Penetration Testing (Pen Testing), also called ethical hacking or white hat hacking. Test if the vulnerabilities are exploitable

Level 2: Repeatable This level of maturity that some processes are repeatable, possibly with consistent results. Process discipline is unlikely to be rigorous, but where it exists it may help to ensure that existing processes are maintained during times of stress.

Dogs are a physical security control. Access lists and biometrics are technical and regulations are administrative.

Open source software can be protected by a variety of licensing agreement. GNU (General Public License), BSD (Berkeley Software Distribution) and Apache are all examples of this.

MAC (Mandatory Access Control): Often used when Confidentiality is most important. Access to an object is determined by labels and clearance, this is often used in the military or in organizations where confidentiality is very important.

Hot site: Similar to the redundant site, but only houses critical applications and systems, often on lower spec’d systems.

Still often a smaller but a full data center, with redundant UPS', HVACs, ISPs, generators.

We may have to manually fail traffic over, but a full switch can take an hour or less. Near or real-time copies of data.

Quantitative Risk Analysis is where we put a number on the risk: how much does it cost per time? How often does it happen? Asset Value (AV) – How much is the asset worth? Exposure factor (EF) – Percentage of Asset Value lost? Annual Rate of Occurrence (ARO) – How often will this happen each year?

2013 A4 Insecure direct object reference. Users can access resources they shouldn't, by guessing the URL or path, often if it is logical. If you have access to a report names ending in financials_may2017.pdf on your organization's network, you can try guessing other file names you should not have access to financials_August.pdf or financials_2017.pdf Mitigated by proper access control, using non-sequential names or monitoring file usage.

We can still recover files from deleted, formatted or reinstalled drives.

Overwriting is done by writing 0’s or random characters over the data.

As far as we know there is no tool available that can recover even single pass overwriting (not possible on damaged media).

An Extranet is a connection between private Intranets, often connecting business partners' Intranets.