CISSP Prep: Ch 7. Security Assessment and Testing
1 like2,855 views
The document discusses various methods for assessing security controls and testing systems, including penetration testing, social engineering, vulnerability testing, security audits, and software testing methods. It covers topics like penetration testing tools and methodology, assuring data confidentiality, different types of audits and reviews, and levels of software testing from unit to acceptance. Static and dynamic analysis are introduced as approaches to software security testing.
CISSP Prep: Ch 7. Security Assessment and Testing
- 1. CNIT 125: Information Security Professional (CISSP Preparation) Ch 7. Security Assessment and Testing
- 3. Penetration Testing • Authorized white hat hacker breaks into an organization
- 4. Social Engineering • Exploiting the human mind • Often tricks the user into clicking a link • Zero-knowledge (black box) test • No information provided to attacker • Full-knowledge test • Provides pen tester with network diagram, policies and procedures, and sometimes results from previous pen testers • Partial-knowledge test
- 5. Penetration Tester Tools and Methodology • Metasploit (open source) • Core Impact and Immunity Canvas (closed source) • Methodology
- 6. Assuring Confidentiality, Data Integrity, and System Integrity • Pen testers must ensure confidentiality of data they access • Report should be treated as confidential
- 7. Vulnerability Testing • Also called Vulnerability Scanning • Uses a tool like Nessus or OpenVAS • Finds vulnerabilities • Requires manual verification and assessment • Must be matched to real threats to find true risk
- 8. Security Audit • Tests against a public standard • Such as PCI-DSS (Payment Card Industry Data Security Standard)
- 9. Security Assessment • View many controls across multiple domains • Policies and procedures • Administrative controls • Change management • Other tests (pen tests, vuln assessments, security audits)
- 10. Internal and Third Party Audits • Internal audits • Assessing adherence to policy • External audits • Require security professionals to play a role • Response and remediation to audit findings • Demonstrating mitigations
- 11. Log Reviews • Easiest way to verify that access control mechanisms are working
- 12. Centralized Logging • A central repository allows for more scalable security monitoring and intrusion detection • Syslog transmits log data in plaintext over UDP port 514 • Log retention • May be relevant to legal or regulatory compliance
- 14. Software Testing Methoda • Discovering programmer errors • Custom apps don't have a vendor providing security patches • Source code review helps • Two general approaches: • Static and dynamic analysis • Also manual code review • Pair programming is employed in agile programming shops
- 15. Static and Dynamic Testing • Static testing: the code is not running • Review source code for insecure practices, unsafe functions, etc. • Unix program lint • Compiler warnings • Dynamic testing: while code is executing • White box testing: tester has source code • Black box: tester has no internal details
- 16. Traceability Matrix • Maps customer requirements to software testing plan
- 17. Synthetic Transactions • Simulating business activities • Often used for Web apps
- 18. Software Testing Levels • Unit testing • Tests components like functions, procedures, or objects • Installation testing • Tests software as it is installed and first operated • Integration Testing • Testing multiple software components as they are combined into a working system
- 19. Software Testing Levels • Regression testing • Testing softare after updates, modification, or patches • Acceptance testing • Testing to ensure the software meets the customer's requirements • When done by customer, called User Acceptance Testing
- 20. Fuzzing • A type of black box testing • Sends random malformed data into software programs • To find crashes • A type of dynamic testing • Has found many flaws
- 21. Combinatorial Software Testing • Seeks to identify and test all unique combinations of software inputs • Pairwise testing (also called all pairs testing)
- 22. Misuse Case Testing • Formally model an adversary misusing the application • A more formal and commonly recognized way to consider negative security outcomes is threat modeling • Microsoft highlights it in their Security Development Lifecycle (SDL)
- 23. Test Coverage Analysis • Identifies the degree to which code testing applies to the entire application • To ensure that there are no significant gaps
- 24. Analyze and Report Test Outputs • Security test results are easy to produce • Actually improving security is much more difficult • Data must be analyzed to determine what action to take