2. 计算机
  3. Sarah and her security team have carried out many vulnerability tests over the years to locate the weaknesses and vulnerabilitie

Sarah and her security team have carried out many vulnerability tests over the years to locate the weaknesses and vulnerabilitie

admin2013-12-19  21
问题 Sarah and her security team have carried out many vulnerability tests over the years to locate the weaknesses and vulnerabilities within the systems on the network. The CISO has asked her to oversee the development of a threat model for the network. Which of the following best describes what this model is and what it would be used for?
选项 A、A threat model can help to assess the probability, the potential harm, and the priority of attacks, and thus help to minimize or eradicate the threats.
B、A threat model combines the output of the various vulnerability tests and the penetration tests carried out to understand the security posture of the network as a whole.
C、A threat model is a risk-based model that is used to calculate the probabilities of the various risks identified during the vulnerability tests.
D、A threat model is used in software development practices to uncover programming errors.
答案A
解析 A正确。威胁模型是一种确定可以发现漏洞的可能威胁的结构性方法。威胁模型方法观察谁最有可能想要攻击某个组织和他们如何成功发起攻击。威胁模型有助于评估威胁的可能性、潜在的危害和攻击的优先顺序，进而帮助减小或消除威胁。威胁模型是一个确定负面影响资产的威胁和攻击者用于实现其攻击日的的攻击向量的过程。
B不正确。因为攻击模型与脆弱性测试和渗透测试完全不同。这两种测试的目的是以一种集中的方法寻找和查看某个特定事物。威胁模型是一个概念性结构，它是为了抽象地理解一个系统或网络而提出的。威胁模型常被当作一种考虑所有可能攻击向量的工具，而这两种测试是为了确定某个特定漏洞是否存在，会允许某种攻击发生。
C不正确。因为威胁模型并不用于计算。定量威胁分析过程通常用于计算已确定的漏洞成为真正的风险的可能性。这些分析过程可以在威胁模型之后执行，但是它们不是同一个概念。
D不正确。因为尽管威胁模型可以用于软件开发中，但它并不局限于行业的这部分。理解所有类型的威胁至关重要——软件威胁、物理威胁、人员威胁等。威胁模型是一种用于理解不同资产面临的不同类型威胁的高层次结构。威胁模型对确定编程错误并不是必需的。这个模型用于理解某个资产面临的潜在威胁。
转载请注明原文地址:https://kaotiyun.com/show/QAhZ777K
0

CISSP认证

相关试题推荐
随机试题
最新回复(0)