Risk Management

First Step to Risk Assessment

Identify all potential risks

Potential Risk that Cant Be Checked by Vuln Scan

Untrained end users

Intrusive Test

Actively interacts with the system

Non-Intrusive Testing

Passively identifies vulnerabilities, does not exploit them.

Packet Sniffing

Monitoring and capturing data from a traveling packet moving through a network. Known to be advertised for spying on users.

Password Cracker

Uses methods such as brute-force/rainbow tables.

Honey Pot

A trap system that’s purposely meant to be attacked/exploited by hackers to analyze and collect data from.

WHOIS

A resource to find domain names, IP addresses, etc.

Risk Management

The process of identifying, analyzing, and mitigating (monitoring/responding) threats to a system or digital assets

Race Condition

A situation where the proper sequence of multiple operations is important

System Sprawl

A hasty expansion of systems where the growth exceeds documentation.

Buffer Overflow

A situation where too much data may cause data corruption.

End-Of-Life

Hardware/Software that is no longer being updated or supported by the company. Not a programming error.

Input Handling

A process of securing data processes from users or sources, prevents attack such as SQL injections and XSS (cross-site scripting).

Integer Overflow

Software error where the calculation is way larger than the maximum variable capacity.

Error Handling

Managing errors in code to prevent exploiting from attackers.

Risk Mitigation

Risk response involving taking steps to reduce risk

Risk Transfer

Letting a third-party also handle the responsibility of a risk.

SLE

Single Loss Expectancy

Formula: Asset Value (AV) multiplied by Exposure Factor (EF)

ARO

Annualized Rate of Occurrence

Formula: # of Incidents divided by # of Years

ALE

Annual Loss Expectancy

Formula: Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO)

Risk Acceptance

Understanding the risks and agreeing to live with the consequences.

Three Types of Threats

External, Internal, Natural

Active Reconnaissance

Uses techniques such as port scans, traceroute information, network mapping, Direct & Intrusive

Pivot

A technique used to move through a network by using a compromised system

Passive Reconnaissance

Uses techniques such as social media, news reports, dumpster diving, and company websites, Indirect & Difficult to Detect.

Initial Exploitation

Attacks leveraging vulnerabilities to gain access into a system, drive-by-compromise phishing and brute force are all techniques.

Escalation of Privileges

Technique used to navigate deeper into a network and gain higher level access

Chaos Engineering

An intentional controlled set of failures to understand the impacts and plan better for it. Basically destroying the system for a greater good.

Vulnerability Scan

Automated tools that identify security weaknesses or vulnerabilities