coursera pentesting ibm.docx

[[https://www.sans.org/emea/]](https://www.sans.org/emea/) - 1. 2. 3. 4. 5. 6. The document relating to penetration testing [[250.pdf]](https://prod-files-secure.s3.us-west-2.amazonaws.com/63ea89f4-9128-4513-a139-c96929e884b2/89971628-1a24-46e8-a773-e14a9a248c53/250.pdf) 2.discovery -...

[[https://www.sans.org/emea/]](https://www.sans.org/emea/) - 1. 2. 3. 4. 5. 6. The document relating to penetration testing [[250.pdf]](https://prod-files-secure.s3.us-west-2.amazonaws.com/63ea89f4-9128-4513-a139-c96929e884b2/89971628-1a24-46e8-a773-e14a9a248c53/250.pdf) 2.discovery - - - - - - - - ### **additional discovery details** methods of gaining access to a system: - - - - - - - - - - - - - - - - - Techniques: [[https://securitytrails.com/blog/google-hacking-techniques]](https://securitytrails.com/blog/google-hacking-techniques) - ### **Penetration Testing Attack** - - ### **Penetration Testing - Reporting** - - - - - - - - - ### **Tools** - - - - - - [[https://www.coursera.org/learn/ibm-penetration-testing-incident-response-forensics/ungradedWidget/zDPwh/hands-on-lab-penetration-testing]](https://www.coursera.org/learn/ibm-penetration-testing-incident-response-forensics/ungradedWidget/zDPwh/hands-on-lab-penetration-testing) ### **Hands-on testing** - - - - Introduction Personnel involved Contact information Scope Information Gathering Passive intelligence Active intelligence Corporate Assets involved in testing Objectives of Test Scope of Test intelligence Strength of Test Personelle Approach intelligence Threat/Grading Structure Vulnerability assessment In this section, a definition of the methods used to identify the vulnerability as well as the evidence/ classification of the vulnerability should be present. Vulnerability Confirmation This section should review, in detail, all of the steps taken to confirm the defined vulnerability as well as the following: Exploitation Timeline Targets selected for Exploitation Exploitation Activities Post Exploitation Escalation path Acquisition of Critical Information Value of information Access to core business systems Access to compliance protected data sets Additional Information/Systems Accessed Ability of persistence Ability for exfiltration Countermeasure Effectiveness Risk/Exposure This section will cover the business risk in the following subsections: Evaluate incident frequency Estimate loss magnitude per incident Derive Risk passive vs active Monitoring employees Listening to network traffic Vs Network Mapping Port Scanning Password Cracking - difference between event and incident response - - !!! preventive activities can lower the number of incidents, but not all incidents can be prevented - Untitled **Common Attack Vectors:** 1. 2. 3. 4. 5. 6. **Questions to document:**  **Incident Response Phases:** Untitled  - - - - ### **Preparation** - - - - Precursors & Indicators - - common sources: alerts, logs, reports from staff, publicly available info (news, national vuln database) ### **Types of Monitoring Systems** - - - - Documentation: understand the incident + aids future incident handling Untitled Functional impacts (nist guidelines): no impact, low impact, medium impact, high impact Info impact: no impact, privacy breach, proprietary breach, integrity loss Recoverability effort: regular, supplemented, extended, non-recoverable Containment: - - - - - - - Eradication - - - ++scan all systems Recovery - Scenario - - - **Document: empowering incident** [[38862.pdf]](https://prod-files-secure.s3.us-west-2.amazonaws.com/63ea89f4-9128-4513-a139-c96929e884b2/c89f200b-b159-467c-894a-ff99780cca46/38862.pdf) **Lessons learnt** questions checklist:  - - - - - ### **Info from document. Key techniques and tools used:** **ping sweep and nmap scans** - **privilege escalation** - - **dump and password cracking** - - **network reconnaissance** - **data collection and analysis tool** - - [[37920.pdf]](https://prod-files-secure.s3.us-west-2.amazonaws.com/63ea89f4-9128-4513-a139-c96929e884b2/c7512a28-f351-46c3-b8ec-81064e6be830/37920.pdf) Incident response TEMPLATE [[CQR8pKH6QDupokHg0xtIyA\_b79ffcbc283748dd8261aff198090cf1\_Incident-Response-and-Preparedness-Template.docx]](https://prod-files-secure.s3.us-west-2.amazonaws.com/63ea89f4-9128-4513-a139-c96929e884b2/2a0b5d61-cc25-48fc-a143-d4f2d29a99e1/CQR8pKH6QDupokHg0xtIyA_b79ffcbc283748dd8261aff198090cf1_Incident-Response-and-Preparedness-Template.docx) ### **Incident response Demo** 1. 1. 2. 3. 4. 2. 5. 6. 7. 8. 3. 9. 10. 11. 12. **Protect against ransomware using Guardium Data Encryption and QRadar** - - ⚫the best offense The Best Offense\... Risk Assessment Periodic risk assessments of systems and apps should determine what risks are posed by combinations of threats and vulnerabilities Host Security All hosts should be hardened appropriately using standard configurations, adhere to strict ACLS, and be monitored continuously Network Security The network perimeter should be configured to deny all activity that is not expressly permitted. User Awareness and Training Malware Prevention Software to detect and stop malware should be deployed throughout the organization. Users should be made aware of policies and procedures regarding appropriate use of networks, systems, and applications. IR Team The composition of the incident response team within the organization Roles The role of each of the team members Means, Tools, Resources The technological means, tools, and resources that will be used to identify and recover compromised data. Policy Testing The persons responsible for testing the policy Action Plan ⚫ how to put the policy into action Incident Handler Communications and Facilities: Contact information On-call information Incident reporting mechanisms Issue tracking system Smartphones Encryption software War room Secure storage facility Incident Analysis Hardware and Software: Digital forensic workstations and/or backup devices Laptops Spare workstations, servers, and networking equipment ⚫ Blank removable media Portable printer ⚫ Packet sniffers and protocol analyzers Digital forensic software Removable media Evidence gathering accessories Incident Analysis Resources: Port lists Documentation Network diagrams and lists of critical assets Current baselines Cryptographic hashes