CISSP Cheat Sheet Series

Domain 6: Security Assessment & Testing

Software Testing
Test code passively without running the code: syntax
checking, code reviews & walkthroughs. Eg. toolsthat use exploitable buffer overﬂows from open
source code

Static Testing

Analyze and test using running environment. Use totest software provided by third parties where noaccess to software code. Eg. cross-site scripting,
SQL injection

Dynamic TestingType of dynamic testing which use speciﬁc inputs todetect ﬂaws under stress/load. Eg. input invalid
parameters to test

Fuzz TestingMutation / Dumb Fuzzing

Using already modiﬁed input values to test.

Generational / Intelligent
Fuzzing

Inputs models of expected inputs.

Software Development Security Best Practices
WASC

Web Application Security Consortium

OWASP

Open Web Application Security Project

BSI

the Build Security In initiativeIEC

The International Electrotechnical Commission

Security Testing
To make sure security controls are properly applied and in use. Automated scans,vulnerability assessments and manual testing.
Software Threats
Viruses
Rootkit

Stealth virus • Polymorphic virus • Macro virus •• Spyware/Adware • Botnet • worm
Kernel-mode Rootkit • Bootkit • User-mode Rootkit •Virtual Rootkit • Firmware Rootkit
Buffer Overﬂow • Escalation of Privileges • Backdoor

Misuse Case Testing

Evaluate the vulnerability of known risks and attacks.

Source Code Issues
Malware Protection

Interface Testing

Evaluate performance of software modules against
the interface speciﬁcations to validate working
status.
Test APIs to verify web application meets all security
requirements.

• Resources availability• Level of critical and sensitiveness of the system under testing• Technical failures• Control misconﬁgurations result in security loopholes• Security attack risks• Risk of performance changes• Impact on normal operations

Application Programming
Interfaces (APIs)
User Interfaces (UIs)

Includes graphic user interfaces (GUIs) andcommand-line interfaces (CLI). Review of userinterfaces against requirement speciﬁcations.

Physical Interfaces

Eg. in physical machines such as ATM, card readers
etc.

Unit Testing

Testing a small part of the system to test units aregood for integration into ﬁnal product.

Integration Level Testing
System Level Testing

Transfer of data and control between programinterfaces.
Verify system has all the required speciﬁcations andfunctions.

Log Management System
OPSEC process

Analyze daily operations and review possible attacks toapply countermeasures.

Pen-test

Testing of network security in view of a hacker.

Port scanner

Check any port or port range open in a computer.

Ring zeroInternal code of the system.

Operational assurance

Verify software meets security requirements.

Supervisor mode

Processes running in internal protected ring.

Threat Assessment Modeling
STRIDE

Spooﬁng

Tampering
Repudiation

Evaluate threats against applications or operating
systems.
Use of false identity to gain access to system identity.
Can use IP/ MAC address, usernames, wireless network
SSIDs.
Cause unauthorized modiﬁcations of data in transit or instorage. Results in violation of integrity as well asavailability.
Deny an action or activity carried out by an attacker.

Information disclosure

Distribution of private/conﬁdential or restricted
information to unauthorized parties.

Elevation of privilege

Attack result in increase the level privileges for a limiteduser account.

Regular monitoring of
key performance andrisk indicators including

Number of open vulnerabilities and compromisedaccounts, vulnerability resolve time, number of detectedsoftware ﬂaws etc.

Vulnerability scans

Automatically probe systems, applications, andnetworks.

TCP SYN Scanning

Sends a packet with SYN ﬂag set. Also known as“half-open” scanning.

TCP Connect Scanning
TCP ACK Scanning

Perform when a user running the scan does not have thenecessary permissions to run a half-open scan.
Sends a packet with the ACK ﬂag set.

Xmas Scanning

Sends a packet with the FIN, PSH, and URG ﬂags set.

Passive Scanning

Detect rogue scanning devices in wireless networks.

Authenticated scans

Read-only account to access conﬁguration ﬁles.

Antivirus software • Antimalware software • SecurityPolicies
Considerations

Veriﬁcation & Validation• Veriﬁcation – SDLC design output meets requirements• Validation – Test to ensure software meets requirements
Security Software• Antimalware and Antivirus – Scan and log malware and virus detection• IDS/IPS = Real time and promiscuous monitoring for attacks• Network-based IDS• Local network monitoring and passive and header level scanning .No host levelscan.
• HOST BASED• Monitor hosts using event logs
• Intrusion prevention system (IPS) – Attack detects and prevent• Remote Access Software Should be access via a VPN• Vulnerability assessment Software – should be updated and patched• Routers – policy based access controlLogs
Network Flow

Network traﬃc capture

Audit logging

Events related to hardware device login and accessNetwork Time Protocol(NTP)
SyslogEvent types
Simple Network
Management Protocol(SNMP)

Should synchronize across entire network to have correctand consistent time in logs and device traﬃc ﬂows.
Device event message log standard.
Errors, Warnings, Information, Success Audits, Failure
Support for different devices such as Cisco.
Monitoring and auditing

Deﬁne a clipping level. A.K.A BASELINE• Audit trails – event/transaction date/time, author /owner of the event• Availability – Log archival• Log Analysis – examine logs
Code Review and Testing
Person other than the code writer/developer check the code to ﬁnd errors
Fagan inspections –steps

Planning • Overview • Preparation • Inspection • Rework •Follow-up

Code Coverage Report

Details of the tested code structure

Use cases

Percentage of the tested code against total cases

Code Review Report

Report create in manual code testing

Black-box testing

Test externally without testing internal structure

Dynamic Testing

Test code in run time

White-box testing

Detailed testing by accessing code and internal structure

CVE

Common Vulnerability and Exposures dictionary

CVSS

Common Vulnerability Scoring System

NVD

National Vulnerability Database

Regression Testing

Verify the installations required for testing do not have
any issues with running system

Integration Testing

Test using two or more components together