Mod 5 Student Created

ESS Tier Scructure: Tier 1

A DoD Info sys used to record, track, and disseminate critical vulnerability info throughout DoD Enterprise network.

Who is responsible for remediation assets that are supported by a weapons program management office?

Technique used to control net access by monitoring outing and incoming packets and either allowing or blocking them

software packages used to scan looking for weaknesses like open port exploitations, weak passwords

is designed to support a faster pace of system updating and patch management for our network connected Windows devices

Who directs NOS, NCC/CFP and PMOs to implement Normal vulnerability remediation actions via the three-tiered model?

What uses sensors to detect & alert abnormalities?

performs config scans of servers, ntwk dev and databases to test for specific policy settings

a comprehensive STIG compliance tool that provides sec monitoring, and DISA STIG-specific audit logs

MECM hierarchy is comprised of three tiers

What are the overall Purposes of ESS

An open-source, multi-platform, and lightweight IDS?

Analyzes code at fixed points during its development.

responsible for patching vul on servers, network infrastructure, boundary devices and all other IP capable assets

This function is provided in ESS to monitor and report on subnets, usinglayer 2 traffic, for undefended machines:

Who is responsible for SDC and SSC?

Detects when a program is not calling the proper applications, processes, or actions

This is the top of the line IDS available on the market today and it is not free.

What is a DISA-led formal inspection designed to increase accountability and the security posture of DoD information

The 690th NSS/AMAC verifies compliance percentages via…

SSL was replaced by TLS

_______ ________aims to reduce the risk on systems and applications due to out-of-date code bases.

What is primarily utilized to protect the endpoint from unauthorized device insertions?

What describes how to minimize network-based attacks and prevent system access for DOD IA and IA enabled devices?

Anomaly based detection first identifies normal operation or normal behavior.

Secondary Sites that connect to a Primary Site

Who is responsible for 95% compliance of vulnerability remediation actions using enterprise tools.

software within ESS that can be utilized for scanning clients and returninginfo from their current state of Windows

Most common method of tracking customers accessing an organization’s website

What attack allows an attacker to piggyback on an existing active session?

Uses a flexible attack signature subsystem.

enables dev teams to spot security issues at all stages of the software supply chain, from design to implementation.

Solar winds has both IDS and IPS

located at Wright-Patterson AFB, is used for large-scale deployments and provides a central point of administration .

devs test the results of unexpected values or inputs to discover which ones cause the app to act in unexpected way

What deployment has a mandatory deadline set time of 24 hours, with a grace period of 4 hours

Who is responsible for maintaining the security posture of the Department of Defense Information Network (DoDIN)?

Ethical hacker breaks into a system to detect vulnerabilities with a goal to protect from real attack.

Attack that involves someone intercepting data being sent between two parties.

Continuous process of identifying, prioritizing, remediating, and reporting on security vulnerabilities?

This monitors for suspicious activity and attempts to stop the activity once detected?

____can be found in the control panel and provides configuration information of the client and available client actions.

Tier 1 of MECM Consists of Primary Sites that house the MECM database

Which of these terms is NOT a part of the RMF process?

Widely adopted sec protocol designed to facilitate privacy and data security for comm over the internet?

A free NIDS that can also perform a signature analysis.

NIDS are local to a host, which may need to be monitored for malicious activity that pertains to specific applications.

A useful auditing tool, but it is not considered a true IDS because it does not analyze and flag packets for anomalies.

Analyzes running code while simulating outside, or “black box" attacks.

what is the term for when code is inserted into and existing programs code?

SCAP can be used to conduct only local scans

CCRI is a squadron led inspection that occurs normally every 3 years

What supports Information Assurance and automates the Risk Management Framework (RMF) process?

an automated compliance scanning tool that leverages the STIGs and OS-specific baselines to analyze

gateways, routers, firewalls, guards, and encrypted tunnels help achieve this

Single console access used by ACAS managing Nessus® scans at the enterprise network level.

What is the first function of ENS

Who is responsible for the remaining 5% of vulnerability remediation actions using enterprise tools