Learning Objective: Apply the concept of the Open Web Application Security Project, Common Vulnerability Enumeration, Common Weakness Enumeration, the Common Vulnerability Scoring System and the Common Weakness Scoring System and how to leverage them for security testing
A new start-up enterprise in the banking industry has developed a new core system. The development team has focused on good usability and excellent performance so far. Before going live, the executive board wants to get an independent view about the level of security. They are asking you as security tester to do a black-box-pentest. The task is to test for the most critical vulnerabilities that could be exploitable for the new banking app.
If you want to fulfill this job, how can you leverage standards for your task?
Select TWO options.
A.
You select relevant weaknesses within CWEs standard and execute listed test cases.
B.
You select relevant weaknesses within CWE, choose available exploits for selected CWEs and apply them
C.
You select relevant weaknesses within CWE, you prioritize selected CWEs based on CWSS standard, and you select relevant CVEs covering prioritized CWE
D.
You select relevant weaknesses within CWE, you prioritize selected CWEs based on CVSS standard and derivate individual test cases related the CVSS
E.
For each selected CVE you derive test cases for the banking app and execute them