Competition

Question 1

What is a vulnerability Assessment?

Answer 1

A vulnerability scan is a static inspection of network components, to identify security holes. It’s conducted with automated software and lists out security issues and grades according to CVSS.

Question 2

What are the limitations of vulnerability assessments?

Answer 2

Doesnt consider the actual business impact and has a lot of false positives. Also lacks dynamic context of the network, data and human error.

Question 3

List 5 examples of Vulnerability Assessment solutions.

Answer 3

1. Nexpose (Rapid7)
2. Beyondtrust Network Security Scanner
3. Nessus (Tenable)
4. Qualys
5. OpenVAS (opensource, we use it)

Question 4

What is a Breach and Attack Simulator?

Answer 4

Deploys agents across a network which communicate with eachother and deploy simulated attacks.

Question 5

List 6 examples of BAS tools?

Answer 5

1. Cymulate
2. AttackIQ
3. Metasploit (Rapid7)
4. Core Security
5. Wireshark
6. SAINT

Question 6

What are the 2 key shortcomings of BAS tools compared to PenTera?

Answer 6

1. They require agents.
2. They are tools for experienced Pentesters, you need to be technical to use them. With PenTera you only need a very basic understanding of cyber security.