 on network accessed attack as opposed to attack vectors that are possible with physical access to a target system. Security should not be treated as a separate process but be part of the development flow. Assessment of product system security is typically done through third party "Ethical Hacker" engagements (such as 10) who have in-house up-to-date knowledge on security topics. Profiling Profiling (passive information gathering) is the first phase in all cyber-attack scenarios. Attackers can use a variety of sources to learn as much as possible about the target business and how it operates, such as internet searches, social engineering, research of public sources such as Domain Name Systems (DNS) and IP-registrations, dumpster diving (searching the trash) and nonintrusive network scanning. It includes a wide range of techniques to cast a broad information gathering net, including Network Blocks. Network blocks owned by the organization can leak a lot of information about the current and previous infrastructure used. DNS host name enumeration, by brute force guessing of common subdomains. Port scanning is also another useful tool of identifying platforms. Part of the effort of port scanning is to develop a fingerprint to identify your targets. With small cells/femto cells/ RUs sitting on the open internet they become targets through these fingerprinting activities. Once a malicious party has a database of all devices attached to the internet, they can search that database for characteristics to identify particular target devices and move from there. Social media sourcing for identification of persons. Chapter 5 System software Validation of certificate transparency. Certificate Transparency is a system that keeps track of issued certificates in publicly available logs. When the browser opens a connection to a web application, it will check these logs to validate whether the Secure Sockets Layer (SSL) certificate of the server is valid. If the used certificate is not in this list, it could mean that the certifica