System Security Control Testing and Audits

Flashcards testing knowledge of system security control testing, software security control testing, security process data collection, and security audits based on lecture materials.

What administrative and technical aspects are examined during a security assessment?

A security assessment tests both administrative and technical controls, examining the entire security posture including policies, the organization's security culture, and management's attitude towards security.

What are the key risks associated with conducting a security assessment?

Testers might focus only on technical controls while ignoring administrative controls, policy, and culture; testing may disrupt normal operations; resulting data will not be properly interpreted; and recommendations will be ignored or improperly/insufficiently implemented.

What are the advantages and disadvantages of internal security control testing?

Internal testing uses your own personnel and is the least expensive form of testing without risking revealing internal information outside. Disadvantages include blind spots from knowledge of internal systems and potential insufficiency for regulatory requirements.

What is the primary difference between external testing and third-party testing?

External testing involves hiring an outside organization to provide an outsider's perspective and save internal personnel time. Third-party testing is similar but specifically aimed at an audience of a third-party organization, often required for insurance or regulatory issues.

What components are included in administrative assessment test output?

Responses by management and users to security-related questions, a list of existing or non-existing procedures or documentation, recorded observation of user or management activities, and recorded observation of adherence to existing procedures and policies.

What items are included in technical assessment test output?

Current firewall configuration of each system, antivirus patch level of each system, list of known or potential vulnerabilities found on each system, list of default configurations found on each system, list of unused user accounts found on each system, and list of user privilege levels on each resource or system.

When should a vulnerability assessment be performed?

When first deploying new or updated systems, when new vulnerabilities have been identified, when a security breach occurs, and when you need to document the security state of systems.

Which vulnerability scanning tools are specifically identified in the transcript?

Tenable Network Security's Nessus, OpenVAS, Tripwire, Rapid7's Nexpose/Insight, and Qualys VMDR.

What are the disadvantages of automated vulnerability scanning?

False positives and negatives require administrator oversight, it is not as creative as penetration testing (or hackers), and it doesn't always account for more complex attacks.

How does penetration testing differ from a vulnerability assessment?

Penetration testing actively tests and bypasses security controls to exploit vulnerabilities. Compared to vulnerability assessments, it is less common, more intrusive, provides an objective measurement, and combines multiple vulnerabilities to give a holistic understanding.

How do black box, grey box, and white box penetration testing approaches differ?

Black box emulates an outside attacker with no prior target knowledge (requires reconnaissance); grey box emulates an inside attacker with partial knowledge (requires some reconnaissance); white box emulates an inside attacker with extensive knowledge (requires no reconnaissance).

What are the roles of the Red, Blue, and Purple teams in attack exercises?

Red team simulates attacks using attacker tools to identify weaknesses; Blue team is the internal team detecting and mitigating the Red team's simulated attack; Purple team is a collaborative exercise where Red and Blue teams work together to analyze results and improve security.

What are the five steps of the penetration test process?

Reconnaissance, Scanning, Exploitation, Maintaining Access, and Reporting.

What is Breach and Attack Simulation (BAS)?

A pen testing tool that goes beyond traditional vulnerability scanning by employing a Red-team/Blue-team scenario where the Red team initiates attacks and the Blue team uses organizational assets to counter them.

Which activities are commonly logged in system event logs?

Authentication requests (successful and unsuccessful), new user/group creation, group membership changes, user privilege level changes, resource access (opening/changing/deleting files), client requests for server services, transactions per hour, application/service/system shutdowns and restarts, service/system component errors/failures, and system policy changes.

What are synthetic benchmarks and what example programs are listed in the transcript?

Synthetic benchmarks measure system performance under a specific workload to determine capacity and scalability and establish baselines. Example programs include Apache JMeter, Gatling, LoadRunner, and WebLOAD.

What are the common components of a software security test report?

Testing methodology, systems tested, tools used, known gaps in test coverage, vulnerabilities found by category, remediation alternatives, and suggestions for further testing.

What common software vulnerabilities and exploits are listed in the transcript?

Error and exception handling, improper storage of sensitive data, buffer overflow, integer overflow, memory leaks, SQL injection, command injection, session fixation, session prediction, Cross-Site Scripting (XSS: Stored, Reflected, DOM-based), and Cross-Site Request Forgery (XSRF/CSRF).

How do unit, integration, and interface tests differ?

Unit test is a simple pass/no pass test for a small piece of code; Integration test tests individual components together to ensure expected interaction; Interface test is a type of integration test focusing specifically on the interface between two systems or applications.

What is misuse testing in software security?

Also called negative testing or the unhappy path, misuse testing validates input and evaluates how an application handles invalid input, unexpected key combinations, or illegal user activities to identify vulnerabilities without prior expectation of outcome.

How is test coverage defined and calculated?

Test coverage measures how much code is actually tested, calculated as the total number of situations tested divided by the total number of situations.

What is the difference between Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs)?

KPIs measure current process performance and gauge operational effectiveness, whereas KRIs look forward to provide early warnings of potential future issues or security failures.

What four examples of KRIs are listed in the transcript?

System availability trends, how often network timeouts occur, trouble ticket resolution times, and system backup failures.

What four components are part of the security data collection process?

Account Management, Disaster Recovery / Business Continuity Planning (DR/BCP), Backup Verification, and Management Review.

What are the four stages of an audit?

Audit preparation, audit performance, audit reporting, and audit follow-up and closure.

What is the difference between a performance audit and a compliance audit?

A performance audit measures functional or operational efficiency, conformance, and areas for improvement; a compliance audit is a comprehensive review of an organization's adherence to regulatory or corporate requirements.

What are the characteristics of SOC 1, SOC 2, and SOC 3 reports?

SOC 1 reports are limited to controls impacting financial reporting; SOC 2 extends beyond financial interests to evaluate Security, Confidentiality, Processing Integrity, Availability, and Privacy with detailed test results; SOC 3 is a short version of SOC 2 that omits detailed test control descriptions for a general audience.

What are the five Trust Services Principles for SOC 2/3?

Security, Confidentiality, Processing Integrity, Availability, and Privacy.