CompTIA Security + Chapter 5

CompTIA Security + Chapter 5: Security Assessment and Testing

• Cybersecurity professionals are responsible for building, operating, and maintaining security controls to protect against threats.
• Regular security assessments and testing are crucial to ensure controls function properly and identify exploitable vulnerabilities.
• Vulnerability management involves identifying, prioritizing, and remediating vulnerabilities in environments.
• Vulnerability scanning detects new vulnerabilities as they arise, initiating remediation workflows focused on high-priority vulnerabilities.
• Automated techniques identify systems covered by scans. Tools like Qualys and OpenVAS (Linux-based) and Nessus (Windows-based) scanners are used.
• Nessus provides asset inventory and criticality information, guiding scan frequency and prioritization.
• Security professionals use automation for efficient and effective duty performance.
• Administrators schedule scans to meet security, compliance, and business requirements. Scan settings should be evaluated regularly.
• Automated alerting and email reports for new vulnerabilities are significant benefits of scanning tools.
• Organizations' risk appetite determines scan frequency. Regulatory requirements (e.g., PCI DSS, FISMA) may mandate minimum scan frequencies.
• Business constraints (high activity periods) and licensing limitations/bandwidth constraints can limit scan frequency.

Configuring Vulnerability Scans

• Scanners can be customized by administrators to specify checks, target server access credentials, and target server agent installation.
• Regular configuration reviews are important to ensure scanner settings align with current requirements.

Scan Sensitivity Levels

• Scanner checks should be determined to minimize target environment disruption.
• Custom-developed templates can aid in implementing and managing standardized scans.
• Creating templates for reusable configurations simplifies and standardizes the vulnerability scan process.

Nessus Scan Templates

• Nessus provides various templates for vulnerability scanning, including advanced scan configurations, cloud infrastructural audits, detection of malware, and more.

Supplementing Network Scans

• Basic scans offer a distanced view, but other security controls (firewalls, intrusion prevention systems) can influence results.
• Remote scans might yield false positives. Modern vulnerability management supplements these scans with detailed server configuration information.
• Credentialed scans, accessing operating systems, databases, and applications, can improve accuracy.

Credentialed Scanning (Qualys)

• Qualys provides credentialed scanning options for accessing operating systems, databases, and applications.

Scanner Software

• Scanning systems are prone to vulnerabilities.
• Regular updates are essential for scanners to effectively detect and address modern security threats.

Vulnerability Plug-in Feeds

• Security researchers constantly discover new vulnerabilities.
• Scanners need frequent updates to their plug-ins to remain effective against emerging vulnerabilities.
• Administrators regularly update scanners with the latest plugins.

Vulnerability Scanning Tools

• Tenable's Nessus, Qualys, Rapid7's Nexpose, and OpenVAS are important tools for detecting vulnerabilities.
• These tools vary in deployment model (e.g., SaaS, on-premises).

Application Scanning

• Application scanning tools are used for analyzing custom-developed software to identify common security vulnerabilities.
• Static analysis, dynamic analysis, and interactive testing are methodologies used by application scanning tools.

Before Release

• Many organizations integrate testing requirements into the software-release process. Testing is crucial before final system deployment.

Web Application Scanning

• Specialized tools called web application scanners examine web application security.
• These tools test for vulnerabilities such as SQL injection, cross-site scripting, and cross-site request forgery.

Nikto and Arachni Web Application Scanners

• Nikto, an open-source tool, utilizes a command-line interface.
• Arachni is a packaged scanner for multiple operating system platforms.

Reviewing and Interpreting Scan Reports

• Vulnerability scan reports provide detailed information for interpretation.
• Scan reports include vulnerability names, overall severity (low, medium, high, critical), detailed descriptions, solutions, and related output.

CVSS (Common Vulnerability Scoring System)

• CVSS is an industry standard for assessing the severity of vulnerabilities.
• A technique for scoring vulnerabilities based on various metrics. This system is used by security analysts to prioritize actions.

CVSS: Common Vulnerability Scoring System

• Vulnerability scoring begins by evaluating the vulnerability against eight different metrics.
• The first four metrics assess exploitability. The last three metrics evaluate the impact. The final metric examines the scope of the vulnerability.

CVSS: Metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Confidentiality, Integrity, Availability, Scope)

• These factors are used to assess and categorize vulnerability risk.

Calculating CVSS Scores

• Calculating CVSS base scores involves computing impact and exploitability scores. Base scores are calculated by combining impact and exploitability scores, and often multiplied.
• Scores greater than 10 are set to 10; all scores are used in categorization.

Categorizing CVSS Base Scores

• Vulnerability scanning systems often categorize results into qualitative risk categories (like low, medium, high) instead of numerical scores.

False Positives

• Scanners can sometimes report vulnerabilities that do not exist (false positives).
• Careful review of scan results is crucial. Cybersecurity analysts verify vulnerabilities reported.

Reconciling Scan Results with Other Data Sources

• Using logs, SIEM systems, configuration management information to confirm scanning results. Reconciliation helps identify false positives, confirms actual vulnerabilities, and helps prioritize security responses.

Explore the critical aspects of security assessment and testing as outlined in CompTIA Security + Chapter 5. This quiz covers the importance of vulnerability management, scanning techniques, and automation tools that assist cybersecurity professionals in protecting systems. Test your understanding of how security controls function and the methodologies for identifying vulnerabilities in various environments.