021 Security Concepts - 021.2 Risk Assessment and Management (weight: 2)

Importance of Information in IT Security

• Security-related information is critical for protecting both the organization and its products.
• Information is sourced from various channels and is essential for planning, testing, hardening, defense, and analysis.
• Action plans and improvements are based on this information, particularly for damage control during attacks.
• Manufacturers and suppliers provide crucial data, but additional information can be obtained either internally or from third parties.

Core Characteristics of Security Vulnerabilities

• Analyzing threats and security vulnerabilities is the starting point for security assessment.
• Vulnerabilities exhibit specific properties that help categorize them.
• Many key terms are predominantly in English and not translated in casual discourse.

Zero-Day Vulnerabilities

• Newly discovered vulnerabilities often lack developed patches and defenses.
• High risk due to the unawareness of target vulnerabilities among those responsible.
• High market value as zero-days are efficient attack vectors.

Remote Execution and Remote Exploitation

• Vulnerabilities that can be exploited over a network without needing system access.
• Systems connected to the Internet and open networks are particularly at risk.

Privilege Escalation

• Vulnerabilities can enable attackers with limited permissions to escalate their access.
• This may lead to bypassing security checks and accessing unauthorized functions and data.

Untargeted Attacks

• Random attacks scan networks for potential targets.
• Malware is sent indiscriminately, allowing a low hit rate to reveal many vulnerable targets.
• Standardized tools facilitate rapid experimental attacks, and attackers accept that detection may occur.

Advanced Persistent Threats (APT)

• Tailored attacks aimed at specific targets, often involving comprehensive pre-attack reconnaissance.
• Designed to infiltrate deeply and remain undetected for extended periods, often by professional adversaries or state-affiliated groups.

Common Vulnerabilities and Exposures (CVE)

• CVE is a database and method for cataloging, identifying, evaluating, and disseminating information about security weaknesses.
• Managed by the American National Cybersecurity Federally Funded Research and Development Center (FFRDC), operated by MITRE Corporation.
• The CVE database can be searched online for specific vulnerabilities.

CVE Identifiers and Scores

• Each vulnerability is assigned a unique CVE ID composed of a prefix "CVE", year, and a numeric identifier (e.g., CVE-2019-1213).
• The Common Vulnerability Scoring System (CVSS) rates vulnerability risks, aiding quick assessments and prioritization of defenses.
• CVSS scores range from 0.0 (None) to 10.0 (Critical), helping gauge the severity of vulnerabilities quickly.

Information Security Management System (ISMS)

• Centralizes the management of security-related information and evaluates risks and damage potential.
• Key functions include identifying risks, assessing their likelihood and potential impact, and determining appropriate countermeasures.
• Documentation of findings is essential and often aligns with quality assurance measures like ISO 27000.

Incident Response Planning

• The Information Security Incident Response Plan outlines actionable steps during a security incident.
• Requires approval from top management and centralizes vital information and contacts.
• Sensitive data within must remain confidential while being accessible to response teams during IT outages.

Computer Emergency Response Team (CERT)

• CERTs, an essential group for managing security incidents and minimizing damage, monitor threat conditions and provide alerts.
• Offer recommendations and posture support in addressing security events.
• Large organizations often establish their CERTs; in Germany, CERT-Bund operates under the Federal Office for Information Security (BSI).

IT Forensics

• Following a security incident, reliable information must be collected to track attack methods and consequences.
• IT forensics encompasses the post-attack analysis of systems using various tools.
• Key investigative questions include the method of attack, affected systems, and whether data integrity was compromised.

Security Assessments

• Regular checks of security measures are crucial, known as "Security Assessments."
• Involves automated tools to identify vulnerabilities, simulating attacks, and monitoring logs for unusual activity.

Penetration Testing

• Pentests assess IT infrastructure security by using hacker methodologies and tools.
• Authorization by the organization being tested is mandatory; often conducted by external providers.
• Goals include identifying security shortfalls and testing the effectiveness of existing defenses, keeping tests low-profile to simulate real conditions.

Legal Framework for Pentesting

• It requires a clear legal framework to define the scope, objectives, and permissible actions.
• Detailed agreements must specify if actions may modify data or impact system availability.

Explore essential information regarding IT security and its implications for organizations. This quiz covers the sources of security-relevant events and the varying information needs across different situations such as planning, testing, and defense. Enhance your understanding of how these insights shape security measures.