OSSTMM

OSSTMM

1. overview

   • open source testing methodology manual
   • purpose: provide a scientific methodology for the accurate characterization of operational security through examination and correlation of test results in a consistent and reliable way.

2. phases

   • induction
     • posture review
       • culture, norms, legislation, regulations, policy applicable to target
     • logistics
       • know limitations of audit itself. will minimize error and improve efficiency
     • active detection verification
       • know restrictions on interactive tests
   • interaction
     • visibility audity
       • determination of targets to be tested within scope
     • access verificaiton
       • investigate points of access to target system(s)
     • trust verification
       • investigate trust relationships between targets
     • control verification
       • investigate effectiveness of process-based loss controls
         • non-repudiation
         • confidentiality
         • privacy
         • integrity
   • inquest
     • process verification
       • defined controls vs. real, day-to-day use
     • configuration verification, training verification
       • explores default conditions under which targets regularly operate to understand intent, business justification and reasoning of targets
     • property validation
       • licensing and intellectual property use/misuse
     • segregation review
       • know which privacy rights apply and to what extent uncovered, personally identifiable info can be classified based on these requirements
   • intervention
     • quarantine verification
       • effectiveness of authorization & subjugation controls based on black and white lists
     • privileges audit
       • effectiveness of authentication, indemnification and subjugation controls based on depth and roles
     • survivability validation
       • effectiveness of continuity and resilience controls from DOS and denial of interactivity
     • alert & log review, end survey
       • review of audit activities performed with the true depth of those activities as recorded by the target or from a 3rd party as in the control of an alarm