-
Notifications
You must be signed in to change notification settings - Fork 1
Home
The security concept called defense in depth postulates that each abstraction layer of the information system (from human to RJ45) must have its own security measures since none of them, alone, is infallible.
(OCNSP-CART-001) Audit network's cartography
(OCNSP-CART-002) Audit machines' cartography
(OCNSP-CART-003) Audit users' cartography
(OCNSP-PHYS-001) Review physical entrances of the buildings
(OCNSP-PHYS-002) Enumerate physical access to Layer 1
(OCNSP-PHYS-003) Test access to server room and patch bay
(OCNSP-PHYS-004) Test access to sensitive assets
(OCNSP-PHYS-005) Test network access through outdoor equipment
(OCNSP-NETW-001) Test for presence of network segmentation
(OCNSP-NETW-002) Test access control between the segments of the network
(OCNSP-NETW-003) Test for the presence and configuration of a dedicated admin subnet
(OCNSP-NETW-004) Test for the presence and configuration of one or more DMZ
(OCNSP-NETW-005) Test for private/public Wifi segmentation with the main network
(OCNSP-NETW-006) Test for the presence and configuration of VoIP networks
(OCNSP-NETW-007) Test for SCADA/ICS segmentation with the main network
(OCNSP-NETW-008) Test for interconnection security with Internet
(OCNSP-NETW-009) Test for interconnection security with remote premises
(OCNSP-NETW-010) Test for interconnection security with partner networks
(OCNSP-NETW-011) Test high availability mechanisms
(OCNSP-NETW-012) Test presence of low layer protocols protection
(OCNSP-NETW-013) Test Network Access Control mechanisms
(OCNSP-PRTC-001) Test for presence/usage of cleartext protocols
(OCNSP-PRTC-002) Test for presence/usage of unsigned protocols prone to poisoning
(OCNSP-PRTC-003) Test for presence/usage of deprecated protocols
(OCNSP-PRTC-004) Test for presence of unauthenticated services
(OCNSP-PRTC-005) Test for presence of redundant protocols
(OCNSP-PRTC-006) Test WiFi security
(OCNSP-INFR-001) Test known vulnerabilities due to outdated OS
(OCNSP-INFR-002) Test known vulnerabilities due to outdated firmware
(OCNSP-INFR-003) Test for default or predictable credentials
(OCNSP-INFR-004) Test Known Exploited Vulnerabilities against Public-Facing equipment
(OCNSP-INFR-005) Test for printers misconfiguration
(OCNSP-INFR-006) Test for IPBX misconfiguration
(OCNSP-INFR-007) Test for Camera misconfiguration
(OCNSP-INFR-008) Test for DNS server misconfiguration
(OCNSP-INFR-009) Test for e-mail server misconfiguration
(OCNSP-INFR-010) Test for Virtual Manager misconfiguration
(OCNSP-INFR-011) Test for Backup server misconfiguration
(OCNSP-INFR-012) Test for Active Directory misconfiguration
TODO
(OCNSP-APSC-001) Check for superfluous programs or services on servers
(OCNSP-APSC-002) Test for known vulnerabilities due to outdated technologies
(OCNSP-APSC-003) Apply OWASP against Web applications
(OCNSP-APSC-004) Test for default or predictable credentials
(OCNSP-APSC-005) Test for Databases misconfiguration
(OCNSP-APSC-006) Test for docker misconfiguration
(OCNSP-DATA-001) Test for anonymous share access
(OCNSP-DATA-002) Enumerate sensitive data storage locations
(OCNSP-DATA-003) Test for different permission through different protocols (NFS, SMB, ...)
(OCNSP-DATA-004) Test users' privilege over sensitive shared folders
(OCNSP-DATA-005) Look for sensitive data in common shares
(OCNSP-DATA-006) Test presence of production data in testing environments
(OCNSP-HOST-001) Review endpoint encryption
(OCNSP-HOST-002) Test for BIOS/UEFI modification
(OCNSP-HOST-003) Test for local Administrator reuse
(OCNSP-HOST-004) Test for VoIP end points phones
(OCNSP-HOST-005) Test for OS misconfiguration
(OCNSP-HOST-006) Test for thick clients
(OCNSP-HOST-007) Check for superfluous programs or services
(OCNSP-HOST-008) Test for overprivileged user on workstations
(OCNSP-AWRN-001) Test for user vigilance over physical entrances
(OCNSP-AWRN-002) Test for sensitive data leak through unsecured support
(OCNSP-AWRN-003) Test for unlocked active sessions
(OCNSP-AWRN-004) Test for vigilance about suspicious activity
(OCNSP-AWRN-005) Test for users'passwords resistance to bruteforce/dictionnary attacks
(OCNSP-REAC-001) Audit detection capabilities
(OCNSP-REAC-002) Audit incident response capabilities
(OCNSP-REAC-003) Audit recovery capabilities (backup)
For any question/support about this project, please visit: www.astar.org.