Download as PDF, PPTX
Uploaded bySam Bowne
CNIT 125 7. Security Assessment and Testing
The document covers various concepts in information security, focusing on security assessments and testing methodologies, including penetration testing techniques, vulnerability scanning, and security audits. It details methods for software testing such as static and dynamic analysis, regression testing, and fuzzing, as well as the importance of compliance with standards like PCI-DSS. The emphasis is on ensuring data confidentiality and integrity while addressing potential security threats through structured testing and audits.
More Related Content
Similar to CNIT 125 7. Security Assessment and Testing
CNIT 125 7. Security Assessment and Testing
- 1. CNIT 125: Information Security Professional (CISSP Preparation) Ch7. Security Assessment and Testing
- 2.
- 3. Penetration Testing • Authorizedwhite hat hacker breaks into an organization
- 4. Social Engineering • Exploitingthe human mind • Often tricks the user into clicking a link • Zero-knowledge (black box) test • No information provided to attacker • Full-knowledge test • Provides pen tester with network diagram, policies and procedures, and sometimes results from previous pen testers • Partial-knowledge test
- 5. Penetration Tester Toolsand Methodology • Metasploit (open source) • Core Impact and Immunity Canvas (closed source) • Methodology
- 6. Assuring Confidentiality, DataIntegrity, and System Integrity • Pen testers must ensure confidentiality of data they access • Report should be treated as confidential
- 7. Vulnerability Testing • Alsocalled Vulnerability Scanning • Uses a tool like Nessus or OpenVAS • Finds vulnerabilities • Requires manual verification and assessment • Must be matched to real threats to find true risk
- 8. Security Audit • Testsagainst a public standard • Such as PCI-DSS (Payment Card Industry Data Security Standard)
- 9. Security Assessment • Viewmany controls across multiple domains • Policies and procedures • Administrative controls • Change management • Other tests (pen tests, vuln assessments, security audits)
- 10. Internal and ThirdParty Audits • Internal audits • Assessing adherence to policy • External audits • Require security professionals to play a role • Response and remediation to audit findings • Demonstrating mitigations
- 11. Log Reviews • Easiestway to verify that access control mechanisms are working
- 12. Centralized Logging • Acentral repository allows for more scalable security monitoring and intrusion detection • Syslog transmits log data in plaintext over UDP port 514 • Log retention • May be relevant to legal or regulatory compliance
- 13.
- 14. Software Testing Methoda •Discovering programmer errors • Custom apps don't have a vendor providing security patches • Source code review helps • Two general approaches: • Static and dynamic analysis • Also manual code review • Pair programming is employed in agile programming shops
- 15. Static and DynamicTesting • Static testing: the code is not running • Review source code for insecure practices, unsafe functions, etc. • Unix program lint • Compiler warnings • Dynamic testing: while code is executing • White box testing: tester has source code • Black box: tester has no internal details
- 16. Traceability Matrix • Mapscustomer requirements to software testing plan
- 17. Synthetic Transactions • Simulatingbusiness activities • Often used for Web apps
- 18. Software Testing Levels •Unit testing • Tests components like functions, procedures, or objects • Installation testing • Tests software as it is installed and first operated • Integration Testing • Testing multiple software components as they are combined into a working system
- 19. Software Testing Levels •Regression testing • Testing softare after updates, modification, or patches • Acceptance testing • Testing to ensure the software meets the customer's requirements • When done by customer, called User Acceptance Testing
- 20. Fuzzing • A typeof black box testing • Sends random malformed data into software programs • To find crashes • A type of dynamic testing • Has found many flaws
- 21. Combinatorial Software Testing •Seeks to identify and test all unique combinations of software inputs • Pairwise testing (also called all pairs testing)
- 22. Misuse Case Testing •Formally model an adversary misusing the application • A more formal and commonly recognized way to consider negative security outcomes is threat modeling • Microsoft highlights it in their Security Development Lifecycle (SDL)
- 23. Test Coverage Analysis •Identifies the degree to which code testing applies to the entire application • To ensure that there are no significant gaps
- 24. Analyze and ReportTest Outputs • Security test results are easy to produce • Actually improving security is much more difficult • Data must be analyzed to determine what action to take