Evaluaciones de Seguridad - Capítulo 1

Security Assessments

• This chapter presents strategies for testing, assessing, and auditing.
• Regular assessments of security measures are crucial, as their effectiveness can diminish over time.
• Audit strategies include assessment, testing, and auditing strategies.
• A test records system properties and compares them to standards.
• An assessment is a series of related tests.
• An audit is a thorough evaluation of a system against external standards.
• Security assessments are crucial for maintaining a strong security posture.
• These assessments are critical to improve security posture and address risks in an effective way.
• Assessments should be consistent and comparable through standard methodologies.
• The scope of the assessment should clearly define objectives, including the relevant controls and elements to audit for a given problem or situation.
• Assessments should involve stakeholder approval; this includes financial resources and scheduling.
• Internal and external evaluations are essential for identifying vulnerabilities, assessing risks, and validating controls in place.

Test, Assessment, and Audit Strategies

• Tests record behaviors to determine compliance with predetermined standards.
• Assessments entail a series of planned tests, often related.
• Audits rigorously evaluate a system against external standards.

Designing an Assessment

• Initial step: define the assessment's objective—such as an audit, a security incident, or specific control implementation.
• Scope: determine the specific controls to be evaluated.
• Resources: identify resources needed for the assessment, including personnel, time, and budget.

Validating an Assessment

• Management uses assessment results to prioritize remediation efforts.
• Risk and cost considerations are essential in the prioritization.
• Plans are critical for repeatable and efficient assessments and effective risk mitigation.
• Any changes in the plan should be documented.

Vulnerability Testing

• Manual, automatic, or combined testing is necessary.
• Staff (and/or consultants) experienced in security are required.
• Tools produce output that needs to be correctly interpreted.
• Testing needs to evaluate critically.
• Written agreement from management is a critical requirement for testing.
• Assessment aims to evaluate true security posture.
• Identification of vulnerabilities and prioritized action plans.
• System-specific tests (e.g., software versions, database versions) evaluate current security compliance.

Penetration Testing

• Purpose: evaluate the organization's system's ability to resist attacks.
• Methodologies emulate those used by real attackers, focusing on a variety of targets.
• Testing types vary based on organization, objectives, and desired impact.
• Can evaluate different system components and vulnerabilities, such as web servers, DNS servers, routers, etc.
• Timeframes should be agreed upon to avoid affecting current operations.
• The knowledge of the testing team can vary (zero-knowledge, partial knowledge, full knowledge).

Vulnerability Scanning

• Identify active hosts and services on the network, operating systems, and applications.
• Determine vulnerabilities associated with discovered operating systems and applications.
• Testing compliance with established security policies.
• Foundation for penetration testing.
• Establish a foundation for future security evaluations.

Log Reviews

• Assessing daily operational logs for critical systems and errors may prevent and/or discover security breaches.
• Validates operational compliance to security policy.
• Identifies operational issues and vulnerabilities.
• Enables effective risk mitigation.

Password Cracking

• Verify compliance with password policy.
• Establish effectiveness in producing passwords that are secure.

Integrity Checkers

• Assess for unauthorized modifications, such as unexpected changes to files and data.
• Monitoring for suspicious events.
• Identifies potential vulnerabilities.

Testing Technical Controls

• Testing third-party software and technical controls with systematic steps to ensure that controls will mitigate risks.
• Determining control effectiveness based on the risk analysis to mitigate risk.
• Selecting appropriate means of testing, such as third-party services for software issues.

Compliance Checks

• Evaluations of security controls and their execution in a certain time frame.
• Demonstrates adherence to standards and regulations in an objective way.
• Logs and other documentation are used to validate the checks.
• Demonstrating compliance to regulatory requirements.

Conducting Security Audits

• Length of time: cover longer periods and evaluate compliance with established controls, policies, and standards.
• Scope of audit: define the specific elements and components to audit.
• Validation of controls: ensure that the controls are implemented correctly, and that they are properly functioning.
• Goal-oriented audits that address risk factors.
• Stakeholder communication is fundamental for successful audits.

Facilities Third-Party Audits

• The importance of thorough planning and precise communication between the parties involved in the process.
• Defining clear rules and boundaries to prevent misunderstandings.

Synthetic Transactions

• Useful for testing system responsiveness and performance under user behavior simulations.
• Mimics real user actions (e.g., web page requests, wire transfers).
• Helps in the proactive identification and resolution of problems.

Real User Monitoring (RUM)

• Passive monitoring of user interactions with applications.
• Data from actual users.
• Important because it provides a more accurate representation of user behavior.

Code Reviews

• In-depth examination of code to identify vulnerabilities and security shortcomings.
• Verification against the standards set by the organization (guidelines).
• Detection of defects or issues in the code.
• Improving code quality and security.

Breach Attack Simulations (BAS)

• Automated testing that simulates sophisticated attacks.
• Helps assess an organization's defense capabilities.
• Emulates real attacker behavior and objectives.
• Can include realistic malware and ransomware.

Network Time Protocol (NTP)

• Establishes a standardized time across a network.
• Improves the accuracy of timekeeping and helps to avoid inconsistent timestamp issues between events.
• Important in security incident analysis, and other situations where synchronization is critical.

Preventing Log Tampering

• Crucial to keep log files from malicious modification.
• Log files can be compromised or altered to hide attacks and/or to hide malicious activities.
• Methodologies and best practices to ensure log file integrity and consistency.
• Various methods to prevent successful alteration.