- Welcome to Lesson 27, Deep Dive Quiz.
Now, in Lesson 27,
we focused on explaining types of audits and assessments.
In 27.1, we looked at audits and assurance,
including SSAE 18 reports.
In 27.2, we looked at penetration testing concepts,
and then in 27.3,
we looked at penetration testing tools and techniques.
So, you ready to do a quiz? All right.
Make sure you've got that pen or pencil
and that paper ready.
This is really our 27th one,
so I probably don't need to tell you that anymore,
but I do wanna make sure that you stop me, right?
Pause me as much as you need
so that you can get the answers.
All right, let's start that quiz.
Question One.
We are gonna match the SSAE-related term and description.
Let me scroll down a little bit so you can see all of it.
We've got, on the left-hand side,
Type 2, Type 1, SOC1, SOC2, SOC3.
On the right-hand side, we have,
based on the trust service principles, or the TSPs,
relevant to user entities financial statements,
designed for public distribution,
measures effectiveness for a specific period,
or a point-in-time-report.
Right.
These are all SSAE 18-related terms and descriptions.
So go ahead and put me on pause and match these up.
All right, let's try it.
So our first one, based on trust service principles or TSPs,
that's gonna be our SOC2.
Measures effectiveness for a specific period of time,
now that's gonna be a type, that is a type 2.
Relevant to the user entity's financial statements,
that's what we used to call a SAS 70,
and that's gonna be a SOC1.
Designed for public distribution, that's a SOC3.
And it does the same type of testing as a SOC2,
but doesn't have any proprietary information
and doesn't detail any of the testing.
And a type 1 is a point in time.
So let's go through that.
A type two SSAE 18 is a measures effectiveness
for a specific period.
A type one is a point in time.
As of a particular date, do those controls exist?
A SOC1 is relevant
to the user entity's financial statements,
and a SOC1 is an agreed upon scope
between the audit firm and the company being audited.
A SOC2 is based on the trust service principles
where the organization that's being audited
gets to choose what categories they wanna be audited on,
but they don't have any say over the controls
or the control criteria.
That's all done by the auditing firm.
Remember, the SOC2 is also gonna have
a lot of proprietary information in it,
and it will detail all of the testing and the results.
So you'll probably have to sign an NDA to get a SOC2.
And then we get to a SOC3.
And SOC3, the same type of testing has been done as a SOC2,
but all of that proprietary information
and that testing information has been stripped out.
It's really designed for public distribution,
kinda more of a marketing tool.
You agree?
All right, let's try it.
And that is correct.
All right.
Your organization is negotiating a contract
with a third-party
to conduct quarterly penetration tests.
It is operationally critical
that compromise exploitation not be permitted.
How would you best communicate this requirement?
Disallow all escalation of privilege attempts.
In the ROE, state that all testing
follow proof-of-concept protocol.
Inform target personnel of the testing schedule
and have them plan for potential exploits.
Or, document expectations and requirements in an audit plan.
And so what do we have here?
Right, your organization is negotiating a contract.
You're gonna have these quarterly penetration tests,
but you absolutely do not want compromise exploitation,
right?
What do you want instead?
Think about that.
And how are we going to best communicate that requirement?
Go ahead and put me on pause
while you read through those again, if you want.
Well, I'm gonna choose, in my ROE,
that's my rules of engagement,
I'm gonna state that all testing
follow proof-of-concept protocol,
which is the opposite of compromise exploitation.
Compromise exploitation is just go for it, do it all,
where proof-of-concept says just do enough,
so that you can prove to me or show me
that this exploit is possible.
Disallowing all escalation of privilege attempts.
That means finding everything that would have
a related vulnerability, which isn't a bad idea,
except that it's not relevant to our question here.
Inform our target personnel of the testing
and have them plan for potential exploits.
Well, we don't want those exploits.
That's what we wanna stop upfront.
And document expectations and requirements in an audit plan
where we use an audit plan for an audit,
but for a penetration test or for a vulnerability assessment
or a configuration assessment,
we use an ROE, or rules of engagement.
So I'm gonna choose an ROE,
state that all testing follow proof-of-concept protocol.
Let's try it. Let's see what you think.
And that's correct.
All right. Number three.
This technique is used to infer characteristics
about a population,
based upon the characteristics of a chosen group.
It says, examining, sampling, auditing, or interviewing.
So we're inferring characteristics about a population,
based on the characteristics of a chosen group
of a smaller group.
What is it?
Evidence? Excuse me.
Examining, sampling, auditing, or interviewing.
Are you ready?
I'm gonna choose sampling,
because sampling is a technique that we use
to infer characteristics about a population,
based upon the characteristics of a chosen group
of the sample group.
You agree?
Let's check, and that is correct.
Okay. Question number four.
This exploitation technique uses a weakness on one system
to access a better protected system.
Is this escalation of privileges, persistence, pivoting,
or teaming?
It's the exploitation technique that uses a weakness
on one system
to access a better protected system.
You can put me on pause if you wanna think about it.
Well, let's go through them.
Escalation of privilege
is when we're going to exploit a vulnerability
that would allow us to have privilege access to a resource
really over and above what a user would have
or an application would have.
So that's not it.
Persistence is the act of installing something
like creating users or installing malware or backdoors
or rootkits that survive reboots.
Well, that's not what we're talking about here, either.
Ah, pivoting.
Pivoting is the technique that uses a weakness on one system
to access a better protected system.
So I'm gonna choose that.
Teaming, that was just a term that was thrown in here.
So do you agree with pivoting?
Let's check, and that's correct.
All right.
We are going to put the penetration test phases
in the correct order.
So our options here are additional research,
exploitation, analysis and reporting,
continued exploitation, active reconnaissance,
and passive reconnaissance.
And we'll start with number one as the first step.
So go ahead and put me on pause,
so you can get these in the right order.
So add 'em down.
Okay, so what are we gonna start with?
We're gonna start with passive footprinting.
That's the first thing we're gonna do.
So no interaction, right?
Just learning about the target.
Then we wanna dive in a little bit deeper
and get more specific information about the target.
That's gonna be our active reconnaissance.
Oops, active reconnaissance.
There we go.
All right.
After we have done our active reconnaissance
and our passive reconnaissance,
we should have enough information
to begin crafting our exploits.
So exploitation.
Now that exploitation could be manual,
it could be automated,
it could be like right out-of-the-box exploits,
or it could be specifically crafted exploits.
But generally those first exploits,
we're gonna learn more about our target.
So that might mean
that we're gonna do some additional research,
and after we've done some additional research,
we're gonna do our continued exploitation.
And that's a very iterative process.
That might happen over and over again.
We learn something, we do some research,
we continue exploiting.
We keep fine-tuning, right, what our exploitations are.
And then lastly, we have analysis and reporting.
So, passive footprinting, active reconnaissance,
exploitation, additional research, continued exploitation,
and analysis and reporting.
Now, just in one and two, just to be clear,
footprinting and reconnaissance,
those are interchangeable terms.
All right, so do you agree with our order?
All right, let's check.
And that is correct.
Awesome. Another great job.
All right.
Up next, we're going into Lesson 28, which is:
Given a scenario, implement security awareness practices.
I'll see you there.