Professional Documents
Culture Documents
CISSP Cheat Sheets
CISSP Cheat Sheets
Evaluate performance of software modules against Antivirus software • Antimalware software • Security
Malware Protection
Interface Testing the interface specifications to validate working Policies
status. Considerations
Application Programming Test APIs to verify web application meets all security • Resources availability
Interfaces (APIs) requirements. • Level of critical and sensitiveness of the system under testing
Includes graphic user interfaces (GUIs) and • Technical failures
User Interfaces (UIs) command-line interfaces (CLI). Review of user • Control misconfigurations result in security loopholes
interfaces against requirement specifications. • Security attack risks
• Risk of performance changes
Eg. in physical machines such as ATM, card readers
Physical Interfaces • Impact on normal operations
etc.
Verification & Validation
Testing a small part of the system to test units are
Unit Testing • Verification – SDLC design output meets requirements
good for integration into final product.
• Validation – Test to ensure software meets requirements
Transfer of data and control between program
Integration Level Testing Security Software
interfaces.
Verify system has all the required specifications and • Antimalware and Antivirus – Scan and log malware and virus detection
System Level Testing • IDS/IPS = Real time and promiscuous monitoring for attacks
functions.
• Network-based IDS
• Local network monitoring and passive and header level scanning .No host level
Log Management System
scan.
Analyze daily operations and review possible attacks to • HOST BASED
OPSEC process
apply countermeasures. • Monitor hosts using event logs
Pen-test Testing of network security in view of a hacker. • Intrusion prevention system (IPS) – Attack detects and prevent
Port scanner Check any port or port range open in a computer. • Remote Access Software Should be access via a VPN
• Vulnerability assessment Software – should be updated and patched
Ring zero Internal code of the system.
• Routers – policy based access control
Operational assurance Verify software meets security requirements.
Logs
Supervisor mode Processes running in internal protected ring.
Network Flow Network traffic capture
Audit logging Events related to hardware device login and access
Threat Assessment Modeling
Network Time Protocol Should synchronize across entire network to have correct
Evaluate threats against applications or operating (NTP) and consistent time in logs and device traffic flows.
STRIDE
systems. Syslog Device event message log standard.
Use of false identity to gain access to system identity. Event types Errors, Warnings, Information, Success Audits, Failure
Spoofing Can use IP/ MAC address, usernames, wireless network Simple Network
SSIDs. Management Protocol Support for different devices such as Cisco.
Cause unauthorized modifications of data in transit or in (SNMP)
Tampering storage. Results in violation of integrity as well as Monitoring and auditing
availability. Define a clipping level. A.K.A BASELINE
Repudiation Deny an action or activity carried out by an attacker. • Audit trails – event/transaction date/time, author /owner of the event
• Availability – Log archival
Distribution of private/confidential or restricted
Information disclosure • Log Analysis – examine logs
information to unauthorized parties.
Code Review and Testing
Attack result in increase the level privileges for a limited
Elevation of privilege Person other than the code writer/developer check the code to find errors
user account.
Fagan inspections – Planning • Overview • Preparation • Inspection • Rework •
Regular monitoring of Number of open vulnerabilities and compromised
steps Follow-up
key performance and accounts, vulnerability resolve time, number of detected
Code Coverage Report Details of the tested code structure
risk indicators including software flaws etc.
Use cases Percentage of the tested code against total cases
Automatically probe systems, applications, and
Vulnerability scans Code Review Report Report create in manual code testing
networks.
Black-box testing Test externally without testing internal structure
Sends a packet with SYN flag set. Also known as
TCP SYN Scanning Dynamic Testing Test code in run time
“half-open” scanning.
White-box testing Detailed testing by accessing code and internal structure
Perform when a user running the scan does not have the
TCP Connect Scanning CVE Common Vulnerability and Exposures dictionary
necessary permissions to run a half-open scan.
CVSS Common Vulnerability Scoring System
TCP ACK Scanning Sends a packet with the ACK flag set.
NVD National Vulnerability Database
Xmas Scanning Sends a packet with the FIN, PSH, and URG flags set.
Verify the installations required for testing do not have
Regression Testing
Passive Scanning Detect rogue scanning devices in wireless networks. any issues with running system
Authenticated scans Read-only account to access configuration files. Integration Testing Test using two or more components together