Threat Analysis & Vulnerability Management Flashcards

What is the main purpose of vulnerability scanning?

Answer: To identify and assess system vulnerabilities

Vulnerability scanning is a proactive security measure designed to identify weaknesses or flaws in computer systems, networks, and applications. Its main purpose is to systematically scan for known vulnerabilities that attackers could exploit. This assessment helps organizations understand their security posture and prioritize remediation efforts to prevent potential breaches.

Which tool is commonly used for vulnerability assessments?

Answer: Nessus

Nessus is a widely recognized and powerful vulnerability scanner developed by Tenable. It is commonly used to identify security vulnerabilities, misconfigurations, and compliance issues across various systems and networks. Nessus helps organizations proactively assess their security posture and prioritize remediation efforts to strengthen their defenses against cyber threats.

What does CVSS stand for?

Answer: Common Vulnerability Scoring System

CVSS stands for Common Vulnerability Scoring System, which is an open industry standard for assessing the severity of computer system security vulnerabilities. It provides a standardized method to rate vulnerabilities, allowing organizations to prioritize and respond to threats based on their potential impact and exploitability. This system helps in consistent and effective risk management.

Which phase comes after identifying a vulnerability?

Answer: Risk analysis

After identifying a vulnerability, the next crucial phase is risk analysis. This involves evaluating the potential impact of the vulnerability if exploited, considering factors like the likelihood of exploitation and the value of the affected assets. Risk analysis helps prioritize which vulnerabilities need immediate attention and guides the development of effective mitigation strategies.

Which of the following is a threat vector?

Answer: Phishing email

A threat vector is a path or means by which an attacker can gain unauthorized access to a system or network, or deliver a malicious payload. A phishing email is a classic example, as it serves as a delivery mechanism for social engineering attacks, tricking users into revealing sensitive information or installing malware. Understanding threat vectors is crucial for designing effective security defenses.

What is the difference between vulnerability and threat?

Answer: A vulnerability is a weakness and a threat is the danger

A vulnerability is a weakness or flaw in a system that could be exploited by an attacker. A threat, conversely, is a potential danger or action that could exploit such a vulnerability, leading to harm or unauthorized access. Essentially, the vulnerability is the 'hole' in security, and the threat is the 'event' or 'actor' that might use it.

Which database provides vulnerability information?

Answer: NVD

The National Vulnerability Database (NVD) is a U.S. government repository that provides detailed information about known software vulnerabilities. It integrates all publicly available U.S. government vulnerability information, making it a primary and authoritative source for security professionals to research and understand security flaws. Other options like CISA, FDA, and WHO are not primarily vulnerability databases.

What is zero-day vulnerability?

Answer: A vulnerability not yet known to the vendor or public

A zero-day vulnerability refers to a software flaw that is unknown to the vendor or the public, meaning there has been 'zero days' for a patch to be developed. This makes it particularly dangerous as there are no existing defenses against it, allowing attackers to exploit it before anyone is aware of its existence. Once discovered and publicly disclosed, it ceases to be a true zero-day.

Which practice reduces the chance of exploitation?

Answer: Regular patching and updates

Regular patching and updates are critical for reducing the chance of exploitation because they address known vulnerabilities in software and systems. Vendors release patches to fix security flaws as they are discovered, and applying these updates promptly closes potential entry points for attackers. This proactive approach significantly strengthens a system's security posture against known threats.