Solution to Activity 1.4: Recognize Security Tools

Solution to Activity 2.3: Intelligence Gathering Techniques

Solution to Activity 3.3: Intelligence Gathering Tools

Solution to Activity 5.2: Analyze a CVSS Vector

The CVSS vector for the IKE vulnerability shown in Figure 5.23 is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Breaking this down piece by piece gives us the following:

• AV:N indicates that an attacker may exploit the vulnerability remotely over a network. This is the most serious value for this metric.
• AC:L indicates that exploiting the vulnerability does not require any specialized conditions. This is the most serious value for this metric.
• PR:N indicates that attackers do not need any authenticated privileges. This is the most serious value for this metric.
• UI:N indicates that no user interaction is necessary to exploit the vulnerability.
• S:U indicates that the access gained by exploiting this vulnerability is limited to the scope of control of the compromised component.
• C:L indicates that a successful exploitation of this vulnerability would yield partial access to information. This is the middle value for this metric.
• I:N indicates that a successful exploitation of this vulnerability would not allow the unauthorized modification of information. This is the least serious value for this metric.
• A:N indicates that a successful exploitation of this vulnerability would have no availability impact. This is the least serious value for this metric.

Based on this CVSS analysis, the first vulnerability in Figure 5.22 is more serious. They have identical CVSS vectors except for the integrity metric, which is higher for the SSL vulnerability.

Solution to Activity 7.3: Security Architecture Terminology

Solution to Activity 8.1: Federated Security Scenario

Part 1: You should identify two major problems: use of HTTP, rather than HTTPS, and the development team's creation of their own OAuth libraries.

Part 2: Answers may vary but should include detail similar to:

1. What recommendations and advice would you provide to the implementation team?

   The implementation team should use open source or Facebook-provided libraries and code and should follow recommended best practices for implementation. Secure connections should be required for all authentication and authorization traffic.

   A strong answer might also reference the OWASP Facebook development guide at www.owasp.org/index.php/Facebook.

2. What should Example Corp.'s incident response plan include to handle issues involving Facebook Login?

   Responses will vary but should take into account the fact that Example Corp. will now be relying on a third party and will need to know how to contact Facebook, what they will do if Facebook is compromised, and how individual account issues will be handled.

3. Does using Facebook Login create more or less risk for Example Corp.? Why?

   Responses will vary but should take into account use of a third-party authentication service and lack of control of accounts versus the utility of a third-party service provider.

Solution to Activity 8.2: On-site Identity Issues Scenario

Part 1: You should suggest solutions involving local authentication with appropriate monitoring, logging, and management to ensure that local accounts are secure.

Part 2: You should suggest a central identity and access management system to centrally manage credentials and rights, and administrative policies and controls that ensure that roles and rights are updated when users change positions or roles.

Part 3: Answers are left to your own analysis of your work.

Solution to Activity 8.3: Identity and Access Management Terminology

Solution to Activity 9.3: Security Tools

Solution to Activity 11.1: Incident Severity Classification

The functional impact of this incident is high because the organization has lost the ability to sell products to customers. This fits the definition of the “organization is no longer able to provide some critical services to any users.”

The economic impact of this incident is high. The organization expects to lose $2 million per day. This fits the definition of the high category: “The organization expects to experience a financial impact of $500,000 or more.”

The recoverability effort of this incident is extended. The organization has exhausted all internal resources and is seeking a consultant to assist. This fits the extended category definition of “Time to recovery is unpredictable; additional resources and outside help are needed.”

The information impact of this incident is none. The attack described in this scenario is a denial-of-service attack, and there is no indication of the compromise of sensitive information. This fits the none category definition of “No information was exfiltrated, changed, deleted or otherwise compromised.”

Solution to Activity 11.2: Incident Response Phases

Solution to Activity 12.3: Security Tools

Solution to Activity 13.2: Conduct the NIST Rhino Hunt

You can find a complete answer to the NIST Rhino hunt from Activity 13.2 at www.cfreds.nist.gov/dfrws/DFRWS2005-answers.pdf.

Solution to Activity 13.3: Security Tools

Solution to Activity 14.1: Incident Containment Options

Network segmentation

Network isolation

Network removal

Solution to Activity 14.2: Incident Response Activities

Solution to Activity 14.3: Sanitization and Disposal Techniques

Solution to Activity 15.1: Risk Management Strategies

Solution to Activity 16.1: Policy Documents

Solution to Activity 16.3: Compliance Auditing Tools

The testing procedures for PCI DSS requirement 8.2.3 instruct auditors to inspect system configuration settings and verify that the user password/passphrase requirements are set to require a minimum length of at least seven characters and to require that passwords contain both alphabetic and numeric characters.