T&E's expertise is in providing early awareness of system strengths and weaknesses during the development process during the system life cycle.

Awareness required to manage risk

Empirical data for validating models and simulations

Testing of technical performance and system maturity

Determination of operation and maintenance efficiency, adaptability and survivability

Identify, manage and reduce risks

Awareness required to manage risk

Empirical data for validating models and simulations

Testing of technical performance and system maturity

Determination of operational effectiveness, adaptability and survivability.

Work with sponsoring organizations to establish or evaluate T&E strategies to support program acquisition/development;

Provide T&E methods that can deeply manage risks;

Monitor T&E processes and changes that may be required;

Evaluate and provide recommendations for suitability of test plans and procedures for development testing or operational testing;

It is further expected to understand the rationale behind acquisition/development procedures for establishing and executing T&E strategies;

Expect to understand the specific activities of T&E testing, such as interoperability testing;

This group is often called the T&E integrated product team and consists of T&E experts, customer user representatives, and other stakeholders;

The T&E strategy is a living document and the team is responsible for updating it when needed;

The team needs to ensure that the T&E process includes acquisition strategies and that the system meets operational requirements based on the capabilities used;

For example, routing log analysis is helpful in identifying security incidents, policy violations, fraudulent behaviors, and operational problems.

Conduct audits and forensic investigations;

Support internal investigations;

Establish a baseline;

Identify operational trends and identify long-term issues;

Need to balance limited log management resources with continuously generated log data

Log production and storage

Need to protect the integrity, confidentiality and availability of logs

Ensure security, system and network administrators analyze log data regularly and effectively.

Define logging requirements and goals

Logging requirements and recommendations should be generated along with the resources and detailed analysis techniques required to implement and maintain logging

Protection of original logs

Optimize logs and requirements, based on perceived organizational risk reduction and the resources and expected time required to perform log management.

Establish log management responsibilities and roles

A log management architecture encompasses the hardware, software, network, and media used to generate, transmit, store, analyze, and process logs.

Designing a log management framework should consider the current and future needs of the management framework as well as independent log sources across the organization.

Administrators of the system should receive adequate support;

Including disseminating information, providing training, providing a point of contact for questions and answers, Provide specific technical guidance, corresponding tools and documentation, etc.

Log administrator responsibilities

Log management process

Log source

challenge

key practices

Web monitoring methods designed to capture or analyze every transaction of every user on the web or app

Also known as real-user measurement, real-user metrics, or end-user experience monitoring (EUM) end-user experience monitoring

passive monitoring Passive monitoring method

Monitor mode

proactive monitoring Proactive or pre-responsive monitoring approach

Does not track actual user sessions

Fully controllable by the client full control over the client

Microsoft System Center Operations Management Software

Increase value

Inappropriate programming patterns such as missing checks affecting user data, SQL injection (input validation)

Mismatch of security infrastructure: excessive access control or weak encryption configuration;

Functional errors in the security infrastructure: access control enforcement facilities themselves do not restrict access to the system;

Logical errors in the implementation process: For example, the user places an order without paying

Top 25

White box (structural testing/open box testing) vs. black box testing (functional testing/closed box testing)

Dynamic testing VS. Static testing Dynamic Testing vs. Static Testing

Manual vs. Automation Manual Testing vs. Automated Testing

attack surface

App types

quality

Support technology

Performance and resource utilization

Architecture security review

Threat Modeling -

Static Source Code Analysis (SAST) and Manual Code Review (static code analysis and manual code review)

Static Binary Code Analysis and Manual Binary Review (static binary code analysis and manual binary review)

Manual or automated penetration testing

Automated vulnerability scanning

Fuzz Testing Tools Fuzz Testing Tools

It is recommended to use passive security testing technology to monitor system behavior and analyze system logs

During software maintenance, patch testing is very important

Software testing has its limitations and it is impossible to complete 100% testing

Test plans and test cases should be developed as early as possible in the software development phase

Software security testing generally starts with unit-level testing and ends with system-level testing.

Structured testing ("white box" testing) Unboxing test

Test cases are based on knowledge gained from source code, detailed design specifications, and other development documents;

Statement Coverage statement coverage

Decision (Branch) Coverage Decision coverage

Condition Coverage condition coverage,

Multi-Condition Coverage Multi-Condition Coverage

Loop Coverage loop coverage

Path Coverage path coverage

Data Flow Coverage data flow coverage

Test cases are defined based on what the software product is specifically supposed to do;

The main challenges for test cases are the intended use and functionality of the program as well as the internal and external interfaces of the program;

Functional testing should be applied to any level of software testing, from unit testing to system level testing

Normal Case Common use case

Output Forcing output requirements,

Robustness Robustness

Combinations of Inputs Input combinations

weakness weakness

Provides high structural coverage

Generate random data from a distribution defined based on the operating environment (intended use, dangerous use, or malicious use of the software product);

Generate large amounts of test data and use it to cover specific areas or areas of concern, providing increased likelihood of identifying single and extremely rare operating conditions that were not anticipated by designers and testers;

reason

Purpose

Unit (module or component) level testing unit test

Integration level testing Integration testing (testing the interfaces between modules)

System level testing System test

Acceptance Test

System testing will present the behavior of the software product in a specific environment;

Test procedures, test data, and test results should be documented in a manner that permits pass/fail decisions;

Enterprise software products are complex, and the testing of software products needs to maintain consistency, completeness and effectiveness;

Software maintenance tasks are different from hardware maintenance. Hardware has preventive maintenance measures but software does not;

Requires valid verification of changes

Software Validation Plan RevisionSoftware Validation Plan Revision,

Anomaly Evaluation exception verification,

Problem Identification and Resolution Tracking Problem identification and resolution tracking,

Proposed Change Assessment Request a change assessment

Task Iteration task iteration,

Documentation Updating Documentation Update

Test cases from the perspective of normal users using the system

Use cases from the perspective of someone with malicious intent on the system.

Make sure the application works as expected and fail if errors are found during forward testing

Make sure your app handles invalid input or unexpected user behavior appropriately.

It mainly checks whether the different components of the application or system development are in sync with each other;

From a technical level, interface testing is mainly used to determine different functions such as Whether data is transferred as designed among the different elements of the system.

Used to ensure software quality

Discovery, collecting information about the target (discovery)

Enumerate, perform port scanning and resource identification methods

Vulnerability exploration, identifying vulnerabilities in identified systems and resources

exploit, attempt to exploit a vulnerability to gain unauthorized access

Report to management and submit reports and safety recommendations to management

Black box testing, zero understanding, the penetration team tests without understanding the test goals

Gray box testing, testing based on knowing some information related to the test goal

White box testing, testing based on understanding the essence of the target

0 knowledge

partial knowledge

all knowledge

Dial a range of phone numbers to find available modems

Some organizations still use modems for communication backup

War dialing is a form of intrusion into an organization's network designed to circumvent firewalls and intrusion detection systems (IDS)

War dial attacks involve attempts to gain access to an organization's internal computing and network resources through dial-in access, This brings convenience to hackers.

self test

There are vulnerabilities in the kernel layer

Countermeasure: Ensure that security patches to the operating system are deployed promptly after adequate testing in the environment to keep the vulnerability window as small as possible.

Countermeasures: good programming practices and development education, source code for automatic scanners, Enhanced programming library to use strong language typing to disallow buffer overflows

Hackers redirect symbolic links to gain unauthorized access.

Countermeasure: When writing programs (especially scripts), there is no way to avoid the full path of the file

A file descriptor is a number used by many operating systems to represent open files in a process. Certain file descriptor numbers are universal and have the same meaning to all programs.

If a program uses file descriptors unsafely, it may allow an attacker to exploit the program's privileges to provide unexpected input to the program, or cause output to go to an unexpected place.

Countermeasures: Good programming practices and development education, automated source code scanners, and application security testing are all ways to reduce this type of vulnerability.

Failure to eliminate environmental vulnerability factors before executing procedures

Can allow an attacker to read or write unexpected data or execute unauthorized commands

Countermeasures: Good programming practices and development education, automated source code scanners and application security testing

When a parent process creates a child process, attention should be paid to race conditions and minimum authorization.

Improper file or directory permissions

Countermeasure: File integrity check, also check the permissions of expected files and directories

Awareness used to define current information security, vulnerabilities and hazards to support organizational information security risk decisions;

Any efforts and processes used to support information security monitoring across the organization must begin with a sophisticated ISCM strategy defined by senior leadership;

It is built on a clear understanding of organizational risk tolerance and helps companies set priorities and manage risk consistency across the organization;

Include metrics to provide a true meaning of security posture at all organizational levels;

Ensure the continued effectiveness of all security controls;

Verify compliance with information security requirements driven by organizational mission/business functions, national laws and regulations, guidance, guidance standards;

All organization IT assets are informed and visibility into asset security is assisted;

Ensure knowledge and control of changes to organizational systems and environment;

Maintain awareness of threats and vulnerabilities.

Information Security Continuous Monitoring (ISCM) of Federal Information Systems and Organizations

ISCM programs are established to collect data based on preset measurement indicators, making it easier to exploit information changes in part through security controls that have been implemented.

Organization-wide risk monitoring cannot be effectively achieved by relying on separate manual processes or solely automated processes:

Measurements include all security-related information from assessment and monitoring produced by automated tools as well as manual procedures, organized into meaningful information to support decision-making and reporting requirements.

Metrics should be driven by specific goals to maintain or improve the security posture.

Metrics develop system-level data that make sense of mission/business context or organizational risk management;

Measurement metrics security-relevant information obtained from different times and with varying levels of latency.

Security Control VolatilitySecurity Control Volatility

System Categories/Impact Levels System Categories/Impact Levels

Security Controls or Specific Assessment Objects Providing Critical FunctionsSecurity Controls or Specific Assessment Objects Providing Critical Functions

Security Controls with Identified Weaknesses Security Controls with Identified Weaknesses

Organizational Risk Tolerance Organizational Risk Tolerance,

Threat InformationThreat Information

Vulnerability Information

Risk Assessment ResultsRisk Assessment Results

Reporting RequirementsNotification requirements

For example, the U.S. Federal Information Security Management Act (FISMA Federal Information Security Management Act) requires federal agencies to conduct self-audits and independent third-party audits of the organization's information security system at least once a year;

Information security professionals need to understand the requirements outlined in legal standards to provide protection, but complete protection or risk management of information systems is rarely achieved;

Information security professionals must ensure proper scope and tailoring to obtain the appropriate number of controls at the correct level for the target system

In order to focus on core competencies, reduce expenses and deploy new application functions more quickly, organizations Continuous outsourcing of systems, business processes and data processing to service providers;

The organization frequently updates the outsourcing service provider's monitoring process and management and outsourcing risks;

Historically, many organizations have relied on Statement on Auditing Standards (SAS) 70 reports to gain comfort with outsourcing activities. However, SAS 70 focuses on internal control over financial reporting (ICOFR) rather than system availability and security.

The SAS70 report was retired in 2011 and replaced by the SOC (Service Organization Control) report;

They are familiar with the work processes within the organization.

high working efficiency

Able to accurately identify the most problematic points

It can make the audit work more flexible, and the management can constantly change the audit needs, allowing the audit team to adjust the audit plan accordingly.

Their access to information systems is relatively limited

There is the possibility of a conflict of interest that impedes objectivity.

Has audited many different information systems and has rich experience

They are unaware of the dynamics and politics within the target organization. will remain objective and neutral

high cost

You still have to deal with the added resources to organize them and oversee their work even with an NDA.

Lack of understanding of the inner workings of the organization.

Contrary to the SOC 1/SOC 2 report, the SOC 1 report requires the service provider to describe his system and define the control objectives and controls related to internal control over financial reporting;

SOC1 reports generally do not cover services and controls that are not relevant to user ICOFR reporting.

SOC1 reports began to be used by many service providers for core financial processing services in 2011;

Period of time reports covering design and operating effectiveness Reports covering design and operating effectiveness over a period of time

The principles and guidelines specifically define security, availability, confidentiality, processing integrity and privacy;

Providing Beyond Internal Control over Financial Reporting (ICOFR);

Based on the needs of service providers and their users, a modular approach can be used to facilitate SOC2/SOC3 reports can cover one or more principles;

If the IT service provider has no impact or has an indirect impact on the user's financial system, the SOC2 report will be used;

SOC3 reports are generally used to inform a wide range of users of their assurance levels without disclosing detailed controls and test results;

1. New employees should read and sign the Acceptable Use Policy (AUP)

2. Confirm employees' compliance with AUP by auditing employee accounts.

3. Retrieve the list of new employees from the human resources department and compare it with the employee accounts opened in the system by the IT department to ensure the effectiveness of communication between the two departments.

4. The policy should also clarify the account expiration time, password policy, and the scope of information that users can access.

Issues with using privileged accounts

1. Normally, each computer user account has local administrator rights, and server management and maintenance personnel have domain administrator rights, both of which are risky.

2. The addition, deletion or modification of accounts should be strictly controlled and documented.

3. Implement hierarchical management of administrator account permissions.

4. Use privileged accounts only when necessary, and use restricted accounts for daily maintenance work.

1. Suspend accounts that are no longer in use.

2. Obtain a list of short-term and long-term leavers from the Ministry of Human Resources, Compare the account status with the IT system and delete the accounts of employees who have been out of work for a long time. And suspend the use of accounts for short-term leavers.

user files

database

Email data

Test data backup situation

Analyze various scenarios of threats that the organization may face

Develop a plan to test all mission-critical data backups in each scenario

Leverage automation to minimize auditor workload and ensure testing occurs regularly

Minimize the impact of the data backup test plan on business processes so that it can be performed regularly

Ensure coverage so that every system is tested, but not necessarily within the same test.

Record results so you know what worked and what needed work

Correct or improve any issues you documented.

Checklist Test Checklist Test

Structured Walk-Through Test Structured Walk-Through Test

Simulation Test Simulation Test

Parallel Test Parallel Test

Full-Interruption Test Full-Interruption Test

Safety training refers to the process of teaching a skill or set of skills that enables people to better perform specific functions.

Security awareness training is the process of exposing people to security issues so that they can recognize them and respond better to them.

In the context of information security, it is the process of manipulating individuals to cause them to perform actions that violate security protocols.

Phishing is social engineering through digital communications.

A driver download is an automated attack that is triggered simply by visiting a malicious website.

Key performance indicators (KPIs) measure how effectively an organization performs a given task at a given time

A measure of the risk inherent in performing a given action or set of actions.

A technical report should be more than the output of an automated scanning tool or a generic inventory.

Elements of a good audit technical report

Reports to senior leaders should be concise and easy to understand, focusing on key findings and recommendations

Risk is best described quantitatively, and one way to quantify risk is to express risk in monetary terms.

Common risk measurement methods

Management reviews should be carried out periodically, otherwise the inspection risk will change from proactive to reactive.

The frequency of meetings should also be synchronized with the length of time required to implement the decisions of the previous review.

review input

management action