Chapter 7: Security Assessment
Security Testing Tools
Take careful note of the tools used (they’re testable), how they’re used (for instance, nmap switches) and what their output looks like.
Threat Hunting
Intelligence Fusion
Threat Feeds
Advisories and Bulletins
Maneuvering
Vulnerability Scans
-
- Nessus
- OpenVAS
- Retina etc.
False Positives
False Negatives
Log Reviews
Credentialed vs. Non-Credentialed
Intrusive vs. Non-Intrusive
Application
Web App
Network
CVE / CVSS
Configuration Review
Use Shodan to find the Things on the Internet of Things: https://www.shodan.io/
SIEM: Syslog / Security Information and Event Management
Alerts and Reports
Packet Capture
Data Inputs (compare SNMP)
User Behavior Analysis (compare Heuristics)
Sentiment Analysis
Security Monitoring
Log Aggregation
Log Collectors (compare Event Log/Viewer vs. Syslog)
SOAR: Security Orchestration, Automation, and Response
Runbooks
Think of checklists, so you don’t forget steps.
Playbooks
Think of a driver’s manual, with required practices plus decision-making.