★ Starred in your notes: vulnerability assessment = passive, pentest = active · CVSS scoring.
Breakdown 1 — Identification methods
From class — Day 2 Module C: the goal of vulnerability scanning is to find weaknesses (open ports, services, missing patches) before attackers do. Tools: OpenVAS, Nessus (vulnerability scanners); exploit-db.com for known exploits. Vulnerability assessment is passive (identify); penetration testing is active (exploit).
| Method | What it is | Notes |
|---|---|---|
| Vulnerability scan | Automated check against known vulnerabilities/misconfigs | Credentialed (logs in — deeper, fewer false positives) vs. non-credentialed (outsider view); intrusive (may disrupt) vs. non-intrusive; scanner types: network/infrastructure, web application, cloud (class) |
| Application security | Static analysis (source code, before run), dynamic analysis (running app, fuzzing), package monitoring (watch third-party libraries/dependencies for CVEs) | |
| Threat feed | OSINT (free/public), proprietary/third-party (paid — class: "CSINT"), information-sharing organizations (ISAC by sector / ISAO), dark web monitoring (leaked creds, chatter) | |
| Penetration testing | Authorized simulated attack — done after we know what's vulnerable; don't mess up the system (class) | Phases (class): Planning → Discovery → Attack → Reporting (attack and discovery loop) |
| Responsible disclosure / bug bounty | Program that lets outside researchers report bugs safely (and get paid) | |
| System/process audit | Review of configurations and procedures against a standard | Class "security audits": baseline review, attack-surface review, design review, control review, procedure review |
From class — pentest approaches: Unknown environment (black box — tester gets no information, must build the whole picture), Known environment (white box — "give you all information"), Partially known (gray box). ⚠ Your notes had "unknown → white box"; CompTIA's mapping is unknown = black box, known = white box.
Teams: Red (attack), Blue (defend), White (referees/rules), Purple (red + blue working together). Recon: passive (no direct contact — OSINT, DNS records) vs. active ("making the phone calls", port scans). Tools: nmap (
-PN= don't ping, just scan), hping, netcat, scanless, tcpreplay, password crackers,ping(ICMP). Penetrating networks: privilege escalation → establish persistence (backdoor) → lateral movement.
Breakdown 2 — Analysis
| Step | Know |
|---|---|
| Confirmation | False positive — the event was benign but was mistaken for a problem (class). False negative — a problem occurred and the analyst mistook it for benign — the dangerous one. (Class also mentioned "false-positive generation attacks" — flooding the SOC with noise.) |
| Prioritize | Fix what's exploitable and exposed first |
| CVSS | Common Vulnerability Scoring System — criticality score 0–10 from a calculator (class): base metrics (attack vector, complexity, privileges, impact on C/I/A) |
| CVE | Common Vulnerabilities and Exposures — the ID (CVE-2024-1234) |
| Vulnerability classification | Type (injection, misconfiguration, crypto…) and affected asset class |
| Exposure factor | How much of the asset is lost if exploited; class: internal vs. external exposure — an internet-facing flaw outranks an internal one |
| Environmental variables | Your context: is the port filtered? is the host isolated? |
| Industry / organizational impact | Regulatory or business consequences |
| Risk tolerance | How much the org is willing to leave open |
Breakdown 3 — Response and remediation
| Option | When |
|---|---|
| Patching | The default fix — test, schedule (change management) |
| Insurance | Transfer residual financial risk |
| Segmentation | Can't patch → isolate |
| Compensating controls | Alternative protection when the fix isn't possible (WAF rule, extra monitoring) |
| Exceptions and exemptions | Formally accept the risk for a period, with an owner and expiry |
From class: remediation plans go to the users/owners; reports should use plain language.
Breakdown 4 — Validation and reporting
Validation of remediation: rescanning (run the scan again), audit (verify the control exists), verification (prove it works — try the exploit). Reporting: trends, open vs. closed, SLA compliance, exceptions.
Breakdown 5 — Scenario matching
| Scenario | Answer |
|---|---|
| Scanner flags a vuln, but the package isn't installed | False positive |
| Need to test how a system reacts to attacks without disrupting production | Non-intrusive scan (or pentest in a test environment) |
| Want the deepest possible scan results | Credentialed scan |
| Rank 500 findings | CVSS + exposure + asset criticality |
| Patch not available for six months | Compensating control + documented exception |
| Prove the patch worked | Rescan / verification |
| Outside researchers keep finding bugs | Bug bounty / responsible disclosure program |
Quick self-check
- Credentialed vs. non-credentialed scans — which finds more? (Credentialed.)
- Order of the class pentest phases? (Planning → Discovery → Attack → Reporting.)
- Which is worse, a false positive or a false negative? (False negative.)
Sources: 20260917_173205.jpg, 20260917_173234.jpg, 20260917_173241.jpg, 20260917_173248.jpg, 20260917_173252.jpg