3.0 Threats and Vulnerabilities

3.7 Implement assessment tools and techniques to discover security threats and vulnerabilities

• Vulnerability scanning and interpret results
• Tools
  • Protocol analyzer
  • Sniffer
  • Vulnerability scanner
  • Honeypots
  • Honeynets
  • Port scanner
• Risk calculations
  • Threat vs. likelihood
• Assessment types
  • Risk
  • Threat
  • Vulnerability
• Assessment technique
  • Baseline reporting
  • Code review
  • Determine attack surface
  • Architecture
  • Design reviews
• Penetration testing
  • Verify a threat exists
  • Bypass security controls
  • Actively test security controls
  • Exploiting vulnerabilities
• Vulnerability scanning
  • Passively testing security controls
  • Identify vulnerability
  • Identify lack of security controls
  • Identify common misconfiguration
• Black box
• White box
• Gray box