Assignment – Module 2: Threat Management and
Cybersecurity Resources
Module Objectives
- Explain penetration testing. - Identify rules of engagement and steps in pen testing. - Define
vulnerability scanning. - Describe cybersecurity resources.
1. Penetration Testing
Definition: Simulated attack to exploit vulnerabilities and test security. Purpose: - Discover hidden
vulnerabilities. - Understand their impact. - Strengthen defenses. Importance of Planning: Prevents
scope creep and legal issues. Why Conduct a Pen Test? - Goes deeper than automated scans. -
Mimics real threat actor techniques. Who Performs the Test? - Internal Security Team: Low cost,
quick, but limited expertise. - External Consultants: Skilled and experienced, but may risk data
misuse. - Crowdsourced Testers (Bug Bounty): Fast, diverse testing, multiple perspectives.
2. Rules of Engagement
- Timing: When tests occur (business hours, start–end dates). - Scope: Defines boundaries
(internal/external targets, locations). - Authorization: Written approval required. - Exploitation: Level
of attack agreed in advance. - Communication: During initiation, status updates, incidents,
emergencies. - Cleanup: Remove scripts, tools, credentials, restore systems. - Reporting:
Executive summary (non-technical) + detailed technical report.
3. Performing a Pen Test
Phase 1: Reconnaissance (Footprinting) - Active: Probing systems, war driving/flying. - Passive:
Open-source intelligence (OSINT). Phase 2: Penetration - Simulates attacker behavior. - Pivoting:
Using one system as gateway. - Requires patience and persistence.
4. Vulnerability Scanning
Definition: Continuous, automated process to identify weaknesses. Differences from Pen Test:
Ongoing, frequent vs. one-time manual test. Conducting Scans: - Decide what/when to scan. -
Interpret results. - Focus on high-value systems. Threat Hunting: Proactive search for undetected
threats using feeds, advisories, and intelligence sources.
5. Cybersecurity Resources
- Frameworks: Guidelines for managing security (NIST, ISO, AICPA, CIS, CSA). - Regulations:
Industry/government compliance (broad, industry-specific, state, international). - Legislation: Laws
on data protection and breach notifications. - Standards: Industry-approved rules, e.g., PCI DSS. -
Benchmarks/Guides: Secure configuration references. - Information Sources: Threat feeds,
bulletins, fusion centers.
Conclusion
- Penetration testing and vulnerability scanning complement each other. - Rules of engagement
ensure safe, legal, and effective testing. - Cybersecurity resources (frameworks, regulations,
standards) provide structured defense. - Together, these practices strengthen organizational
security posture.
