Unit 5: Security Assessment and Testing (Part 1)

Chapter 5: Security Assessment and Testing

Page 1: Exam Objectives

  • Domain 4.0: Security Operations

    • 4.3: Vulnerability Management Activities

      • Identification methods:

        • Vulnerability scan

        • Penetration testing

        • Responsible disclosure program

        • Bug bounty program

        • System/process audit

      • Analysis:

        • Confirmation

        • Prioritize

        • Common Vulnerability Scoring System (CVSS)

        • Common Vulnerabilities and Exposures (CVE)

        • Vulnerability classification

        • Exposure factor

        • Environmental variables

        • Industry/organizational impact

        • Risk tolerance

      • Vulnerability response and remediation:

        • Patching

        • Insurance

        • Segmentation

        • Compensating controls

        • Exceptions and exemptions

      • Validation of remediation:

        • Rescanning

        • Audit

        • Verification

      • Reporting

    • 4.4: Security Alerting and Monitoring Concepts and Tools

      • Tools:

        • Security Content Automation Protocol (SCAP)

        • Vulnerability scanners

    • 4.8: Incident Response Activities

      • Threat hunting

Page 2: Overview of Security Assessment and Testing

  • Importance of regular security assessment and testing

  • Focus on vulnerability management, penetration testing, and cybersecurity exercises

  • Regular assessments ensure security controls are effective and vulnerabilities are addressed

Page 3: Vulnerability Management

  • Complexity of technical environments

  • Role of vulnerability management programs:

    • Identify, prioritize, and remediate vulnerabilities

    • Use of vulnerability scanning to detect new vulnerabilities

  • Importance of incorporating vulnerability management into cybersecurity programs

Page 4: Identifying Scan Targets

  • Steps to conduct vulnerability scanning:

    • Identify systems for scanning

    • Consider data classification, exposure, services, and system type

  • Use of automated techniques for asset inventory

Page 5: Determining Scan Frequency

  • Dependence on automation to scan

  • Factors influencing scan frequency:

    • Organizational risk appetite

    • Regulatory requirements

    • Technical and business constraints

  • Importance of balancing considerations for effective scanning

Page 6: Configuring Vulnerability Scans

  • Customization of scan parameters:

    • Scheduling, types of checks, credentials, and perspectives

  • Importance of regular configuration reviews

Page 7: Scan Sensitivity Levels

  • Attention to scan sensitivity settings to minimize disruption

  • Use of templates for efficient scan configuration

Page 8: Improving Scan Efficiency

  • Configuration of specific plug-ins to enhance scan speed and accuracy

  • Management of intrusive plug-ins to avoid disruption

Page 9: Supplementing Network Scans

  • Limitations of basic network scans

  • Use of credentialed scans for improved accuracy

  • Importance of enforcing least privilege for credentialed access

Page 10: Scan Perspective

  • Different perspectives for vulnerability scans:

    • External, internal, and agent-based scans

  • Importance of managing different scanners for consolidated results

Page 11: Scanner Maintenance

  • Regular maintenance of vulnerability scanners

  • Importance of keeping scanning software and vulnerability feeds up-to-date

Page 12: Security Content Automation Protocol (SCAP)

  • Standardized approach for communicating security-related information

  • Key components of SCAP:

    • Common Configuration Enumeration (CCE)

    • Common Platform Enumeration (CPE)

    • Common Vulnerabilities and Exposures (CVE)

    • Common Vulnerability Scoring System (CVSS)

Page 13: Vulnerability Scanning Tools

  • Types of vulnerability scanners:

    • Network, application, and web application scanners

  • Examples of popular tools:

    • Tenable's Nessus, Qualys, Rapid7's Nexpose, OpenVAS

Page 14: Reviewing and Interpreting Scan Reports

  • Importance of detailed vulnerability scan reports

  • Key sections of a scan report:

    • Vulnerability name, severity, description, solution, references, output, risk information

Page 15: Understanding CVSS

  • CVSS as a standard for assessing vulnerability severity

  • Importance of CVSS ratings for prioritizing response actions

Page 16: Confirmation of Scan Results

  • Importance of confirming vulnerabilities reported by scanners

  • Techniques for verifying vulnerabilities

Page 17: Vulnerability Classification

  • Familiarity with common vulnerability types

  • Importance of patch management and addressing outdated software

Page 18: Weak Configurations

  • Common weak configurations identified by scans

  • Importance of addressing default settings, unsecured accounts, and open ports

Page 19: Debug Mode and Insecure Protocols

  • Risks associated with debug modes and insecure protocols

  • Recommendations for disabling debug modes and using secure protocols

Page 20: Weak Encryption

  • Importance of secure encryption practices

  • Risks of using weak encryption algorithms

Page 21: Penetration Testing

  • Purpose and benefits of penetration testing

  • Importance of adopting a hacker mindset

Page 22: Reasons for Penetration Testing

  • Provides visibility into security posture

  • Offers a blueprint for remediation

Page 23: Threat Hunting

  • Distinction between threat hunting and penetration testing

  • Importance of presumption of compromise in threat hunting

Page 24: Penetration Test Types

  • Categories of penetration testing:

    • Physical, offensive, defensive, integrated

  • Classifications of penetration tests:

    • Known, unknown, partially known environments

Page 25: Rules of Engagement

  • Key elements of rules of engagement for penetration testing

  • Importance of clear communication and permissions

Page 26: Reconnaissance

  • Techniques for gathering information about the target

  • Difference between passive and active reconnaissance

Page 27: Running the Test

  • Key phases of penetration testing:

    • Initial access, privilege escalation, pivoting, persistence

Page 28: Cleaning Up

  • Importance of cleaning up after a penetration test

  • Providing a close-out report with findings and recommendations

Page 29: Audits and Assessments

  • Components of a security assessment program:

    • Security tests, assessments, audits

Page 30: Security Tests

  • Importance of regular security testing

  • Factors to consider when scheduling tests

Page 31: Responsible Disclosure Programs

  • Purpose of responsible disclosure programs

  • Benefits of bug bounty programs

Page 32: Security Assessments

  • Comprehensive reviews of security environments

  • Importance of assessment reports for management

Page 33: Security Audits

  • Independent audits for unbiased evaluations

  • Types of audits: internal, external, independent third-party

Page 34: Auditing Standards

  • Importance of standards in audits

  • Common frameworks: COBIT, ISO 27001, ISO 27002

Page 35: Vulnerability Life Cycle

  • Stages of the vulnerability life cycle:

    • Identification, analysis, response, validation, reporting

Page 36: Summary

  • Importance of security assessment and testing in cybersecurity

  • Role of vulnerability scanning and penetration testing in maintaining security posture

Page 37: Exam Essentials

  • Key concepts to remember for the exam:

    • Types of vulnerabilities, false positives,