Week 4 - Vulnerability Assessment and Pen Testing Flashcards
1
Q
Vulnerability Assessment Elements
A
– Identify what needs to be protected (asset identification),
– What pressures are against those assets (threat evaluation),
– How susceptible current protection is (vulnerability appraisal),
– What damages could result from the threats (risk assessment),
– Analysis of what to do about it (risk mitigation);
2
Q
Asset Identification
A
- Asset identification - Process of inventorying items with economic value
- Common assets
– People
– Physical assets
– Data
– Hardware
– Software
3
Q
Asset’s Relative Value
A
- After an inventory of the assets has been taken, it is important to determine each item’s relative value.
- Value based on:
– Asset’s criticality to organization’s goals,
– How much revenue asset generates,
– How difficult to replace asset,
– Impact of asset unavailability to the organization; - Can rank using a number scale;
4
Q
Threat Evaluation
A
- Threat evaluation - List potential threats from threat agent,
- Threat agents are not limited to attackers,
- Also include natural disasters like fire or severe weather;
5
Q
Threat Modeling
A
- Threat modeling – Goal of understanding attackers and their methods.
- Attack tree - Provides visual representation of potential attacks as inverted tree structure.
- Attack tree displays:
– Goal of attack,
– Types of attacks that could occur,
– Techniques used in attacks;
6
Q
Vulnerability Appraisal
A
- Vulnerability appraisal - Determine current weaknesses as snapshot of current organization security,
- Every asset should be viewed in light of each threat,
- Catalog each vulnerability;
7
Q
Risk Assessment
A
- Risk assessment - Determine damage resulting from attack and assess likelihood that vulnerability is risk to organization.
- Determining damage from attack first requires realistic look at several different types of attacks that might occur.
- Based upon vulnerabilities recognized in vulnerability appraisal, a risk assessment of impact can then be undertaken.
- Not all vulnerabilities pose the same risk.
8
Q
Risk Mitigation
A
- Risk mitigation - Determine what to do about risks.
- Risk can never be entirely eliminated; would cost too much or take too long.
- Some risks must be accepted by default and degree of risk must always be assumed.
- Question is not, “How can we eliminate all risk?” but “How much acceptable risk can we tolerate?”.
- Once “toleration” level is known, steps can be taken to mitigate risk.
9
Q
Baseline Reporting
A
- Baseline - Imaginary line by which an element is measured or compared; can be seen as standard.
- IT baseline is checklist against which systems can be evaluated and audited for security posture.
- Outlines major security considerations for system and becomes the starting point for solid security.
- Baseline reporting - Comparison of present state of system to its baseline.
- Deviations include not only technical issues but also management and operational issues.
10
Q
Software Programing Vulnerabilities
A
- Important for software vulnerabilities be minimized
while software being developed instead of after released. - Software improvement to minimize vulnerabilities
difficult:
– Size and complexity
– Lack of formal specifications
– Ever-changing attacks
11
Q
Assessment Tools
A
- Many tools available to perform vulnerability assessments:
– Port scanners,
– Banner grabbing tools,
– Protocol analyzers,
– Vulnerability scanners,
– Honeypots and honeynets;
12
Q
Ports
A
- TCP/IP networks exchange information between program running on one system (process) and same/corresponding process running on remote
system. - Each packet/datagram contains source port and destination port.
- Identifies both originating application/service on local system and corresponding application/service on remote system .
13
Q
Port Categories
A
- Port numbers 16 bit length so have decimal value from 0-65,535.
- Well-known port numbers (0–1023) - Reserved for most universal applications.
- Registered port numbers (1024–49151) - Other applications not as widely used.
- Dynamic and private port numbers (49152–65535) - Available for use by any application.
14
Q
Port Security
A
- Because port numbers are associated with applications and services, if attacker knows specific port is accessible could indicate what services are
being used. - Implement by disabling unused application/service ports to reduce number of threat vectors.
15
Q
Port Scanner
A
- Software can be used to search system for port vulnerabilities.
- Port scanners typically used determine state of port to know what applications/services are running.
- Three port states:
– Open - Application/service assigned to port is listening for any instructions.
– Closed - No process is listening.
– Blocked - Host system does not reply to any inquiries to this port number.
16
Q
TCP Connect Scan
A
Involves completing a ‘three-way handshake’ with a remote port, and reports the port as closed if the full handshake cannot be established. An advantage is that it works against any TCP/IP stack.
