If there are contractions between the security objectives (anonymity
vs. accountability): The context defines which objectives dominate over
others
1.4.3 CISSP
Domains/Certificates
Security Engineering: Engineering and Management of
Security
Security Assessment and Testing: Designing,
Performing and Analyzing Security Testing
Security Operations: Foundational Concepts,
Investigations, Incident Management and Disaster Recovery
Software Development Security: Understanding,
Applying and Enforcing Software Security
→ This course strives for 80% of TPSSE compliance
1.4.4 Why Security?
Security is context dependent: On localhost and
unprotected UNIX socket isn’t an issue, but forward it with
socat and it becomes a massive security vulnerability!
With every change every test needs to be run again (regression
testing)
Typically ~30 errors in every 1000 lines of code
Growing application complexity
Devices are more and more connected which reduces the need for
physical access
Extensible architectures
1.4.5 Common Terms
Exploit/Proof of Concept
Attack
Vulnerability
Threat
Error
Threat agent gives rise to threat
Threat exploits vulnerability
Vulnerability leads to risk
Risk can damage asset and causes exposure
Exposure can be countermeasured by a safeguard
Safeguard directly affects threat agent
1.4.6 Threat Agents
Virus (i.e. infection)
Hacker (i.e. unauthorized access)
User (i.e. wrong config, data loss)
Fire (i.e. damage to computers)
Worker (i.e. leaking)
Other corporations (i.e. industrial espionage)
Black hats (i.e. buffer overflows, DoS)
Intruders (i.e. physically stealing drives)
1.4.7 Researching
Vulnerabilities
Classifying vulnerabilities by severity (low, middle, high)
Classifying vulnerabilities by exploit range (local or remote)
Intents to find trends and attacks
Intents to find vulnerabilities before they can be exploited
Intents to find countermeasures
1.4.8 CVSS Metrics
Results in a number which can be used to classify the
vulnerability.
