Define cybersecurity.
Refers to protecting computer systems, including their electronic data, software and hardware, from theft or damage as well as disruption
What are assets in cybersecurity?
Valued data/computerized assets
What is the CIA Triad? What are its assets?
Describes the security attributes of assets
- Confidentiality: material should only be entrusted to designated parties for specific groups
- Integrity: dependent on assurance that material has not been tampered with via unauthorized access
- Accessibility: data/service is available only to authorized users
What are the three elements of criminality? Define them.
- Motive: malicious individuals and groups might be motivated by greed, revenge, or ideology
- Means: knowledge, skills, and resources to take advantage of an opportunity
- Opportunity: vulnerabilities in cybersecurity controls
What is the purpose of cybersecurity testing? What does it provide?
Probes systems to reveal potential failures in furnishing desired level of security.
Provides verification and validation.
What is threat modeling? (i.e., what does it anticipate?)
Anticipates the nature of assaults that might be encountered in the operating environment of the system
Specification of what the system __________ is often less difficult than elaborating what the system __________.
Should do; should not do
List four cybersecurity differences.
- It must be responsive to a rapidly changing environment.
- The adequacy of established controls is under constant active probing.
- Cybersecurity testing must address detection, response, and recovery after controls fail.
- Human shortcomings are at least as prominent as technological challenges.
When do vulnerabilities appear?
They can either lay dormant for years before exposure or appear with new development.
What are threat actors?
Individuals with varying motivations and skills that will expose control weaknesses and at times will expose it to other threat actors.
Cybersecurity testing must evaluate ___________.
How well risk mitigation supplements risk avoidance.
What is the leading cause of security failures?
Social engineering (exploits through low-tech means)
What is the overall goal of cybersecurity testing?
To reduce overall risk exposure to an acceptable level.
List and define the two cybersecurity test approaches.
- Risk avoidance: lowering the probability of when a threat might take advantage of a vulnerability
- Risk mitigation: decreasing the consequences of when a vulnerability is taken advantage of
What are dynamic security issues?
Issues that can only be seen during execution.
List and define the five stages of cybersecurity testing.
- Identify: confirm identification, categorization, and prioritization of the data and processes to be safeguarded
- Protect: analyze the protection of each asset category with corresponding controls that will stop or slow attempts to compromise the system
- Detect: demonstrate the ability to detect intrusion and provide timely actionable analysis
- Respond: exercise the responses and determine how well affected parties are notified, damage is minimized, and further access is shut off
- Recover: demonstrate the speed and extent of recovering operational status and restoring data and confidence
What needs to be done to avoid cybersecurity testers from being mistaken for malicious insiders?
All cybersecurity testing must be pre-authorized in writing by appropriate management
What two modes of cybersecurity testing should be conducted? Define them.
- Black box testing: attends to external system behaviors; “outsider” will gather information via system reconnaissance and use that information to craft attacks
- White box testing: utilizes structural knowledge of the system as-built; “insider” threat is modeled by treating the system’s internals as visible and exploitable
What is fuzzing?
Inserting random variations of expected input values to detect sensitivities that might be exploited
What is Red Team vs. Blue Team?
Derived from the military where team of attackers (red team) is pitted against team of defenders (blue team).
Targeted tests should probe the adequacy of what specific controls? (This is a long list of items having to do with cybersecurity.)
- policy and procedure enforcement
- system hardening: reducing the attack surface by eliminating as many security risks as possible
- access control mechanisms for authentication, authorization, and accountability
- input validation
- encryption
- error and exception handling
- intrusion detection
- malware scanning
- resistance to social engineering
