CISSP - Domain 6
33 flashcards · Computer Science · by Jaysen Lewis
You may need to perform vulnerability scanning in order to comply with certain regulatory requirements - what laws might you be subject to?
PCI DSS (Payment Card Industry Data Security Standard) - if you're in the payment card industry. FISMA (Federal Information Security Management Act) - If you work in US Federal Govt space.
Vulnerability scanner placement, i.e. vulnerability scan perspectives, bring different value to analysts. What are some of these perspectives and their benefits?
Placing the scanner on the DMZ provides the clearest possible picture of vulnerabilities on target systems (like public web servers). Placing the scanner on the internet gives me an attacker's view of my network. Agent-based scans can probe deeply into a server's configuration to check for vulns but this brings along with it the common problems of agent-based tools. Credentialed scanning is an alternative to this (Think BeyondTrust Retina)
Know the 5 prioritization factors of Reporting Vulnerability Scan results:
1) Severity of the vuln 2) System Criticality 3) Information sensitivity 4) Remediation difficulty 5) System Exposure
What are some of the things you can do to validate a vulnerability (and maintain credibility)?
Check for False Positives, False Negatives & Documented Exceptions
Once you have a solid asset inventory, you'll need to begin prioritizing those assets for your vuln scans. This is normally done by answering questions in three key areas about each asset. What are they?
What CVSS value is the threshold at which PCI DSS requires remediation to achieve a passing scan?
4.0
What are the differences b/w White box, Grey box and Black Box tests?
What should you document before beginning a Pen Test?
Rules of Engagement (ROE) The permitted scope of testing should be OK'd with the sponsor of the test (not necessarily the system owner). What systems you're allowed to target and the permitted techniques you can use for testing.
Understand the Penetration Testing Process:
What is "Pivoting" as it relates to Pen Testing?
After exploiting a vuln on a weak target in a system, attackers use that system as a base and then pivot to other more-desirable target systems on the same local network.
What is "Persistence" as it relates to Pen Testing?
Installing backdoors or tools on an already-exploited system that will allow the Pen Tester future access to that system (even if the intial vuln was corrected).
WHat is a Breach and Attack Simulation (BAS) platform?
A platform that seeks to automate some aspects of penetration testing. Designed to inject threat indicators onto systems and networks in an effort to trigger other security controls. In a well-functioning security program, detection and prevention controls would immediately detect and or block this traffic as potentially malicious. The BAS platform is not actually waging an attack, but it is conducting automated testing of other security controls to identify any deficiencies that might indicate…
What is Responsible or Ethical Disclosure?
In this approach, a security professional who discovers a new vulnerability first privately reports it to the vendor, providing the vendor with an opportunity to correct the problem. They then also notify the vendor that after a specified period of time, they are going to publicly disclose the vulnerability. This responsible disclosure approach offers vendors the time to fix the problem while also satisfying the security professional's ethical responsibility to protect the common good.
What are Red, Blue, White & Purple Teams?
Purple Team combines Red & Blue Team knowledge
Know the differences between Security Tests, Security Assessments and Security Audits:
Under the responsible/ethical disclosure approach, who should be notified first of a vulnerability?
The Vendor.
What is syslog?
syslog is often used to send log records in a standard, text-based format. Default on Linux systems: the defacto standard for sending and receiving log messages between applications, systems and devices syslog forms the foundational core of many security tools, resource monitoring tools, performance managers, and other security services.
What is the Fagan Inspection code review process?
The most formal code review process
What is a Static code test vs. a Dynamic code test?
NOTE for the Exam: One is not better than the other, they are compliomentary. Static program reviews are typically performed by an automated tool. Static tests are done on NON-running code. Dynamic tests use running code. Program understanding, program comprehension, code review, software inspections and software walkthroughs are all human-centric methods for reviewing code.
What is Fuzzing or Fuzz testing?
Sending different types of input (intentionally bad, random input usually) to applications to test the behavior, i.e. stress testing code. Mutation Fuzzing (aka Dumb) – Previous input values are mutated (changed) and passed to the application Generation Fuzzing (aka Intelligent) – Generates input values randomly Warning: technically, a dangerous tool.
During a test coverage analysis, how would you compute Test Coverage %?
Example: testers determined that they only evaluated 20 test cases and did not evaluate 30 others. What is the test coverage? (20/50)
What is a Business Impact Assessment (BIA)?
A Business Continuity-related assessment that identifies and prioritizes risks. Uses Qualitative & Quantitative analysis. The output of a BIA is a list of prioritized risks, like so:
What is another term for Business Continuity?
CoOP - Continuity of Operation Planning
What is the difference between High Availability and Fault Tolerance?
High Availability: Uses geographic dispersal of operationally redundant systems to protect against damage to a facility. Standby units ready to assume responsibility Fault Tolerance: Protects a single system from technical failures or "faults" in the first place Use UPSs or PDUs & Battery Backups for Power Supply failures, Use RAID for Storage failures Use NIC Teaming, Multiple ISPs, Multi-Cloud and Muiltipath for Network failures
Know the quick facts about RAID:
Redundant Array of Inexpensive of Disks (RAID) Mirroring (RAID 1) Storing the same data on 2 disks Disk Striping with Parity (RAID 5) 3+ disks to store data & parity info. Exam Tip: RAID is a fault tolerance strategy, not a backup strategy
What goal of security (From the CIA triad) is enhanced by a strong business continuity program?
Availability
What are the different types of DR Sites?
Hot Site: They have everything for true DR takeover. Fast recovery speed Very expensive, doubled costs Warm Site: Stocked with all necessary equipment and data Not maintained in parallel Similar expense to hot sites Medium recovery speed: Available in hours or days Cold Site: Relatively inexpensive Essentially empty, only possess bare minimum racks & network equipment to Slow recovery speed: Eventual take over of operations in the case of DR. Offsite Storage Site: Geographic site resiliency Con…
Know MTD, RTO & RPO
MTD - Mean Tolerable Downtime Self-explanitory: How much Downtime can be tolerated RPO - Recovery Point Objective The POINT in time to which data must be recovered after an outage RTO - Recovery Time Objective The TIME it will take to recover service.
What are the different Security Metric types?
1) KPIs - Key Performance Indicators Demonstrates the success of a security program Looks back, Retrospective 2) KRIs - Key Risk Indicators Predicts the likelihood of future risks materializing Forward-looking, Prospective
Which organization recommends selecting key risk indicators based on Business Impact, Effort, Reliability and Sensitivity?
ISACA
Know the different types of Auditors:
What type of controls mitigate the risk of exceptions to security policies?
Compensating Controls.
What are Metasploit, Nikto, Ettercap and THC Hydra?
Metasploit is a tool used to exploit known vulnerabilities. Nikto is a web application and server vulnerability scanning tool Ettercap is a man-in-the-middle attack tool THC Hydra is a password brute-force tool.