management practices.
Automated software composition analysis (SCA) tools
track and monitor the software packages, libraries, and dependencies used in an organization’s codebase. These tools can automatically identify outdated packages or packages with known vulnerabilities and suggest updates or replacements.
They work by continuously comparing the organization’s software inventory against various databases of known vulnerabilities, such as the National Vulnerability Database (NVD) or vendor-specific advisories.
threat feeds
These are real-time, continuously updated sources of information about potential threats and vulnerabilities, often gathered from multiple sources.
AlienVault’s Open Threat Exchange (OTX), IBM’s X-Force Exchange, and Recorded Future are examples
the outputs from the primary research undertaken by threat data feed providers and academics can take three main forms:
Behavioral Threat Research—is narrative commentary describing examples of attacks and TTPs gathered through primary research sources.
Reputational threat intelligence—is lists of IP addresses and domains associated with malicious behavior, plus signatures of known file-based malware.
Threat Data—is computer data that can correlate events observed on a customer’s own networks and logs with known TTP and threat actor indicators.
cyber threat intelligence (CTI) data
Threat data can be packaged as feeds that integrate with a security information and event management (SIEM) platform
The data on its own is not a complete security solution. To produce actionable intelligence, the threat data must be correlated with observed data from customer networks. This type of analysis is often powered by artificial intelligence (AI) features of the SIEM.
Closed/proprietary
is where threat research and CTI data is available as a paid subscription to a commercial threat intelligence platform. The security solution provider will also make the most valuable research available early to platform subscribers in the form of blogs, white papers, and webinars.
Threat feed information-sharing organizations
are collaborative groups that exchange data about emerging cybersecurity threats and vulnerabilities. These organizations collect, analyze, and disseminate threat intelligence from various sources, including their members, security researchers, and public sources.
Information Sharing and Analysis Centers (ISACs)
A not-for-profit group set up to share sector-specific threat intelligence and security best practices among its members. Is also a Threat feed information-sharing organization
Open-source intelligence (OSINT)
describes collecting and analyzing publicly available information and using it to support decision-making.
In cybersecurity operations, OSINT is used to identify vulnerabilities and threat information by gathering data from many sources such as blogs, forums, social media platforms, and even the dark web.
