Security Risk Management Chapter 4
116 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary goal of a threat assessment?

  • To assess historical risks
  • To identify and evaluate potential threats (correct)
  • To review system documentation
  • To perform vulnerability scans

Threat assessments are performed indefinitely over time.

False (B)

What are the three impacts that threats can have on information systems?

Confidentiality, Integrity, Availability

A threat assessment evaluates the _____ of a threat's frequency.

<p>estimate</p> Signup and view all the answers

Which technique helps ensure that data is not modified or destroyed?

<p>Hashing (B)</p> Signup and view all the answers

Match the following terms with their definitions:

<p>Threat = An activity that represents a possible danger Vulnerability = A weakness that can be exploited Exploit = The act of taking advantage of a vulnerability Risk = The potential for loss or damage when a threat exploits a vulnerability</p> Signup and view all the answers

The success of a vulnerability assessment often relies on reviewing system logs and _____ trails.

<p>audit</p> Signup and view all the answers

What is the primary function of an Intrusion Detection System (IDS)?

<p>To send alerts when intrusions are detected (D)</p> Signup and view all the answers

A host-based IDS is installed on multiple systems throughout a network.

<p>False (B)</p> Signup and view all the answers

What information is recorded when auditing is enabled on a folder?

<p>User name, accessed file, time of access, server or computer used.</p> Signup and view all the answers

An automated system has the capability of examining logs from multiple __________.

<p>sources</p> Signup and view all the answers

Match the following agents with their functions in a network-based IDS:

<p>Agent 1 = Identifies attacks from the Internet Agent 2 = Reports attacks that get through the external firewall Agent 3 = Monitors attacks through the second firewall of the DMZ</p> Signup and view all the answers

What is a primary purpose of implementing fault tolerance strategies?

<p>To ensure systems continue to operate during an outage (A)</p> Signup and view all the answers

Natural threats are primarily caused by human actions.

<p>False (B)</p> Signup and view all the answers

Name one common threat from internal sources.

<p>Unintentional access</p> Signup and view all the answers

A disgruntled employee could cause __________ to data if their access is not properly controlled.

<p>corruption</p> Signup and view all the answers

Match the following threats to their categories:

<p>Phishing = Human threat - Unintentional Flood = Natural threat Unauthorized access = Human threat - Intentional Earthquake = Natural threat</p> Signup and view all the answers

Which of the following events is categorized as a natural threat?

<p>Tornado (B)</p> Signup and view all the answers

Accidental access to data by employees poses no risk to organizations.

<p>False (B)</p> Signup and view all the answers

What should be done with a terminated employee’s user account?

<p>It should be deleted or disabled.</p> Signup and view all the answers

External attackers can include __________ trying to launch denial of service attacks.

<p>hackers</p> Signup and view all the answers

How frequently are automated vulnerability scans typically performed?

<p>Weekly (B)</p> Signup and view all the answers

Internal vulnerability assessments are conducted by personnel outside the company.

<p>False (B)</p> Signup and view all the answers

What type of assessment is typically conducted on an annual basis to evaluate security controls?

<p>Audit</p> Signup and view all the answers

A successful __________ attack may indicate that the system is not being updated often enough.

<p>buffer overflow</p> Signup and view all the answers

Match the type of assessment with its description:

<p>Internal assessments = Conducted by in-house security personnel External assessments = Performed by outside consultants Audit = Annual evaluation of security controls Vulnerability scans = Automated checks for security weaknesses</p> Signup and view all the answers

Which of the following is NOT a source for documentation review during a vulnerability assessment?

<p>User satisfaction surveys (B)</p> Signup and view all the answers

External personnel are usually less effective at quickly identifying security weaknesses than in-house staff.

<p>False (B)</p> Signup and view all the answers

What practice is used to improve the effectiveness of vulnerability assessments?

<p>Reviewing past assessment reports</p> Signup and view all the answers

The process of evaluating security controls includes documenting incidents and __________ reports.

<p>outage</p> Signup and view all the answers

What is one of the steps taken during a vulnerability assessment?

<p>Documentation review (C)</p> Signup and view all the answers

Which of the following is NOT one of the seven domains of a typical IT infrastructure?

<p>Physical Domain (B)</p> Signup and view all the answers

Threat modeling requires understanding both hardware and software failures in a system.

<p>True (A)</p> Signup and view all the answers

What is the first step in performing threat modeling?

<p>Identify the assets you want to evaluate.</p> Signup and view all the answers

The seven domains of a typical IT infrastructure include the User Domain, __________ Domain, LAN Domain, and System/Application Domain.

<p>Workstation</p> Signup and view all the answers

Match the following domains with their descriptions:

<p>User Domain = Where end-users interact with systems LAN Domain = Local area network environments WAN Domain = Wide area network connectivity Remote Access Domain = Access from external locations</p> Signup and view all the answers

What is one best practice when evaluating threats across the seven domains?

<p>Verify that systems operate as expected (D)</p> Signup and view all the answers

Internal users cannot misuse a system.

<p>False (B)</p> Signup and view all the answers

Name one question to ask when performing threat modeling.

<p>Is the system susceptible to attacks?</p> Signup and view all the answers

Understanding data ______ is essential to perform effective threat assessments.

<p>flow</p> Signup and view all the answers

Which of the following best describes asset management?

<p>Identifying and evaluating important assets within an organization (B)</p> Signup and view all the answers

Signup and view all the answers

What is the main issue caused by scope creep in software development?

<p>Increased functionality without planning (A)</p> Signup and view all the answers

Access controls testing verifies that users have more permissions than they need for their jobs.

<p>False (B)</p> Signup and view all the answers

What is a 'right' in the context of access controls?

<p>A right grants the authority to perform an action on a system.</p> Signup and view all the answers

Scope creep refers to the addition of functionalities that are outside the scope of the original __________ specifications.

<p>product</p> Signup and view all the answers

What is spear-phishing?

<p>Targeted phishing attempts from within a company (C)</p> Signup and view all the answers

Threat modeling is a straightforward process that requires minimal effort.

<p>False (B)</p> Signup and view all the answers

What are two techniques for identifying threats?

<p>Review historical data and perform threat modeling.</p> Signup and view all the answers

A lack of physical control over laptops often leads to ______ of hardware and compromised data.

<p>theft</p> Signup and view all the answers

Match each type of threat with its description:

<p>Forwarding viruses = Infected emails being shared unknowingly Spear-phishing = Targeted email deception from known individuals Lack of laptop control = Risk of theft and data compromise Historical data review = Analyzing past incidents to identify threats</p> Signup and view all the answers

What is the final step in a threat assessment?

<p>Providing a report of findings (A)</p> Signup and view all the answers

What does a threat assessment report typically include?

<p>Findings, threats, likelihood, and identified costs.</p> Signup and view all the answers

Threat modeling requires understanding the flow of data in and out of systems.

<p>True (A)</p> Signup and view all the answers

The seven domains of typical IT infrastructure include User Domain, Workstation Domain, LAN Domain, and __________ Domain.

<p>WAN</p> Signup and view all the answers

Which of the following is a key question to ask when performing threat modeling?

<p>What system are you trying to protect? (D)</p> Signup and view all the answers

Internal users are exempt from misusing the system.

<p>False (B)</p> Signup and view all the answers

What is the primary purpose of asset management in threat modeling?

<p>To identify and evaluate important assets.</p> Signup and view all the answers

Understanding how __________ flows in and out of systems is crucial for threat assessment.

<p>data</p> Signup and view all the answers

What is the purpose of an audit in an organization?

<p>To determine if policies are being followed (B)</p> Signup and view all the answers

A policy should not disable user accounts when an employee leaves an organization.

<p>False (B)</p> Signup and view all the answers

What should be done with user accounts that have not been used for six months?

<p>Accounts should be deleted.</p> Signup and view all the answers

The ______ analysis examines the output to determine if a vulnerability exists.

<p>output</p> Signup and view all the answers

Match the following analysis types with their descriptions:

<p>Process Analysis = Evaluates processes used to determine output Output Analysis = Examines the resulting output for vulnerabilities</p> Signup and view all the answers

What tool can assist an auditor in determining enabled accounts not used recently?

<p>Script (B)</p> Signup and view all the answers

Personnel interviews can help assess the security knowledge of employees.

<p>True (A)</p> Signup and view all the answers

When is it acceptable to give out passwords according to a secure organization policy?

<p>Never.</p> Signup and view all the answers

An audit may include checking for user accounts that haven't been used in the past ______ days.

<p>15</p> Signup and view all the answers

What is one method for determining the effectiveness of a firewall?

<p>Using process or output analysis (B)</p> Signup and view all the answers

What is the primary purpose of system logs in computer systems?

<p>To log data based on system activities (D)</p> Signup and view all the answers

Audit trails only log successful user activities.

<p>False (B)</p> Signup and view all the answers

Name one type of event that system logs can record.

<p>Warnings</p> Signup and view all the answers

An audit trail attempts to log at least who, what, when, and _____ of events.

<p>where</p> Signup and view all the answers

Which event would likely stand out immediately when reviewing system logs?

<p>An error event (D)</p> Signup and view all the answers

Automated systems can only review a single source of audit trails at a time.

<p>False (B)</p> Signup and view all the answers

What is a key element that an audit log typically captures when auditing is enabled?

<p>User name</p> Signup and view all the answers

The _____ is used in Microsoft Windows to view system events.

<p>Windows Event Viewer</p> Signup and view all the answers

Match the type of log with its function:

<p>System log = Captures system start and stop events Security log = Records access attempts Network log = Tracks data transfer activities Application log = Monitors application-specific events</p> Signup and view all the answers

Which of the following threats are categorized as human threats?

<p>Hacking attempts (D)</p> Signup and view all the answers

Name one reason why disgruntled employees can pose a threat to data security.

<p>They may access, modify, or corrupt the organization’s data.</p> Signup and view all the answers

Employees can accidentally delete data if they have __________ access to information they do not need.

<p>unintentional</p> Signup and view all the answers

Match the following types of threats with their descriptions:

<p>Internal threats = Include actions from employees that may be accidental or malicious Natural threats = Result from weather events such as floods and earthquakes External threats = Origin from outside the organization, like hackers or malware Accidental threats = Caused by unintentional actions of users</p> Signup and view all the answers

Which of the following is a proactive measure to mitigate internal threats?

<p>Employee training and access control implementation (D)</p> Signup and view all the answers

What should happen to an employee's user account after termination?

<p>It should be deleted or disabled.</p> Signup and view all the answers

What type of Intrusion Detection System (IDS) is installed on a single system?

<p>Host-based IDS (B)</p> Signup and view all the answers

An intrusion detection system can only monitor and cannot alert users.

<p>False (B)</p> Signup and view all the answers

What information is included in an audit trail when file access is recorded?

<p>user name, accessed file, time of access, and server or computer</p> Signup and view all the answers

A network-based IDS has several monitoring agents installed throughout the __________.

<p>network</p> Signup and view all the answers

Match the agents in a network-based IDS with their respective functions:

<p>Agent 1 = Identifies attacks launched from the Internet Agent 2 = Detects successful attacks that penetrate the external firewall Agent 3 = Shows attacks that manage to pass through the DMZ's second firewall</p> Signup and view all the answers

What is the primary focus of a vulnerability assessment?

<p>Identifying existing vulnerabilities (D)</p> Signup and view all the answers

Internal human threats pose no risk to data integrity.

<p>False (B)</p> Signup and view all the answers

What principle ensures that users have only the access they need to perform their job?

<p>Principle of least privilege</p> Signup and view all the answers

Failure to implement access controls can make an entire network vulnerable, leading to unauthorized ______ of data.

<p>disclosure</p> Signup and view all the answers

Match the type of threat with its example:

<p>Natural Threat = Earthquake causing data center damage Internal Human Threat = Disgruntled employee leaking information External Human Threat = Hacker attempting to breach network Natural Disaster = Flood impacting physical infrastructure</p> Signup and view all the answers

Which of the following describes social engineering in the context of security vulnerabilities?

<p>Manipulating individuals to reveal confidential information (A)</p> Signup and view all the answers

A buffer overflow attack can be reported as an internal human threat.

<p>False (B)</p> Signup and view all the answers

What is one method to minimize human-related vulnerabilities?

<p>User training and awareness</p> Signup and view all the answers

A ______ is a process conducted to evaluate the effectiveness of an organization's security controls.

<p>vulnerability assessment</p> Signup and view all the answers

All users having the same rights and permissions for a network enhances security.

<p>False (B)</p> Signup and view all the answers

Understanding how data flows in and out of systems is essential for effective threat assessments.

<p>True (A)</p> Signup and view all the answers

List one of the seven domains of a typical IT infrastructure.

<p>User Domain</p> Signup and view all the answers

When performing threat assessments, it’s important to understand the system or application you’re ______.

<p>evaluating</p> Signup and view all the answers

Match the following best practices to their descriptions:

<p>Verify system operations = Ensure the system is functioning as intended Limit the scope of assessment = Focus on one domain at a time Interview experts = Gain insights from knowledgeable individuals Review documentation = Understand system configuration and data flow</p> Signup and view all the answers

Who could be potential adversaries when performing threat modeling?

<p>Both internal and external parties (B)</p> Signup and view all the answers

A successful threat assessment does not require an understanding of hardware or software failures.

<p>False (B)</p> Signup and view all the answers

An excellent starting point for threat modeling is to use the _____ of a typical IT infrastructure.

<p>seven domains</p> Signup and view all the answers

What is one key question to ask when performing threat modeling?

<p>Is the system susceptible to attacks?</p> Signup and view all the answers

An audit trail can only be recorded in security logs.

<p>False (B)</p> Signup and view all the answers

What information does an automated system have the capability of examining in audit trails?

<p>Logs from multiple sources</p> Signup and view all the answers

Windows systems use the Event Viewer to view the _____ log.

<p>System</p> Signup and view all the answers

Match the following types of logs with their functions:

<p>System Log = Records system events such as errors and warnings Security Log = Tracks auditable events like user access Firewall Log = Monitors network traffic and access attempts Application Log = Logs application-specific events and errors</p> Signup and view all the answers

What type of information is typically recorded in an audit log?

<p>Who accessed what, when, and where (B)</p> Signup and view all the answers

System logs are primarily concerned with monitoring user behavior.

<p>False (B)</p> Signup and view all the answers

What is one advantage of using automated systems for reviewing audit trails?

<p>Efficiency in analyzing multiple logs</p> Signup and view all the answers

An audit trail attempts to log at least _____ elements: who, what, when, and where.

<p>four</p> Signup and view all the answers

Which of the following statements about audit trails is true?

<p>They can help identify unauthorized access to data. (B)</p> Signup and view all the answers

Flashcards

What is a threat assessment?

A threat assessment identifies and evaluates potential threats. The goal is to identify as many threats as possible, evaluate their frequency, and assess the potential impact.

When is a threat assessment performed?

A threat assessment is performed for a specific time, evaluating current threats within the existing environment.

What is a threat?

A threat is any activity that represents a possible danger to confidentiality, integrity, or availability of data or systems.

How does a threat impact confidentiality?

Confidentiality refers to unauthorized disclosure of data. Techniques like access controls and encryption help protect confidentiality.

Signup and view all the flashcards

How does a threat impact integrity?

Integrity refers to modification or destruction of data. Access controls and hashing techniques help protect integrity.

Signup and view all the flashcards

How does a threat impact availability?

System availability refers to the ability to access services or systems. Threats can disrupt availability, making systems inaccessible.

Signup and view all the flashcards

How do access controls and encryption protect confidentiality?

Access controls limit who can access data, while encryption scrambles data to make it unreadable without a key. Both help protect confidentiality.

Signup and view all the flashcards

Auditable Event

Any event that you want to track, such as a file access or a login attempt. It usually records information about the user, the action performed, and the time and location of the event.

Signup and view all the flashcards

Intrusion Detection System (IDS)

A system that monitors network traffic for suspicious activity and alerts administrators when a potential intrusion is detected.

Signup and view all the flashcards

Host-Based IDS

An IDS that is installed on a single computer. It protects that specific system from attacks.

Signup and view all the flashcards

Network-Based IDS

An IDS that is installed across an entire network. It has agents deployed at various points to cover wider areas.

Signup and view all the flashcards

Demilitarized Zone (DMZ)

A monitored area that is exposed to the internet, typically used for web servers and external applications.

Signup and view all the flashcards

Fault tolerance strategies

Strategies that ensure systems and services keep running even if a part fails.

Signup and view all the flashcards

Data backup

Creating copies of data to restore it if it gets lost or damaged.

Signup and view all the flashcards

Threat assessment.

Assessing potential threats to an organization, classifying them as human or natural, and analyzing their impact.

Signup and view all the flashcards

Human threats

Threats caused by individuals, either intentionally or unintentionally.

Signup and view all the flashcards

Natural threats

Threats originating from natural events, like storms, earthquakes, or fires.

Signup and view all the flashcards

Internal threats

Employees who intentionally or unintentionally cause harm to their organization.

Signup and view all the flashcards

Disgruntled ex-employees

Employees who leave their jobs and may pose a risk to the organization's security.

Signup and view all the flashcards

Denial of service (DoS) attacks

Attacks designed to overwhelm a network with traffic and make it unavailable.

Signup and view all the flashcards

Malware

Malicious software designed to gain unauthorized access, modify or corrupt data, or cause harm to systems.

Signup and view all the flashcards

Threat Modeling

The process of identifying, analyzing, and mitigating potential threats to valuable assets within an organization's IT infrastructure.

Signup and view all the flashcards

Assets

Items crucial to an organization's operations, including data, systems, and applications.

Signup and view all the flashcards

Seven Domains of a Typical IT Infrastructure

The seven primary divisions of a typical IT infrastructure, used to guide threat modeling assessments by covering all potential attack vectors.

Signup and view all the flashcards

User Domain

The domain encompassing users, their workstations, and the local network.

Signup and view all the flashcards

LAN Domain

The domain encompassing the network connecting workstations and servers within a single location.

Signup and view all the flashcards

LAN-to-WAN Domain

The domain encompassing the connection between a local network and a larger external network, often the internet.

Signup and view all the flashcards

WAN Domain

The domain encompassing the network connecting computers and systems across geographically dispersed locations.

Signup and view all the flashcards

System/Application Domain

The domain encompassing systems and applications that run on servers and other network devices.

Signup and view all the flashcards

Remote Access Domain

The domain encompassing the mechanisms by which users remotely access the organization's network.

Signup and view all the flashcards

Automated Vulnerability Scans

Regularly checking systems for weaknesses using automated tools.

Signup and view all the flashcards

Security Audits

A formal examination of security controls to ensure they are working as intended.

Signup and view all the flashcards

Social Engineering Tests

Tests designed to evaluate how well personnel respond to social engineering attempts.

Signup and view all the flashcards

Internal Vulnerability Assessments

Vulnerability assessments performed by internal security professionals within the organization.

Signup and view all the flashcards

External Vulnerability Assessments

Vulnerability assessments conducted by external security consultants hired by the organization.

Signup and view all the flashcards

Documentation Review in VA

Examining existing documentation to identify potential vulnerabilities, such as incident reports, outage reports and prior assessment reports.

Signup and view all the flashcards

Log Analysis in VA

Analyzing system logs, audit trails, and intrusion detection system outputs to find patterns and potential vulnerabilities.

Signup and view all the flashcards

Vulnerability Scanning in VA

Using security assessment tools to actively scan systems for vulnerabilities and identify potential weaknesses.

Signup and view all the flashcards

Audits and Personnel Interviews in VA

Formal assessments of security controls using interviews and questionnaires to see if policies are being followed.

Signup and view all the flashcards

Process Analysis in VA

Analyzing how processes and workflows are executed to identify potential vulnerabilities and improve security measures.

Signup and view all the flashcards

Spear-phishing

A targeted phishing attempt that appears to originate from a legitimate source within the company.

Signup and view all the flashcards

Reviewing Historical Data

Examining past incidents and security breaches to identify recurring patterns and vulnerabilities.

Signup and view all the flashcards

Threat Assessment Report

A report summarizing the findings of a threat assessment, including identified threats, their likelihood, and potential costs.

Signup and view all the flashcards

What is Threat Modeling?

The process of identifying, analyzing, and mitigating potential threats to valuable assets within an organization's IT infrastructure.

Signup and view all the flashcards

What are the Seven Domains of IT Infrastructure?

The seven primary divisions of a typical IT infrastructure, used to guide threat modeling assessments by covering all potential attack vectors.

Signup and view all the flashcards

What is Asset Management in Threat Modeling?

Identifying critical assets that are important to an organization, including their value. This helps prioritize security efforts.

Signup and view all the flashcards

What are the Key Questions for Performing Threat Modeling?

Asking questions to understand and analyze potential threats. This involves identifying the system, potential attackers, attack methods, and user vulnerabilities.

Signup and view all the flashcards

What are Best Practices for Threat Assessments Within the Seven Domains?

Verifying that systems operate as intended and limiting the scope of the assessment to a single domain at a time. This makes the process manageable and efficient.

Signup and view all the flashcards

What is the User Domain?

The domain encompassing users, their workstations, and the local network. This includes threats related to user behavior, device vulnerabilities, and local network security.

Signup and view all the flashcards

What is the LAN Domain?

The domain encompassing the network connecting workstations and servers within a single location. This involves threats related to network devices, access control, and data integrity.

Signup and view all the flashcards

What is the LAN-to-WAN Domain?

The domain encompassing the connection between a local network and a larger external network, often the internet. This involves threats related to firewalls, network security, and external access.

Signup and view all the flashcards

What is the WAN Domain?

The domain encompassing the network connecting computers and systems across geographically dispersed locations. This involves threats related to network security, communication protocols, and secure data transmission.

Signup and view all the flashcards

What are system logs?

System logs are records of activities happening on a computer system, such as program start-up, errors, and warnings.

Signup and view all the flashcards

What are audit trails?

Audit trails are records of specific and usually security-related events, often answering who, what, when, and where.

Signup and view all the flashcards

What is an Intrusion Detection System (IDS)?

An Intrusion Detection System (IDS) monitors network traffic for suspicious activities and alerts administrators when a potential threat is detected.

Signup and view all the flashcards

Why are system logs, audit trails, and IDS reports important?

System logs, audit trails, and IDS reports all provide valuable information about system events and potential security vulnerabilities.

Signup and view all the flashcards

What is the 'System' log in Windows?

Microsoft Windows systems have a log called 'System' that records system events like start-ups, shutdowns, errors, and warnings.

Signup and view all the flashcards

What are audit logs used for?

Audit logs record events that you want to track, such as file accesses, user logins, and system modifications. They help identify who did what, when, and where.

Signup and view all the flashcards

What are IDS outputs?

Intrusion Detection System (IDS) outputs provide detailed information about potential intrusions and suspicious network traffic.

Signup and view all the flashcards

How are system logs, audit trails, and IDS outputs used?

Organizations often use automated systems to analyze system logs, audit trails, and IDS outputs, searching for patterns and anomalies that indicate potential problems.

Signup and view all the flashcards

What can you find by reviewing logs, audit trails, and IDS outputs?

Reviewing logs, audit trails, and IDS outputs helps to identify potential problems, trends, and patterns of suspicious activities.

Signup and view all the flashcards

How can analyzing log data help improve security?

Analyzing reports from these systems can help identify vulnerabilities and potential threats, allowing you to improve your security posture.

Signup and view all the flashcards

Functionality Testing

Functionality testing ensures that a software product meets its intended functions and specifications. It helps prevent scope creep, where unintended features are added, potentially causing security risks.

Signup and view all the flashcards

Access Controls Testing

Access controls testing verifies user rights and permissions, making sure users can only access resources they need for their job. It aligns with the security principles of least privilege and need to know.

Signup and view all the flashcards

Scope Creep

Scope creep is where additional features are added to a project outside the pre-defined specifications. It can lead to security risks as these additional features weren't initially designed or tested.

Signup and view all the flashcards

Rights vs. Permissions

A "right" allows a user to perform a specific action within a system, while a "permission" grants access to resources like files or printers.

Signup and view all the flashcards

Administrative Models

Administrative models define the rights and permissions users are granted based on their roles. This ensures that users have appropriate access for their jobs but no more.

Signup and view all the flashcards

What is a security audit?

An audit checks if an organization follows its own security policies. This can involve verifying things like account disablement after employee departure or checking for inactive accounts.

Signup and view all the flashcards

What's the difference between process analysis and output analysis in security?

Process analysis focuses on how security controls are implemented, examining the steps involved in a process. Output analysis, on the other hand, looks at the results of the process to see if it's working effectively.

Signup and view all the flashcards

Explain process and output analysis with a firewall example.

Process analysis examines the rules and steps used to implement a security control, providing a detailed understanding of how it works. Output analysis focuses on the results, such as logs and firewall activity, to determine if the desired security outcome is achieved.

Signup and view all the flashcards

How can scripting be used in security audits?

Security audits can be automated using scripts, which check for specific security conditions. For example, finding accounts that haven't been used for a long time, which may indicate a security risk.

Signup and view all the flashcards

What are personnel interviews used for in security assessments?

Personnel interviews can be used to assess security awareness among employees by asking questions related to password security and other best practices.

Signup and view all the flashcards

What is a common password security policy?

A secure organization will have a policy in place prohibiting employees from sharing their passwords with anyone.

Signup and view all the flashcards

What are vulnerability scans and why are they important?

Vulnerability scans are automated tools that help identify potential security weaknesses in systems and networks. These scans look for common vulnerabilities and misconfigurations.

Signup and view all the flashcards

What is the purpose of a security audit?

Security audits are formal examinations of an organization's security controls to ensure they are working as intended. These audits involve reviewing policies, procedures, and technologies.

Signup and view all the flashcards

Why is process analysis sometimes preferred over output analysis?

Process analysis is particularly useful in identifying vulnerabilities that may not be immediately visible by looking only at output. It allows for a deeper understanding of how processes could be exploited.

Signup and view all the flashcards

When should process analysis and output analysis be used?

Both process and output analysis are valuable tools for assessing security controls. The choice between them depends on the specific security objective and the nature of the system being analyzed.

Signup and view all the flashcards

What are internal threats?

Internal threats involve employees who intentionally or unintentionally cause harm to their organization, such as disgruntled ex-employees or employees with insufficient access controls.

Signup and view all the flashcards

What are external threats?

External threats involve attackers outside the organization, including hackers launching denial-of-service (DoS) attacks, malware writers targeting data, and even terrorists.

Signup and view all the flashcards

What are natural threats?

Natural threats are caused by weather events or other non-manmade events, such as floods, earthquakes, tornadoes, fires, and electrical storms.

Signup and view all the flashcards

Why are disgruntled ex-employees a threat?

Disgruntled ex-employees pose a significant security threat as they may have former access to sensitive data and systems and can misuse their credentials or pass them on to others.

Signup and view all the flashcards

What are access controls, and why are they important?

Access controls are essential to prevent unauthorized access to data. They create rules determining who can access what information based on their role and need-to-know.

Signup and view all the flashcards

What are the principles of least-privilege and need-to-know?

Least-privilege and need-to-know principles are essential security practices. Least privilege minimizes access, only granting users the permissions necessary for their job, while need-to-know restricts access to only the data required for a user’s role.

Signup and view all the flashcards

Why is asset management important in threat modeling?

Asset management in threat modeling involves identifying critical assets that are important to an organization, including their value. This helps prioritize security efforts.

Signup and view all the flashcards

What key questions should you ask when performing threat modeling?

Threat modeling relies on understanding the system you are trying to protect, potential attackers, their attack methods, user vulnerabilities, and the system's susceptibility to failures. By asking key questions, you can better identify and analyze potential threats.

Signup and view all the flashcards

What are some best practices for threat assessments within the Seven Domains?

Some best practices for threat assessments within the seven domains include verifying that systems operate as expected and limiting the scope of the assessment to a single domain at a time. This makes the process manageable and efficient.

Signup and view all the flashcards

What is the User Domain in IT Infrastructure?

The User Domain encompasses users, their workstations, and the local network, including threats related to user behavior, device vulnerabilities, and local network security.

Signup and view all the flashcards

What is the LAN Domain in IT Infrastructure?

The LAN Domain comprises the network connecting workstations and servers within a single location, involving threats related to network devices, access control, and data integrity.

Signup and view all the flashcards

What is the LAN-to-WAN Domain in IT Infrastructure?

The LAN-to-WAN Domain connects a local network to a larger external network, often the internet. This involves threats related to firewalls, securing external access, and maintaining network integrity.

Signup and view all the flashcards

What is the WAN Domain in IT Infrastructure?

The WAN Domain handles the connection between computers and systems across geographically diverse locations. It involves threats related to network security, communication protocols, and ensuring secure data transmission.

Signup and view all the flashcards

What is a vulnerability assessment?

A vulnerability assessment (VA) is a process of identifying any weaknesses in an organization's IT infrastructure, including servers, networks, and personnel.

Signup and view all the flashcards

What is a buffer overflow attack?

A buffer overflow attack happens when data exceeding the allocated memory space of a program is entered, potentially allowing malicious code execution.

Signup and view all the flashcards

What are access controls?

Access controls are rules that limit user access to specific resources based on their role or permissions.

Signup and view all the flashcards

What is the principle of least privilege?

The principle of least privilege means that users should only have access to the information and resources they need for their job, and no more.

Signup and view all the flashcards

What is social engineering?

Social engineering is a technique used by attackers to manipulate people into revealing sensitive information or performing actions that compromise security.

Signup and view all the flashcards

Who or what can be assessed in a vulnerability assessment?

A vulnerability assessment can be performed for a single server, an entire network, or even personnel, as vulnerabilities can exist in various aspects of IT systems and human processes.

Signup and view all the flashcards

What is the 'need to know' principle?

A 'need to know' principle means that users should only have access to information that is directly relevant to their work.

Signup and view all the flashcards

What are administrative models?

Administrative models are structures that define user roles and permissions, ensuring that users have the appropriate access for their job function.

Signup and view all the flashcards

How can personnel be vulnerable?

Vulnerabilities exist with personnel if they are not aware of security practices or are susceptible to social engineering tactics.

Signup and view all the flashcards

Why are vulnerability assessments performed?

Vulnerability assessments are performed to identify any potential weaknesses within an IT infrastructure, such as buffer overflows, improper access controls, or lack of security awareness among personnel.

Signup and view all the flashcards

What are auditable events?

Auditable events are actions within a system that are recorded and tracked for security purposes. This includes activities like file access, login attempts, and system changes.

Signup and view all the flashcards

What does an Intrusion Detection System (IDS) do?

An intrusion detection system (IDS) actively monitors network traffic and system activity for malicious patterns. When a potential threat is detected, the IDS alerts administrators.

Signup and view all the flashcards

What's the difference between a Host-Based IDS and a Network-Based IDS?

Host-based IDS is installed directly on a single device, protecting that specific computer from attacks. Network-based IDS, on the other hand, has agents deployed across a network to monitor a wider area.

Signup and view all the flashcards

What is a Demilitarized Zone (DMZ) in network security?

A demilitarized zone (DMZ) acts as a buffer zone between the public internet and a private network. It's used to house servers that need to be accessible externally, like web servers, while still protecting the internal network.

Signup and view all the flashcards

Why is analyzing intrusion detection system (IDS) outputs important?

By analyzing IDS outputs, administrators gain valuable insights into the nature of attacks against the network. They can see what types of attacks are being launched, how effective the defenses are, and what vulnerabilities exist.

Signup and view all the flashcards

What is functionality testing?

Functionality testing ensures that a software product meets its intended functions and specifications. It helps prevent scope creep, where unintended features are added, potentially causing security risks.

Signup and view all the flashcards

Study Notes

Security Risk Management and Ethics

  • Chapter Four focuses on identifying and analyzing threats, vulnerabilities, and exploits.
  • The chapter covers threat assessments, vulnerability assessments, and exploit assessments.
  • The goals of the chapter include describing threat identification techniques, listing best practices for threat assessments across seven IT infrastructure domains, explaining the value of reviewing documentation and system logs for vulnerability assessment.
  • Identifying tools for vulnerability scans, best practices for vulnerability assessments, and identifying exploits throughout the seven domains of a typical IT infrastructure are also goals.

Threat Assessments

  • A threat assessment identifies and evaluates potential threats.
  • The goal is to identify as many potential threats as possible and then evaluate each threat to determine likelihood of occurrence.
  • The frequency of a threat is important.
  • A threat assessment is conducted at a specific point in time, as risks can change.
  • The assessment considers existing threats in the current environment.

Threat Assessments (Continued)

  • Threats represent potential dangers (human actions, environmental factors, and external threats).
  • Impacts on confidentiality (unauthorized disclosure), integrity (modification or destruction of data), and availability (service or system unavailability) are considered.
  • Human threats can be internal (e.g., disgruntled employees) or external (e.g., hackers, malware writers, terrorists).
  • Natural threats include various weather events (floods, earthquakes, tornados, storms), and fires.
  • Employee actions (malicious or accidental) can compromise data.
  • Unintentional access, data deletion, and forwarding of viruses are internal threats.
  • Lack of laptop security control (theft and data compromise) is an internal threat.
  • External actors can launch denial-of-service (DoS) attacks, create malware, and attempt to access, modify, or corrupt organizational data. Terrorists can also launch attacks.

The Top Threats are Internal

  • Internal threats can be unintentional (e.g., accidental access or data deletion) or malicious (e.g., disgruntled employee actions).
  • Access controls, authentication processes, and least-privilege and need-to-know policies are crucial components to minimize the threat of unintentional or malicious user activity.
  • Ex-employee access accounts should be disabled or deleted post-termination to prevent unauthorized access.
  • Phishing attempts, often sophisticated, can target specific companies and trick users, appearing as if they originate from within the company.
  • Virus forwarding (inadvertent sharing of malicious emails), and lack of laptop security (theft and data compromise) are internal threats.

Threat Assessments (Continued)

  • Historical data analysis and threat modeling are fundamental to identifying potential threats.
  • Historical data analysis includes reviewing previous incidents in an organization, similar organizations, and the local area (including weather events) to determine threats from various sources.
  • Different types of historical/organizational data can be examined, including security records, insurance claims, troubleshooting records, and employee interviews.

Threat Modeling

  • Threat modeling is a method for evaluating and documenting security risks within applications or systems.
  • This process should ideally occur before application development or system deployment to avoid scope creep.

Threat Modeling (Continued)

  • It's essential during the initial stages of a system's life-cycle to identify valuable assets, which helps to develop appropriate security measures.
  • The seven domains of IT infrastructure (User, Workstation, LAN, LAN-to-WAN, WAN, Remote Access, and System/Application) are important in threat modeling analysis.

Vulnerability Assessments

  • A vulnerability assessment (VA) is performed to identify weaknesses within an IT infrastructure, or the personnel involved, or the network itself.
  • These weaknesses may lead to security violations.
  • Vulnerabilities can exist at the personnel, network, or specific server level.

Vulnerability Assessments (Continued)

  • Vulnerabilities exist if access controls are not properly implemented or security awareness is lacking in personnel or processes.
  • Social engineering tactics (misinformation or manipulation to gain access to sensitive data) also create vulnerabilities.
  • Regular assessments are recommended to detect emerging or recurring vulnerabilities.

Vulnerability Assessment (Continued)

  • Automated scans (e.g., Nmap, Nessus, SATAN, SAINT) are important to quickly identify vulnerabilities.
  • Audits and personnel interviews help to check for policy compliance and security knowledge.
  • Policies related to employee departures (disabling/deleting user accounts after they leave) are also checked as part of the audit processes.
  • Process and output analysis are used to identify inherent vulnerabilities.
  • System testing is important to discover vulnerabilities related to patches and updates of operational systems or programs.
  • Functionality testing will evaluate the adherence to the initial specifications.
  • Access controls testing verifies that user permissions and privileges are in accordance with the organization's policies. This will also include access restrictions (by grouping employees) based on their department.

Vulnerability Assessment (Continued)

  • Penetration testing is another method to test and uncover vulnerabilities.
  • The goal is to evaluate the effectiveness of security controls against specific known vulnerabilities. A penetration test can detect the effectiveness of controls implemented against certain vulnerabilities, which include checking for vulnerabilities from inside or outside a network, and using a DMZ.
  • Appropriate and detailed documentation of results must occur for compliance and improvement.

Best Practices: Vulnerability Assessments

  • Maintaining up-to-date vulnerability scanners enhances the success of assessments.
  • Performing internal and external checks helps in detecting vulnerabilities from various locations (within a network or outside), and from a DMZ.
  • Documenting vulnerability assessment results is crucial for tracking progress, compliance, reporting, and security improvements.

Documentation Review

  • Documentation review includes reviewing incident reports, outage reports, and past assessment reports.
  • It helps identify vulnerabilities, common problems, and areas needing improvements and correction.

Review of System Logs, Audit Trails, and Intrusion Detection System Outputs

  • System logs, audit trails, and intrusion detection system (IDS) outputs provide information for vulnerability discovery.
  • Auditing of events (actions) provides detailed information on who accessed, what was accessed, when, and where. This may include who attempted to log in to a resource or what files were accessed.
  • An IDS detects intrusions and alerts administrators to security issues.
  • Events from an intrusion detection system (IDS) can detail attack patterns launched against a network. Attacks from a DMZ, the Internet, and internal networks can be identified.
  • IDS's usually consist of multiple agents, often one outside a firewall, one within a DMZ, and one within the internal network.

Other Assessment Tools

  • Review historical data, perform threat modeling, and analyze tools (including Nmap, Nessus, SATAN, and SAINT) to identify and respond to threats and vulnerabilities.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

Security Risk Management and Ethics Chapter 4 PDF

Description

This quiz covers Chapter Four of Security Risk Management, which focuses on identifying and analyzing threats, vulnerabilities, and exploits. It discusses assessment techniques, best practices, and the importance of documentation and system logs in the assessment process. Test your knowledge on threat assessments across various IT infrastructure domains.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser