Section 13: Audit and Assessments

internal vs external audits

internal audits are conducted by the organization’s own team while external is performed by third party entities

internal assessment

in depth analysis to identify and assess potential risks and vulnerabilities in an organization’s IS

Minnesota Counties intergovernmental Trust (MCIT)

created a checklist to help members reduce data and cyber security risks by indentifying and addressing vulnerabilities

cyber-security self-assessment

help organizations identify and strengthen daya security areas internally

• checklist

external assessment

detailed analysis conducted by independent entitites to identify vulnerabilities and risks

types of penetration testing

1. physical

2. offensive

3. defensive

4. integrated

physical pentesting

testing an organizations physical security through testing locks, access cards, security cameras and other protective measures

offensive pentesting (red teaming)

actively seeks vulnerabilities and attempts to exploit them. models a real cyber attack

defensive pentesting (blue teaming)

reactive apprach focused on strengthening systems, detecting and responding to attacks

• monitors for unusual activity and improved incident response times

integrated pentesting (purple teaming)

combination of offensive and defensive pentesting

• red + blue = purple teaming

reconnaissance

an initial phase where critical information about a target system is gathered to enhance an attack’s effectiveness and success

active reconnaissance

direct engagement with the target system, offering more infomation but with a higher detection risk

passive reconnaissance

gathering information without direct engagement with the target system, offering lower detection risk but less data

known environment

detailed target infrastructure information from the organization is received prior to the pentest

• may not need to conduct reconnaissance

partially known environment

involves limited information provided to testers, who may have partial knowledge of the system

• pentest uncovers hidden or forgotten assets that might be vulnerable

unknown environment

testers receive minimal to no information about the target system

• aims to micmic an external attacker with limited knowledge

metasploit

multi-purpose computer security and penetration testing framework that encompasses a wide array of powerful tools, enabling the execution of pentests

attestation

process that involves the formal validation or confirmation provided by an entity that is used to assert the accuracy and authenticity of specific information

types of attestation

• software

• hardware

• system

software attestation

validating the integrity of software by checking that it hasnt been tampered with or altered maliciously

hardware attestation

validating the integrity of hardware components

system attestation

validating the security posture of a system