up

2020-03-04 - Midterm Prep

This midterm was scary and looming but we’re getting a preview so that’s awesome. Like now we have a general idea of how to even prepare, that’s good good.

Vocab

• Threat
  • bad event that could happen
• Risk
  • measured in $
• Threat Actor -
• Wekaness
• flaw
  • design weakness
• bug
  • implementation weakness
• vulnerability
  • a bug or flaw with security implications. Not all bugs/flaws are vulns.
• Explit
  • A technique of using a vuln

Standards

• What are they
• where do they come from

Audit

• What is it
  • measuring reality against a standard
• why do we do that? to test against:
  • legal requirements
  • a standard you choose to adhere to
  • Policy!
    • Issue specific, system spec, enterprise
• goals and outcomes?
• what steps
• audit vs assessment

Threat model / attack graph

• What drives a threat actor?
• Intent and motivation
  • MICE
  • RASCLS
  • open-ended question - tell me about another one
• Internal / External threats
  • sophistication of a threat?
  • sec perimiter / attack surface
  • equipment / skills / access / cost / likelihood of success
• Value of an attack graph / threat model?
  • How can an organization use these
  • how might they help an auditor?

Risk

Risk = propbability of event * cost of impact

Addressing Risk:

• Mitigate
• Accept
• Transfer
• Avoid

P&P

• Living doc
• Types
  • EISP/ISSP/SSSP
  • levels
• heirarchy
• Responsibilities
• Inform and Improve

Complaince

• PCI SOX HIPPA, GDPR

Asset Discovery

yep

Crib Sheet

• Single-sided
• 8.5x11
• hand-written
• write as small as you want

Groups that present lab3 will yeet that after spring break