Lesson 27 - Explain Types and Purposes of Audits and Assessment

Information Security Assessment

- determining how effectively the evaluated entity meets specific security criteria

- can be done via examination or testing

Examination

Information Security Assessment approach that consists of interviewing, reviewing, inspecting, studying and observing (e.g. Audit)

Testing

Information Security Assessment approach that consists of exercising objects under specified conditions to compare actual and expected behavior (e.g. Pen testing)

Assurance

measure of confidence that controls plans, and processes are effective

Audit

provides independent assurance base on evidence

Audit Plan

- high-level description of audit work to be performed in a specific time frame

- audit plan is documented in an engagement letter

Sampling

used to infer characteristics about a population

Unqualified Opinion

audit opinion renderd when the auditor does not have any significant reservations

Qualified Opinion

audit opinion rendered when there are minor deviations and scope limitations

Adervse Opinion

audit opinion when the target is not in compliance with control objectives or when evidence is misleading/misstated

Disclaimer

statement that auditor was not able to render an opiono due to named circumstances

Audit Framework

- structured approach used by auditors to plan, execute, and report on audit engagement

- e.g .ISACA, AICPA

AICPA

- defacto tech company audit framwork

- uses SSAE18 (Statement on Standards for Attestation Engagement no. 18)

SOC 1

- SSAE 18 SOC versions

- report of controls relevant to user entities financial statement

SOC 2

- SSAE 18 SOC Version

- based on Trust Services Principle (TSP) and reports on controls intended to mitigate risk related to security, availability, processing, integrity, confidentiality, and privacy

- organization chooses categories considered in audit

- likely requires NDA

SO3

- SSAE 18 SOC versions

- same as SOC 2 but does not detail testing performed and is designed for public distribution

Type 1 Report

- reports on controls placed in operations as of a point in time

- doesn't report on control effectiveness

- Cover of report will have an "As of" date

Type 2 Report

- reports on the desing, implementation, and operating effectiveness over a period of time

- Cover of report will show a time period

Penetration Testing

- used to evaluate the security of a traget by identifying and attempting to exploit vulnerabilities

- a.k.a ethical hacking

Known environment

testing approach where testers have comprehensive knowledge about the target system

Partially Known enviornment

testing approach where testers have restricted/selective information about the target system

Unknown environment

testing approach where testers have no information about the target system

ROE (Rules of Engagement)

agreement that defines parameters and expected tester conduct

- includes scope, assumptions, logistics, communications plan, etc

Offensive Team (Red Team)

emulates the behaviors and techniques of likely attackers

Defensive Team (Blue Team)

team tasked with detective and defensive activities

Integrated Team

- team that engages in monitoring, detections, and response activities during the testing process with a focus on information sharing and cooperation

- acts as a feedback bridge

Physical Penetration Testing

evaluates the effectiveness of an organizations physical security controls

Penetration Testing Phases

1. Reconaissance, Exploitation, Reporting

Passive Reconnaissance

- information gathering using puliclicly available resources

- the target has no knowledge of the activity as there is no interaction with the system

- e.g. search engines, social media, domain registration, DNS reconnaissance, public databases, web scraping, OSINT, AI Chatbots

Active Reconnaissance

- using technical tools to probe and discover information

- may be intrusive and discovers

- e.g Network connections, open ports, enum

Nmap

- active reconnaissance tool

- port scanning and network discovery

Nessus

- active reconnaissance tool

- vulnerability scanning and enumeration

Metagoofil

- active reconnaissance tool

- extract metadata of public documents

Burp Suite

website vulnerability scanning

Compromise Exploitation

process of fully explointing a vulnerability without regard to potential damage

POC Exploitation

providing evidence that a vulnerability is exploitable (e.g. screenshot, log, code)

Pivoting

using a weakness on one system to access a better protected system

Escalation of Privilege

exploiting a vulnerabiliy to gain elevated access to a resource

Persistence

installing or modifying services that will survive reboots (e.g. installing malware, creating backdoors)