PenTest > Framework > Flashcards

Framework Flashcards

lesson 4 (83 cards)

Study These Flashcards
1
Q

What are MITRE ATT&CK?

A

Catalogs a wide range of tactics and techniques observed during
real-world attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

MITRE ATT&CK
Divides into categories/tactics such as

A

● Initial Access
● Execution
● Persistence
● Privilege Escalation
● Defense Evasion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the OWASP?

A

Open Web Application Security Project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the OWASP Top 10?

A

Identifies the ten most critical web application security risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the Current OWASP Top 10?

A

■ Broken Access Control
■ Cryptographic Failures
■ Injection
■ Insecure Design
■ Security Misconfiguration
■ Vulnerable and Outdated Components
■ Identification and Authentication Failures
■ Software and Data Integrity Failures
■ Security Logging and Monitoring Failures
■ Server-Side Request Forgery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are OWASP - Broken Access Control?

A

Occurs when restrictions on user actions are not properly enforced

Unauthorized access to functionality or data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are OWASP - Cryptographic Failures?

A

Failures related to managing sensitive data securely, including improper encryption

Compromises data confidentiality and integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are OWASP - Injection Flaws

A

Untrusted data sent to an interpreter as part of a command or
query, leading to unintended commands or unauthorized data
access

Execution of unintended commands or access to unauthorized data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are MASVS?

A

OWASP Mobile Application Security Verification Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are MASVS-STORAGE?

A

Secure storage of sensitive data (personal details, user credentials,
financial information)

Ensures data is protected through encryption and prevents data
leakage

Shields sensitive data from unauthorized access and breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are MASVS-CRYPTO?

A

Cryptographic measures to protect sensitive data

Emphasizes using strong, industry-standard encryption methods

Ensures cryptographic keys are of sufficient length and managed
properly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are MASVS-AUTH?

A

Covers authentication and authorization processes

Ensures strong mechanisms to verify user identities and grant appropriate
access rights

Uses secure protocols and additional authentication for sensitive
operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are MASVS-NETWORK?

A

Addresses security of network communications between the mobile app and remote endpoints

Protects data in transit against interception, tampering, and
eavesdropping

Uses protocols like SSL/TLS and certificate pinning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What kind of protocols uses MASVS-NETWORK?

A

SSL/TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are MASVS-PLATFORM?

A

Secure interaction between the app and the underlying mobile
platform and other apps

Addresses issues like inter-process communication and WebViews

Ensures sensitive data isn’t leaked through platform mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are MASVS-CODE?

A

Deals with secure development and maintenance of the app’s code

Emphasizes keeping the app and its operating system up to date

Treats all incoming data as untrusted, verifying and sanitizing it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are MASVS-RESILIENCE?

A

App’s ability to withstand reverse engineering and tampering
efforts

Includes strategies for detecting and mitigating attempts to alter
the app’s code or behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are MASVS-PRIVACY?

A

Emphasizes implementing privacy controls aligned with laws and
regulations

Apps should request only essential data and ensure informed user
consent

Data sharing with third parties should be necessary and based on user
consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

OWASP Mobile Application Security Testing Guide (MASTG) Provides:

A

a detailed testing framework for validating security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

OWASP MAS Checklist Offers:

A

a practical format for assessing security features in the app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

MASVS-STORAGE Ensures:

A

secure storage of user credentials through good encryption practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

MASVS-CRYPTO Uses:

A

industry-standard encryption to protect data both in transit
and at rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

MASVS-AUTH Implements:

A

strong user authentication mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

MASVS-NETWORK Uses______ _______ protocols to secure data in transit

A

SSL/TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
MASVS-PLATFORM Prevents data leakage through:
platform mechanisms like auto-generated screenshots
26
MASVS-CODE Ensures:
all incoming data is properly verified and sanitized
27
MASVS-RESILIENCE Detects and mitigates:
attempts to alter the app’s code or behavior
28
MASVS-PRIVACY Ensures:
informed user consent for data sharing with third parties
29
What are PTES (Penetration Testing Execution Standard)?
Framework for conducting thorough and effective penetration tests Structured approach to testing the security of information systems and networks Seven Main Sections
30
PETS (Pre-engagement Interactions)
Initial communication and reasons for conducting a penetration test Includes tools and techniques for a successful start
31
PETS (Information Gathering)
Includes Open-Source Intelligence, corporate structures, technology setups, and footprinting (passive and active techniques)
32
PETS (Threat Modeling)
Understanding business assets and processes that need protection Identifies threats and their capabilities Prioritizes critical assets and threat vectors
33
PETS (Vulnerability Analysis)
Identifying security weaknesses using active and passive testing techniques Active testing: Direct interaction with the system Passive testing: Observing the system without direct interaction
34
PETS (Exploitation)
Actively exploiting identified vulnerabilities Simulates an attacker’s attempt to exploit weaknesses
35
PETS (Post-exploitation)
Follows successful exploitation with gained access Explores further potential achievements of an attacker included: Accessing sensitive data, escalating privileges, installing backdoors, navigating the network
36
PETS (Reporting)
Compiles a detailed report of all activities conducted during the test Includes vulnerabilities exploited, systems accessed, and potential impact Provides clear, actionable recommendations for remediation
37
What is CREST?
Council of Registered Ethical Security Testers Organization of security companies Sets rigorous standards for cybersecurity services
38
What are CDPT?
CREST Defensible Penetration Test) Guidelines Establish standard for conducting penetration tests
39
What are Executive Summary (CREST)
Clarifies common terms Sets stage for unified understanding of penetration testing across the industry
40
What are Background (CREST)
Discusses evolution and variability of penetration testing practices Emphasizes need for a global standard for consistency and quality
41
What are the Benefits of CREST Accreditation?
Outlines advantages of choosing CREST-accredited companies Enhances trust and reliability of services
42
What are OSSTMM?
Open-Source Security Testing Methodology Manual Provide a scientific method for accurately assessing operational security (OpSec) OSSTMM serves as a reference for all security tests
43
What are ISECOM?
Institute for Security and Open Methodologies Develops OSSTMM Provides additional resources through paid membership (e.g., Hacker Highschool, Cybersecurity Playbook)
44
What are Operational Security (OpSec), regarding OSSTMM?
Assessed through thorough examination and comparison of test results Ensures consistency and trustworthiness
45
OSSTMM has a Quick Start Guide that:
Assists with initial stages of security testing Helps identify what and how to test
46
What are STRIDE?
A security model developed by a team at Microsoft Provides a systematic approach to security encompassing six key elements: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege
47
STRIDE (Spoofing)
Involves an attacker assuming the identity of another user to gain unauthorized access Focuses on the authentication process
48
STRIDE (Tampering)
Refers to the malicious modification or alteration of data in the CIA - hurts i- integrity
49
STRIDE (Repudiation)
Performing actions on a system that cannot be traced back to an individual user Non-repudiation measures: Logging, digital signatures, timestamps, audit trails
50
STRIDE (Information Disclosure)
Unauthorized access to confidential information Breaches confidentiality- CIA
50
DTRIDE (Denial of Service (DoS) )
Designed to interrupt the normal functioning of a website, service, or network by overwhelming it with requests
51
STRIDE (Elevation of Privileges)
When a user with limited permissions exploits a weakness to gain higher-level permissions Involves authorization mechanisms
52
What is The Purdue Model?
Foundational framework for protecting operational technology (OT) environments Helps define network segmentation in industrial settings Isolates and protects OT systems from potential cyber threats Divided in to Levels/Zones
53
the Purdue Model- Level 5 (External/Vendor Support/Cloud Access)
Enterprise Security Zone Manages interactions with external vendors and cloud services
54
the Purdue Model- Level 4 (Business Logistics Systems/Enterprise IT)
Covers corporate IT operations, including enterprise resource planning systems Manages crucial business functions like production scheduling, material use, shipping, and inventory management
55
the Purdue Model- Level 3.5 (Demilitarized Zone (DMZ))
Buffer zone hosting security measures like firewalls and proxies Controls data exchange between IT and OT systems Prevents potential threats from spreading
56
the Purdue Model- Level 3 (Manufacturing Operations Systems Zone)
Hosts operations management systems such as Manufacturing Execution Systems Directs real-time manufacturing processes Stores critical operational data for analysis
57
the Purdue Model- Level 2 (Control Systems Zone)
Includes devices like Supervisory Control and Data Acquisition (SCADA) systems Monitors and controls physical processes
58
the Purdue Model- Level 1 (Intelligent Devices Zone)
Includes Programmable Logic Controllers (PLCs) Manages operations based on real-time data from sensors in the Physical Process Zone
59
the Purdue Model- Level 0 (Physical Process Zone)
Where actual manufacturing processes occur Includes sensors and actuators that directly interact with manufacturing operations
60
What are the advantages of the Purdue Model?
Remains high despite changes in industrial networking and merging of IT and OT Addresses challenges from direct-to-cloud data flow from Level 0 devices Provides a solid framework for segmenting and protecting networks Clear zones and strict controls at each level help prevent unauthorized access and manage cyber risks Adapts to new technologies and methods, offering a valuable blueprint for securing industrial control system
61
What are OCTAVE?
Operationally Critical Threat, Asset, and Vulnerability Evaluation Designed to manage organizational risks, not just technical ones Ideal for small to medium-sized organizations Focuses on operational impacts like data breaches
62
What are the Benefits of OCTAVE?
Self-directed approach- Allows organizations to shape their security assessments internally Encourages ownership- Internal teams lead the assessment Combines organizational insight with technological assessments
63
OCTAVE - Phase 1 (Build Enterprise-Wide Security Requirements)
Process 1 (Identify Enterprise Knowledge)- Senior managers contribute insights on key assets, threats, risk indicators, and protection strategies Process 2 (Identify Operational Area Knowledge)- Operational area managers capture their perspectives on key assets and threats Process 3 (Identify Staff Knowledge)- Staff-level input on key areas Process 4 (Establish Security Requirements)- Combine information to develop an enterprise-wide view of assets, threats, protection strategies, and security requirements
64
OCTAVE - Phase 2 (Identify Infrastructure Vulnerabilities)
Process 5 (Map High-Priority Information Assets to Information Infrastructure)- Map high-priority infrastructure components using compiled asset and threat information Process 6 (Perform Infrastructure Vulnerability Evaluation)- Evaluate the infrastructure for missing policies, practices, and vulnerabilities
65
OCTAVE - Phase 3 (Determine Security Risk Management Strategy)
Process 7 (Conduct Multi-Dimensional Risk Analysis)- Analyze potential risks by examining break-in scenarios, asset vulnerabilities, and threat likelihoods Process 8 (Develop Protection Strategy) - Create a strategic plan to mitigate prioritized risks, select appropriate mitigation strategies, and craft a risk management plan
66
What are the Main Elements of OCTAVE?
STRIDE Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privileges.
67
What are DREAD stands for?
Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability
68
What dose DREAD do?
A risk assessment model used to quantify, prioritize, and compare the level of risk from various security threats Allows analysts to rate, compare, and prioritize the severity of threats by assigning a score between 0 and 10 to each of the five key categories The overall threat rating is determined by adding all these scores together Severity Categories Based on Total ScoresCritical
69
In the DREAD, what should you do when you get a score of 40-50?
treat it immediately
70
In the DREAD, what should you do when you get a score of (25-39)?
Severe vulnerability that should be reviewed and resolved soon
71
In the DREAD, what should you do when you get a score of (11-24)?
Moderate risk that should be reviewed after more severe risks
72
In the DREAD, what should you do when you get a score of (1-10) ?
Minimal risk to infrastructure and data
73
DREAD Components and Scoring - Damage Potential
Evaluates the extent of damage that a successful exploitation of the vulnerability could cause 0- no damage , 9- Non-sensitive administrative data compromised
74
DREAD Components and Scoring - Reproducibility
Measures how easily a threat can be replicated by an attacker 0- very difficult 10- very easy
75
DREAD Components and Scoring - Exploitability
Assesses the level of effort and resources required to exploit the vulnerability 2.5- Advanced programming and networking skills 10- Web browser
76
DREAD Components and Scoring - Affected Users
Quantifies the segment of the user base that would be impacted if the vulnerability were exploited 0- no users 10- all users
77
DREAD Components and Scoring - Discoverability
Refers to how easy it is for the potential attacker to discover the vulnerability 0- Hard to discover the vulnerability 10- Vulnerability found in web address bar or form
78
Which of the following categories in the MITRE ATT&CK framework focuses on techniques used to maintain access in a target system?
PERSISTANCE
79
Which of the following OWASP Top 10 vulnerabilities involves improper enforcement of user permissions, allowing unauthorized individuals from seeing data or altering functionality?
Broken access control
80
Which control group in the OWASP MASVS ensures the security of data in transit and at rest using cryptographic methods?
MASVS-CRYPTO
81
Which phase of the PTES framework involves gaining knowledge about the target system using both passive and active techniques?
Information gathering
82
Which STRIDE element involves exploiting weaknesses in a system's authentication process to assume another user's identity?
Spoofing
PenTest
flashcards
Decks in class (5)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions