Vulnerability Prioritization for CompTIA CASP+
Question
To prepare for an upcoming audit, the Chief Information Security Officer (CISO) asks for all 1200 vulnerabilities on production servers to be remediated.
The security engineer must determine which vulnerabilities represent real threats that can be exploited so resources can be prioritized to migrate the most dangerous risks.
The CISO wants the security engineer to act in the same manner as would an external threat, while using vulnerability scan results to prioritize any actions.
Which of the following approaches is described?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.C.
http://resources.infosecinstitute.com/the-types-of-penetration-testing/#grefThe approach described in the question is that of a Red Team. A Red Team is a group of individuals or an individual who acts as a threat actor and tries to exploit the vulnerabilities in a system or network to find security weaknesses. The purpose of a Red Team is to identify security gaps and weaknesses that can be exploited by real-world attackers. The Red Team approach can be used for security testing, threat modeling, or vulnerability assessments.
In the context of the question, the security engineer is asked to prioritize remediation of vulnerabilities based on their potential for exploitation. This requires a Red Team approach where the security engineer assumes the role of a threat actor and tries to exploit the vulnerabilities to determine their severity.
A Blue Team, on the other hand, is responsible for defending against attacks and preventing unauthorized access to systems and networks. They use defensive techniques such as firewalls, intrusion detection systems, and other security measures to prevent or mitigate attacks.
A Black Box approach is a testing method where the tester has no prior knowledge of the system or network being tested. The tester is given limited information about the system and is expected to find vulnerabilities through testing.
A White Team is a group of individuals who are responsible for analyzing and testing security controls and identifying weaknesses in security architecture. They work closely with the Blue Team to ensure that the security controls are effective in preventing attacks.
In conclusion, the approach described in the question is that of a Red Team, where the security engineer acts as a threat actor and tries to exploit vulnerabilities to determine their severity, in order to prioritize the remediation efforts.
