Security ch 7
black box testing
A method of security testing that isn't based directly on knowledge of a program's architecture.
Vulnerability testing
A process of finding the weaknesses in a system and determining which places may be attack points.
Operating system fingerprinting
A reconnaissance technique that enables an attacker to use port mapping to learn which operating system and version is running on a computer.
Stateful matching
A technique of matching network traffic with rules or signatures based on the appearance of the traffic and its relationship to other packets.
Which of the following is known as stateful matching?
A technique of matching network traffic with rules or signatures based on the appearance of the traffic and its relationship to other packets. looks for sequences appearing across several packets in a traffic stream
Penetration testing
A testing method that tries to exploit a weakness in the system to prove that an attacker could successfully penetrate it.
Zone transfer
A unique query of a DNS server that asks it for the contents of its zone.
Covert act
An act carried out in secrecy.
Overt act
An act carried out in the open.
________gives you the opportunity to review your risk-management program and to confirm that the program has correctly identified and reduced (or otherwise addressed) the risks to your organization.
An audit
Anomoly based IDS
An intrusion detection system that compares current activity with stored profiles of normal (expected) activity.
Pattern-(Signature-) based IDS
An intrusion detection system that uses pattern matching and stateful matching to compare current traffic with activity patterns (signatures) of known network intruders.
Real time monitoring
Analysis of activity as it is happening.
Mitigation activities
Any activities designed to reduce the severity of a vulnerability or remove it altogether.
(T/F) The audit itself sets new policies.
False
False negative
Incorrectly identifying abnormal activity as normal.
Which of the following is the definition of false negative?
Incorrectly identifying abnormal activity as normal.
False positive
Incorrectly identifying normal activity as abnormal.
_________ was developed for organizations such as insurance and medical claims processors, telecommunication service providers, managed services providers, and credit card transaction processing companies.
SAS 70
Which of the following is the definition of white-box testing?
Security testing that is based on knowledge of the application’s design and source code.
White box testing
Security testing that is based on knowledge of the application's design and source code.
Gray box testing
Security testing that is based on limited knowledge of an application's design.
Security Information and Event Management (SIEM) system
Software and devices that assist in collecting, storing, and analyzing the contents of log files.
Reconnaissance
The process of gathering information.
Hardened configuration
The state of a computer or device in which you have turned off or disabled unnecessary services and protected the ones that are still running.
Which of the following is the definition of hardened configuration?
The state of a computer or device in which you have turned off or disabled unnecessary services and protected the ones that are still running.
(t/F) An SOC 1 report is commonly implemented for organizations that must comply with Sarbanes-Oxley (SOX) or the Gramm-Leach-Bliley Act (GLBA).
True
Which of the following defines network mapping?
Using tools to determine the layout and services running on an organization’s systems and networks.
Network mapping
Using tools to determine the layout and services running on an organization's systems and networks.
Security audits help ensure that your rules and __________ are up to date, documented, and subject to change control procedures.
configurations
As your organization evolves and as threats mature, it is important to make sure your __________ still meet(s) the risks you face today.
controls
(T/F) An SOC 1 report primarily focuses on internal controls over security.
false
It's essential to match your organization's required __________ with its security structure.
permission level
________ provides information on what is happening as it happens
real time moitoring
Audits also often look at the current configuration of a system as a snapshot in time to verify that it complies with ________.
standards
The primary difference between SOC 2 and SOC 3 reports is ________.
their audience
(T/F) A benchmark is the standard by which a system is compared to determine whether it is securely configured. One technique in an audit is to compare the current setting of a computer or device with a benchmark to help identify differences.
true
(T/F)Auditors often do a substantial amount of work preparing for an audit.
true
Many jurisdictions require audits by law.
true
SAS70 was officially retired in June 2011 and was superseded and enhanced by the Statement of Standards for Attestation Engagements Number 16 (SSAE 16), which is now the predominant auditing and reporting standard for service organizations.
true
SOC 3 reports are intended for public consumption.
true
Tests should be as "real" as possible and therefore should be run against production networks and systems to the degree possible without impairing system operations.
true
Clipping level
A value used in security monitoring that tells controls to ignore activity that falls below a stated value.
If knowing about an audit changes user behavior, an audit will ____________.
not be accurate
(T/F) Network mapping is a technique of matching network traffic with rules or signatures based on the appearance of the traffic and its relationship to other packets.
false
