Several tools are available for use by security professionals and attackers alike. If you’re planning on taking the Security+ exam, you should have a basic understanding of security tools. For example, can you answer this question?
Q. Security administrators have recently implemented several security controls to enhance the network’s security posture. Management wants to ensure that these controls continue to function as intended. Which of the following tools is the BEST choice to meet this goal?
A. Routine audit
B. Change management
C. Design review
D. Black box test
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Performing Routine Audits
Many organizations perform routine audits to help identify risks. An audit provides an independent and objective examination of processes and procedures. It can help an organization determine its security posture and verify that the organization is following its policies. Internal personnel or external auditors can conduct audits.
Routine audits can verify any system processes or organizational policy. For example, a security policy might state employees should notify a security manager as soon as possible after identifying an incident. The audit verifies personnel are following this policy. Another audit might verify that security controls such as a recently installed intrusion detection system (IDS) continues to function as intended.
Similarly, a security policy may state that when an employee leaves the company, an administrator must disable the employee’s account. This prevents the ex-employee or someone else from using the account. This type of account management policy can prevent attacks such as an example where the employee installed a logic bomb after learning he lost his job.
If the audit discovers that accounts are not disabled, the organization then takes steps to identify and correct the problem. Is a written policy in place? Do appropriate personnel know their responsibilities in relation to the policy? Are processes in place that allow personnel to meet their responsibilities?
In some situations, existing processes don’t support written policies, and the audit helps identify the problem. For example, imagine a single administrator is tasked with disabling accounts, but no one informs the administrator of employee terminations until days later. Obviously, there’s no way the administrator will disable the accounts immediately. To prevent this type of situation, many organizations coordinate exit interviews with security personnel who disable the account during the exit interview.
User Reviews
User access reviews and user rights and permissions reviews are both a type of audit. A basic security principle is the principle of least privilege, and these reviews help verify users have the rights and permissions they need, but no more. This includes ensuring users have the ability to access only the resources they need to perform their job.
A user access review includes a review of what users have accessed, and can detect accounts from ex-employees that are still enabled. A user rights and permissions review identifies the privileges (rights and permissions) granted to users, and compares these against what the users need. These reviews can detect two common problems: privilege creep and inactive accounts.
Privilege creep (or permission bloat) occurs when a user is granted more and more privileges due to changing job requirements, but unneeded privileges are never removed. For example, imagine Lisa is working in the Human Resources (HR) department, so she has access to HR data. Later, she transfers to the Sales department and administrators grant her access to sales data. However, no one removes her access to HR data even though she doesn’t need it to perform her job in the Sales department.
Organizations commonly use a role-based access control model with group-based privileges, For example, Lisa’s user account would be in required HR department security groups, granting her appropriate privileges for her job. When she transfers, administrators would add her to the Sales department groups, granting her appropriate privileges for her new job. An organization should also have account management controls in place to ensure that administrators remove her account from the HR department security groups.
Most organizations ensure that user rights and permission reviews are performed at least once a year, and some organizations perform them more often. The goal is to do them often enough to catch potential problems and prevent security incidents. However, unless they can be automated, they become an unnecessary burden if security administrators are required to do them too often, such as daily or even once a week.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Remember this
Routine audits help an organization ensure they are following their policies, such as the principle of least privilege and account management control best practices. A user rights and permissions review ensures that users have only the access they need and no more and can detect privilege creep issues. It also ensures that inactive accounts are either disabled or deleted.
Q. Security administrators have recently implemented several security controls to enhance the network’s security posture. Management wants to ensure that these controls continue to function as intended. Which of the following tools is the BEST choice to meet this goal?
A. Routine audit
B. Change management
C. Design review
D. Black box test
Answer is A. A routine audit can verify controls are continuing to operate as intended.
Change management controls can help ensure that systems don’t suffer from unintended outages after a change, and although change management helps ensure the controls aren’t modified, it doesn’t necessarily ensure the controls continue to operate as intended.
A design review would be done before the controls are deployed.
A black box test is a type of penetration test where the testers don’t have any knowledge of the system, so it wouldn’t be able to identify if the controls are functioning as intended.
