Vulnerability Management Flashcards
Seeks to identify any issues in a network, application, database, or other
systems prior to it being used that might compromise the system
Vulnerability Assessment
Practice of finding and mitigating the vulnerabilities in computers and
networks
Vulnerability Management
Occurs when an attacker moves onto another workstation or user
account
Pivot
Ability of an attacker to maintain a foothold inside the compromised
network
Persistance
Exercise that uses an incident scenario against a framework of controls or
a red team
Tabletop Exercise (TTX)
A test that uses active tools and security utilities to evaluate security by
simulating an attack on a system to verify that a threat exists, actively
test it, bypass security controls, and then finally exploit vulnerabilities on
a given system
Penetration Test
The hostile or attacking team in a penetration test or incident
response exercise
Red Team
The defensive team in a penetration test or incident response
exercise
BLue Team
Staff administering, evaluating, and supervising a penetration test
or incident response exercise
White team
A standard designed to regulate the transfer of secure public information
across networks and the Internet utilizing any security tools and services
available
Open Vulnerability and Assessment Language (OVAL)
An XML schema used to define and describe the information being
created by OVAL to be shared among the various programs and tools
OVAL Language
A reference developed to ensure the information passed around by these
programs complies with the OVAL schemas and definitions used by the
OVAL language
OVAL Interpreter
Baselining of the network to assess the current security state of
computers, servers, network devices, and the entire network in general
Vulnerability Assessment
Discovery and documentation of physical and logical connectivity
that exists in the network
Network Mapping
A technique that identifies threats on the network without
exploiting them
Vulnerability Scanning
A technique used to gain information about servers and
inventory the systems or services
Banner Grabbing
The process of finding and investigating other computers on the
network by analyzing the network traffic or capturing the packets
being sent
Network Sniffing
A tool used to test the strength of your passwords to ensure your
password policies
are being followed
Password Analysis
Uses comparative analysis
to break passwords and systematically continues guessing
until the password
is determined
o Cain & Abel and John the Ripper
Password Cracker
Occurs when a weak password is simply figured out by a
person
Password Guessing
Method where a program attempts to guess the
password by using a list of possible passwords
Dictionary Attack
Method where a program attempts to try every possible
combination until it
cracks the password
Brute-Force Attack
Comparing a precomputed encrypted password to a value
in a lookup table
Cryptanalysis Attack
List of precomputed valued used to more quickly break a
password since values don’t have to be calculated for each
password being guessed
Rainbow Table
Attempt to crack a password by threatening or causing a
person physical harm in order to make them tell you the
password
Rubber Hose Attack
