Security Assessment And Testing

Front 1

What is an audit?

Back 1

An audit is a systematic way of evaluating and testing ppl, processes, and systems and data within an information system.

Front 2

Internal vs External Audits

Back 2

Internal audits allow the organization to be more agile in its assessment efforts. While external auditors generally have seen and tested many more systems in different organizations.

Front 3

The SOC 1, 2, 3 audits are used to evaluate service organizations. What is the difference between the three?

Back 3

SOC 1 evaluates financial controls. SOC 2 focuses on security, availability, confidentiality, process intergrity, and privacy.

SOC 3 is the same as SOC 2 but it is allow to be released to the public as it doesn't include the details of the report.

Front 4

Vulnerability Testing

Back 4

It is a point in time testing on controls, systems, ppl that evaluate the security posture of an environment.

Front 5

Vulnerability can be used to test three areas, what are they?

Back 5

Personnel, physical space, system and network testing.

Front 6

Name the 3 colors used to understand how much prior knowledge of the system in question is known before conducting a vulnerability or penetration test.

Back 6

Black box: tester knows nothing and used for outsider attacks

White box:tester knows everything and used for an insider attacker

Grey box:tester is somewhere in the middle of the previous approaches.

Front 7

What is pentration testing?

Back 7

The process of an outsider and an organization's leaders teaming up to simulate an attack on a network, system or application to understand its weaknesses.

Front 8

When conducting a pen test what is the five step process?

Back 8

1. Discovery of the target footprint.

2. Emuneration - port scanning, resource identification methods.

3. Mapping out vulnerabilities.

4. Attempt to exploit the vulnerabilities.

5. Report to management documentation of the test findings.

Front 9

What is a blind test for?

Back 9

A blind test is one which the assessors only have publicly available data to work with but the network group doesnt know the test is taking place.

Front 10

What is the double blind test in regards to pen testing?

Back 10

It's also a blind test but it doesn't allow the network professionals to be aware that the testing is taking place.

Front 11

What are Target Tests in regards to pen test?

Back 11

Targeted test are test that are focused on finding vulnerabilities in a specific system, application or network.

Front 12

What is war dailing?

Back 12

War dailing is an attackers attempt to enter a phone or fax system by calling random blocks numbers to locate a modem.

Front 13

What is difference between a kernel flaw and a buffer oveflow?

Back 13

Kernel flaws are when an attacker takes advantage of a vulnerability that is deep inside the operating system. While buffer overflow is when an attacker takes advantage of poor programming by sending multiple strings of data beyond the capacity an app has allocated and causes the app to execute code that the attacker inputs into the program code.

Front 14

What is the difference between a symbolic kink and a file descriptor attack?

Back 14

A symbolic link is used for Unix or Linux and it allows the attacker to compromise the link itself. While file descriptor attacks come into play when an attacker takes advantage of the numbering system used to represent the open files in a process.

Front 15

What are file and directory permission vulnerabilities?

Back 15

They are when files and directories aren't protected against unauthorized access.

Front 16

What is significant about time in regards to log reviews?

Back 16

Time should be the same across an organization to make that during an incident investigation the timing of events are accurate as possible.

Front 17

What are some ways to prevent log tampering?

Back 17

1. Move the logs to a remote location

2. Allow one communication to log location

3. Store the logs in more than one location

4. Use write once media.l

5. Cryptographic hash chaining

Front 18

What is synthetic transaction vs a real user monitoring?

Back 18

Real User Monitoring is a transaction that is done by a user of the system while a synthetic transaction is a written script acting as a user.

Front 19

Which comes first the use case or the Misuse case?

Back 19

The use case and the misuse case is created out of it.

Front 20

Interface testing

Boundary conditions

Intergration testing

Back 20

Interface testing should be done at both good and bad exchanges points to ensure they perform properly. Boundary conditions are the point of a good exchange and a bad exchange point. Intergration testing is how two apps, or system parts interact with one another.

Front 21

Account Management

Back 21

-Adding account user: AUP acceptable use policy is important during this step

-Modifying account roles or access: important not to default to highest levels of control instead of allow control only where it is required

-Suspending account user: deleting account should be in accordance with the data retention plan

Front 22

What is the least often you should complete DR drills and exercises?

Back 22

At least annually.

Front 23

Should protection of life be handled before computer in the event of an emergency?

Back 23

Yes

Front 24

What is social engineering?

Back 24

It is the practice of manipulating company personnel to violate security protocol.

Front 25

What is pretexting?

Back 25

It is the practice of creating a believe able situation to manipulate someone into violating security

Front 26

A good technical audit report has what key elements?

Back 26

-names the threats

-names the vulnerabilities

-probability of exploitation

-impact of exploitation

-recommended actions