Security+ Exam Chapter 5

Front 1

Vulnerability Management

Back 1

Programs that play a crucial role in identifying, prioritizing, and remediating vulnerabilities in our environments.

Front 2

Vulnerability Scanning

Back 2

To detect new vulnerabilities as they arise and then implement a remediation workflow that addresses the highest priority vulnerabilities.

Front 3

Asset Inventory/Asset Map

Back 3

A collection of connected systems, whether they were previously known or unknown to create an asset map

Front 4

Asset Criticality

Back 4

Information that helps make the determinations about which systems are critical and which are non critical.

Front 5

Risk Appetite

Back 5

Willingness to tolerate risk within the environment. How much risk is acceptable.

Front 6

Regulatory Requirements (Scanning)

Back 6

Certain regulatory bodies require frequency of scanning to be compliant.

Front 7

Technical Constraints (Scanning)

Back 7

These can limit the number or frequency of scans.

Front 8

Business Constraints (Scanning)

Back 8

These restrictions are in place to limit scanning during periods of high business activity to avoid disruptions.

Front 9

Licensing Limitations (Scanning)

Back 9

May curtail the bandwidth consumed by the scanner or the number of scans that my be conducted simulataneously

Front 10

Configuration Reviews

Back 10

A check to ensure that scan settings match current requirements

Front 11

Scan Sensitivity Levels

Back 11

Scans start out by using a template usually provided by the scanning product/vendor. Administrators customize these scans and should save them as their own templates saving time and reducing errors for future scans

Front 12

Scan Plug-ins

Back 12

These improve the efficiency of scans as each plugin performs a check for a specific vulnerability. Disabling unnecessary plugins improves the speed of the scan and may reduce the number of false positive results detected by the scanner.

Front 13

Supplemental Scans

Back 13

Additional scans that take place due to disruption caused by firewalls, intrusion prevention systems, and other security controls the lie between the scanner and the target server.

Front 14

Credentialed scans

Back 14

Typically only retrieve information from target servers and do not make changes to the server itself. Administrators should follow least privilege by providing read-only permissions to the scanner. This reduces the likelihood of the scanner causing a security incident related to their credentials.

Front 15

Agent-Based Scanning

Back 15

Installed software on each server these agents provide an “inside-out” vulnerability scan. They report back to the vulnerability management platform

Front 16

Scan Perspectives

Back 16

Each scan perspective conducts the scan from a different location on the network, providing a different view into vulnerabilities. External scan gives the perspective of an outside attacker, Internal scan give the perspective of a malicious insider attack.

Front 17

Controls that Affect Scans

Back 17

Firewall

Network Segmentation

Intrusion Detection Systems (IDS)

Intrusion Prevention Systems (IPS)

Front 18

Scanner Software

Back 18

Scanning systems can be prone to vulnerabilities. Regular patching of scanner software protects and organization against scanner-specific vulnerabilities as well as important bug fixes and feature enhancements to improve scan quality

Front 19

Vulnerability Plug-in Feeds

Back 19

Security researchers discover new vulnerabilities every week, and vulnerability scanners can only be effective against these vulnerabilities is they receive frequent updates to their plug-ins.

Front 20

SCAP

Back 20

Security Content Automation Protocol. Is an effort by National Institute of Standards and Technology (NIST) to create a standardized approach for communicating security related information

Front 21

Vulnerability Scanning Tools

Back 21

Network Vulnerability Scanner

Application Scanner

Web Application Scanner

Front 22

Network Vulnerability Scanner

Back 22

Probe a wide range of network connected devices for known vulnerabilities. They reach out to any systems connected to the network, attempt to determine the type of device and its configuration, and the launch targeted tests designed to detect the presence of any known vulnerabilities on those devices

Front 23

Application Scanning

Back 23

Analyze custom developed software to identify common security vulnerabilities.

Front 24

Static Testing

Back 24

Analyzes code without running it

Front 25

Dynamic Testing

Back 25

Executes code as part of the test, running all the interfaces that the code exposes to the user with a variety of inputs, searching for vulnerabilities

Front 26

Interactive Testing

Back 26

Combines static and dynamic testing, analyzing the source code while rosters interact with the application through exposed interfaces.

Front 27

Web Application Scanning

Back 27

Tool used to examine the security of web applications. Vulnerabilities that are looked for are SQL injection, Cross site scripting XSS, and cross site request forgery CSRF.

Front 28

CVSS

Back 28

Common Vulnerability Scoring System. Industry standard for assessing the severity of security vulnerabilities. It provides a technique for scoring each vulnerability on a variety for measures in order to priorities response actions

Front 29

Attack Vector Metric

Back 29

Describes how an attacker would exploit the vulnerability

Front 30

Attack Complexity Metric

Back 30

Describes the difficulty of exploiting the vulnerability

Front 31

User Interaction Metric

Back 31

Describes whether the attacker needs to involve another human in the attack

Front 32

Confidentiality Metric

Back 32

Describes the type of information disclosure that might occur if an attacker successfully exploits the vulnerability

Front 33

Integrity Metric

Back 33

Describes the type of information alteration that might occur if an attacker successfully exploits the vulnerability

Front 34

Availability Metric

Back 34

Describes the type of disruption that might occur if an attacker successfully exploits the vulnerability.

Front 35

Scope Metric

Back 35

Describes whether the vulnerability can affect system components beyond the scope of the vulnerability.

Front 36

CVSS Vector

Back 36

A single line format o convey the ratings of a vulnerability on all six of the metrics.

Front 37

False Positive

Back 37

When a scanner reports a vulnerability that does not exist

Front 38

False Negative

Back 38

When a report states that there is no vulnerability when there is

Front 39

Reconciling Scan Results

Back 39

Scan results should be checked against other information including:

Log Reviews

Security Information and Event Management Systems

Configuration Management Systems

Front 40

Patch Management

Back 40

One of the core practices in any information security program is a proper patch management system. Outdated versions are commonly found in vulnerability scan and they should be updated through a patch management system

Front 41

Legacy Platforms

Back 41

These are systems that are no longer supported by the vendor which created them. This means no more patches will be released and it is on the user to ensure that the system is free of security flaws. If at all possible these systems should be converted to the newer systems that are supported by the vendor

Front 42

Weak Configuration

Back 42

Vulnerability scans can highlight weak configuration settings which can include:

Default settings

Unsecured Accounts

Open Ports

Open Permissions

Front 43

Debug Mode

Back 43

Give developers crucial error information needed to troubleshoot applications in the development process. This gives detailed information of the inner workings of the application which can be a security risk if debug mode is left on and attackers gained access. Developers should disable debug access to any system with public exposure.

Front 44

Insecure Protocols

Back 44

Telnet is an insecure protocol used to gain command line access to a remote server. FTP allows for the transfer of files but not securely. The secure version of Telnet is Secure Shell (SSH) and for FTP is SFTP or FTPS

Front 45

Weak Encryption

Back 45

2 Choices when it comes to encryption

Algorithm & Key

Weak encryption algorithm may be easily defeated by an attacker

Weak Key that is easily guessable because of its length or composition, an attacker may find it using a cryptographic attack.

Front 46

Penetration Testing

Back 46

Authorized, legal attempts to defeat an organization’s security controls and perform unauthorized activities. They are the most effective way for an organization to gain a complete picture of their security vulnerability.

Front 47

Reasons for Pen Testing

Back 47

Pen testing provides us with visibility into the organizational security posture that simply isn’t available by other means.

Front 48

Benefits of Pen Testing

Back 48

We learn whether an attacker with the same or less knowledge/skills would likely be able to penetrate our defenses. It also gives a blueprint of remediation in the event that attackers are successful

Front 49

Threat Hunting

Back 49

Similar to Pen testing except for what they try to accomplish. Threat hunting looks for evidence of a successful attack. They use attacker’s mindset to see what a hacker might do and what type of evidence they might leave behind and the go in search of that evidence

Front 50

Penetration Test Types

Back 50

White Box: known environment tests that are performed with full knowledge of the technology, configurations, and setting that make up the target.

Benefits: Less time requirements

Disadvantages: May not provide an accurate view of external attacker

Black Box: Unknown environment test intended to replicate what an attacker would encounters.

Benefits: Realistic view of what an attacker sees

Disadvantages: Time consuming

Gray Box: partially known environment test, given some information.

Not as time consuming, while also providing a more accurate view of what an actually attacker would encounter

Front 51

Bug Bounty

Back 51

Allow organizations the opportunity to benefit from the wisdom and talent of cybersecurity professionals outside their own teams. This provides outsiders to conduct security testing with the incentive of financial rewards.

Front 52

Rules of Engagement

Back 52

Given to testers at the beginning to give them the scope of the test the organization is looking for.

Timeline

Locations (Places, Systems, Applications, Included and Excluded)

Data Handling

Expected Behaviors

Committed Resources

Legal Concerns

Communications

Front 53

Reconnaissance

Back 53

Pen tests start with this phase, where testers seek to gather as much information as possible about their target.

Passive reconnaissance happens without directly engaging with the target. This includes Open Source Intelligence (OSINT)

Active reconnaissance occurs when direct contact is made with target. This includes port scanning, foot printing to identify operating systems and applications in use, and vulnerability scanning.

Front 54

Phases of Test

Back 54

Initial Access: attacker gains access to the network

Privilege escalation: shift from the initial access gained by a the attacker to more advanced privileges, such as root/admin

Pivoting/Lateral Movement: uses initial compromise in order to gain access to other parts of the network

Persistence: installing back doors and other mechanisms to allow them to regain access to the network, even if the vulnerability is eventually patched

Front 55

Teams

Back 55

Red Team: are the attackers who attempt to gain access to systems

Blue Team: are the defenders who must secure systems and networks from attack

White Team: Observers and judges

Purple Team: Post exercise the red and blue team discuss the strategies of each team in the exercise to help everyone learn from the process.