DOCSLIB.ORG

Technical Guide to Information Security Testing and Assessment

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Technical Guide to Information Security Testing and Assessment Special Publication 800-115 Technical Guide to Information Security Testing and Assessment Recommendations of the National Institute of Standards and Technology Karen Scarfone Murugiah Souppaya Amanda Cody Angela Orebaugh NIST Special Publication 800-115 Technical Guide to Information Security Testing and Assessment Recommendations of the National Institute of Standards and Technology Karen Scarfone Murugiah Souppaya Amanda Cody Angela Orebaugh C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2008 U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology Dr. Patrick D. Gallagher, Deputy Director TECHNICAL GUIDE TO INFORMATION SECURITY TESTING AND ASSESSMENT Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology (IT). ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-115 Natl. Inst. Stand. Technol. Spec. Publ. 800-115, 80 pages (Sep. 2008) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessa rily the best available for the purpose. ii TECHNICAL GUIDE TO INFORMATION SECURITY TESTING AND ASSESSMENT Acknowledgements The authors, Karen Scarfone and Murugiah Souppaya of the National Institute of Standards and Technology (NIST) and Amanda Cody and Angela Orebaugh of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would like to acknowledge John Connor, Tim Grance, Blair Heiserman, Arnold Johnson, Richard Kissel, Ron Ross, Matt Scholl, and Pat Toth of NIST and Steve Allison, Derrick Dicoi, Daniel Owens, Victoria Thompson, Selena Tonti, Theodore Winograd, and Gregg Zepp of Booz Allen Hamilton for their keen and insightful assistance throughout the development of the document. The authors appreciate all the feedback provided during the public comment period, especially by Marshall Abrams, Karen Quigg, and others from MITRE Corporation; William Mills of SphereCom Enterprises; and representatives from the Financial Management Service (Department of the Treasury) and the Department of Health and Human Services (HHS). Trademark Information All names are registered trademarks or trademarks of their respective companies. iii TECHNICAL GUIDE TO INFORMATION SECURITY TESTING AND ASSESSMENT Table of Contents Executive Summary..............................................................................................................ES-1 1. Introduction ......................................................................................................................1-1 1.1 Authority...................................................................................................................1-1 1.2 Purpose and Scope .................................................................................................1-1 1.3 Audience ..................................................................................................................1-1 1.4 Document Structure .................................................................................................1-2 2. Security Testing and Examination Overview ................................................................2-1 2.1 Information Security Assessment Methodology.......................................................2-1 2.2 Technical Assessment Techniques .........................................................................2-2 2.3 Comparing Tests and Examinations ........................................................................2-3 2.4 Testing Viewpoints...................................................................................................2-4 2.4.1 External and Internal ....................................................................................2-4 2.4.2 Overt and Covert ..........................................................................................2-5 3. Review Techniques..........................................................................................................3-1 3.1 Documentation Review ............................................................................................3-1 3.2 Log Review ..............................................................................................................3-1 3.3 Ruleset Review ........................................................................................................3-2 3.4 System Configuration Review..................................................................................3-3 3.5 Network Sniffing.......................................................................................................3-4 3.6 File Integrity Checking .............................................................................................3-4 3.7 Summary..................................................................................................................3-5 4. Target Identification and Analysis Techniques.............................................................4-1 4.1 Network Discovery ...................................................................................................4-1 4.2 Network Port and Service Identification ...................................................................4-3 4.3 Vulnerability Scanning .............................................................................................4-4 4.4 Wireless Scanning ...................................................................................................4-6 4.4.1 Passive Wireless Scanning ..........................................................................4-8 4.4.2 Active Wireless Scanning .............................................................................4-9 4.4.3 Wireless Device Location Tracking ..............................................................4-9 4.4.4 Bluetooth Scanning ....................................................................................4-10 4.5 Summary................................................................................................................4-10 5. Target Vulnerability Validation Techniques ..................................................................5-1 5.1 Password Cracking ..................................................................................................5-1 5.2 Penetration Testing..................................................................................................5-2 5.2.1 Penetration Testing Phases .........................................................................5-2 5.2.2 Penetration Testing Logistics .......................................................................5-5 5.3 Social Engineering ...................................................................................................5-6 5.4 Summary..................................................................................................................5-7 6. Security Assessment Planning.......................................................................................6-1 6.1 Developing a Security Assessment Policy...............................................................6-1 6.2 Prioritizing and Scheduling Assessments ................................................................6-1 6.3 Selecting and Customizing Techniques...................................................................6-3 iv TECHNICAL GUIDE TO INFORMATION SECURITY TESTING AND ASSESSMENT 6.4 Assessment Logistics ..............................................................................................6-4 6.4.1 Assessor Selection and Skills.......................................................................6-5 6.4.2 Location Selection ........................................................................................6-6 6.4.3 Technical Tools and Resources Selection ...................................................6-8 6.5 Assessment Plan Development .............................................................................6-10 6.6 Legal Considerations .............................................................................................6-12 6.7 Summary................................................................................................................6-12 7. Security Assessment Execution.....................................................................................7-1
Load more

Recommended publications
  • Servicenow Vulnerability Response
    ServiceNow Vulnerability Response Connect security and IT The vulnerability challenge Coordinate response across teams for smoother task Critical vulnerabilities often hide under the radar of security challenges today. When exploited, lack of effective vulnerability response carries major impact to handoffs between groups and business reputation and data security. A study conducted by ServiceNow and quicker resolution. Get the Ponemon Institute found that over a third of organizations who suffered a accountability across the breach already knew they were vulnerable. In many cases, there was an existing organization and know work is patch for the vulnerability which was not applied due to reliance on manual getting done with remediation processes, siloed information, and lack of visibility.1 targets. Additionally, breaches are becoming more severe. Methods to exploit Drive faster, more efficient vulnerabilities are growing more sophisticated, with cybercriminals increasingly leveraging machine learning and artificial intelligence to thwart traditional security response vulnerability response mechanisms. Having a solution which interlocks all components —security, risk, and IT— is crucial to organizations staying ahead of Reduce the amount of time these tactics and taking a holistic approach to vulnerability response. spent on basic tasks with orchestration tools. Automatically prioritize and The ServiceNow solution respond to vulnerabilities with workflows and automation. ServiceNow® Vulnerability Response helps organizations respond faster and more efficiently to vulnerabilities, connect security and IT teams, and provide real-time Know your security posture visibility. It connects the workflow and automation capabilities of the Now Platform® with vulnerability scan data from leading vendors to give your teams a View your current vulnerability single platform for response that can be shared between security and IT.
    [Show full text]
  • Designing Vulnerability Testing Tools for Web Services: Approach, Components, and Tools
    Int. J. Inf. Secur. DOI 10.1007/s10207-016-0334-0 REGULAR CONTRIBUTION Designing vulnerability testing tools for web services: approach, components, and tools Nuno Antunes1 · Marco Vieira1 © Springer-Verlag Berlin Heidelberg 2016 Abstract This paper proposes a generic approach for infrastructure, which typically includes an application server, designing vulnerability testing tools for web services, which the operating system, and a set of external systems (e.g. other includes the definition of the testing procedure and the tool services, databases, and payment gateways). Web services components. Based on the proposed approach, we present are one of the cornerstones of service-oriented architecture the design of three innovative testing tools that implement (SOA), making them the lingua franca for systems integra- three complementary techniques (improved penetration test- tion. ing, attack signatures and interface monitoring, and runtime The security of web applications is, in general, quite anomaly detection) for detecting injection vulnerabilities, poor [2,3]. Web services are no exception, and research thus offering an extensive support for different scenarios. A and practice show that web services are often deployed case study has been designed to demonstrate the tools for the with software bugs (i.e. vulnerabilities) that can be mali- particular case of SQL Injection vulnerabilities. The experi- ciously exploited [4]. Injection vulnerabilities, consisting of mental evaluation demonstrates that the tools can effectively improper code that allows the attacker to inject and execute be used in different scenarios and that they outperform commands, enabling, for instance, access to critical data, are well-known commercial tools by achieving higher detection particularly frequent [2].
    [Show full text]
  • A DATA-ORIENTED NETWORK ARCHITECTURE Doctoral Dissertation
    TKK Dissertations 140 Espoo 2008 A DATA-ORIENTED NETWORK ARCHITECTURE Doctoral Dissertation Teemu Koponen Helsinki University of Technology Faculty of Information and Natural Sciences Department of Computer Science and Engineering TKK Dissertations 140 Espoo 2008 A DATA-ORIENTED NETWORK ARCHITECTURE Doctoral Dissertation Teemu Koponen Dissertation for the degree of Doctor of Science in Technology to be presented with due permission of the Faculty of Information and Natural Sciences for public examination and debate in Auditorium T1 at Helsinki University of Technology (Espoo, Finland) on the 2nd of October, 2008, at 12 noon. Helsinki University of Technology Faculty of Information and Natural Sciences Department of Computer Science and Engineering Teknillinen korkeakoulu Informaatio- ja luonnontieteiden tiedekunta Tietotekniikan laitos Distribution: Helsinki University of Technology Faculty of Information and Natural Sciences Department of Computer Science and Engineering P.O. Box 5400 FI - 02015 TKK FINLAND URL: http://cse.tkk.fi/ Tel. +358-9-4511 © 2008 Teemu Koponen ISBN 978-951-22-9559-3 ISBN 978-951-22-9560-9 (PDF) ISSN 1795-2239 ISSN 1795-4584 (PDF) URL: http://lib.tkk.fi/Diss/2008/isbn9789512295609/ TKK-DISS-2510 Picaset Oy Helsinki 2008 AB ABSTRACT OF DOCTORAL DISSERTATION HELSINKI UNIVERSITY OF TECHNOLOGY P. O. BOX 1000, FI-02015 TKK http://www.tkk.fi Author Teemu Koponen Name of the dissertation A Data-Oriented Network Architecture Manuscript submitted 09.06.2008 Manuscript revised 12.09.2008 Date of the defence 02.10.2008 Monograph X Article dissertation (summary + original articles) Faculty Information and Natural Sciences Department Computer Science and Engineering Field of research Networking Opponent(s) Professor Jon Crowcroft Supervisor Professor Antti Ylä-Jääski Instructor(s) Dr.
    [Show full text]
  • Opentext Product Security Assurance Program
    The Information Company ™ Product Security Assurance Program Contents Objective 03 Scope 03 Sources 03 Introduction 03 Concept and design 04 Development 05 Testing and quality assurance 07 Maintain and support 09 Partnership and responsibility 10 Privavy and Security Policy 11 Product Security Assurance Program 2/11 Objective The goals of the OpenText Product Security Assurance Program (PSAP) are to help ensure that all products, solutions, and services are designed, developed, and maintained with security in mind, and to provide OpenText customers with the assurance that their important assets and information are protected at all times. This document provides a general, public overview of the key aspects and components of the PSAP program. Scope The scope of the PSAP includes all software solutions designed and developed by OpenText and its subsidiaries. All OpenText employees are responsible to uphold and participate in this program. Sources The source of this overview document is the PSAP Standard Operating Procedure (SOP). This SOP is highly confidential in nature, for internal OpenText consumption only. This overview document represents the aspects that are able to be shared with OpenText customers and partners. Introduction OpenText is committed to the confidentiality, integrity, and availability of its customer information. OpenText believes that the foundation of a highly secure system is that the security is built in to the software from the initial stages of its concept, design, development, deployment, and beyond. In this respect,
    [Show full text]
  • Password Cracking / Brute-Force Tools Password Cracking / Brute-Force Tools
    Color profile: Disabled Hacking / Anti-Hacker Tool Kit, 3rd Ed / Shema, Davis, Cowen & Philipp / 226286-9 / Chapter 8 Composite Default screen Presented by: 8 PasswordPassword CrackingCracking // Brute-ForceBrute-Force ToolsTools 195 Reproduced from the book “Anti-Hacker Tool Kit, Third Edition." Copyright © 2006, The McGraw-Hill Companies, Inc. Reproduced by permission of The McGraw-Hill Companies, Two Penn Plaza, NY, NY 10121-2298. Written permission of The McGraw-Hill Companies, Inc. is required for all other uses. P:\010Comp\Hacking\286-9\ch08.vp Monday, January 23, 2006 12:28:07 PM Color profile: Disabled Hacking / Anti-Hacker Tool Kit, 3rd Ed / Shema, Davis, Cowen & Philipp / 226286-9 / Chapter 8 Composite Default screen 196 Anti-Hacker Tool Kit smile, a house key, a password. Whether you’re trying to get into a nightclub, your house, or your computer, you will need something that only you possess. On a Acomputer network, users’ passwords have to be strong enough so that Dwayne can’t guess Norm’s password and Norm can’t steal Dwayne’s password (since Dwayne might have written it on the bottom of his keyboard). Bottom line—one weak password can circumvent secure host configurations, up-to-date patches, and stringent firewall rules. In general an attacker has two choices when trying to ascertain a password. He can ob- tain a copy of the password or hash if encrypted and then use brute-force tools to crack the encrypted hash. Or he can try to guess a password. Password cracking is an old technique that is most successful because humans are not very good random sequence generators.
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • Hydra: a Declarative Approach to Continuous Integration1
    Hydra: A Declarative Approach to Continuous Integration1 Eelco Dolstra, Eelco Visser Department of Software Technology, Faculty of Electrical Engineering, Mathematics and Computer Science (EWI), Delft University of Technology, The Netherlands Abstract There are many tools to support continuous integration: the process of automatically and con- tinuously building a project from a version management repository. However, they do not have good support for variability in the build environment: dependencies such as compilers, libraries or testing tools must typically be installed manually on all machines on which automated builds are performed. In this paper we present Hydra, a continuous build tool based on Nix, a package manager that has a purely functional language for describing package build actions and their dependencies. This allows the build environment for projects to be produced automatically and deterministically, and so significantly reduces the effort to maintain a continuous integration en- vironment. 1. Introduction Hydra is a tool for continuous integration testing and software release that uses a purely func- tional language to describe build jobs and their dependencies. Continuous integration (Fowler and Foemmel 2006) is a simple technique to improve the quality of the software development process. An automated system continuously or periodically checks out the source code of a project, builds it, runs tests, and produces reports for the developers. Thus, various errors that might accidentally be committed into the code base are automatically caught. Such a system allows more in-depth testing than what developers could feasibly do manually: • Portability testing: The software may need to be built and tested on many different plat- forms.
    [Show full text]
  • Vulnerability Management: Overview
    Resource ID: w-013-3774 Cybersecurity Tech Basics: Vulnerability Management: Overview SEAN ATKINSON, CIS™ (CENTER FOR INTERNET SECURITY), WITH PRACTICAL LAW INTELLECTUAL PROPERTY & TECHNOLOGY Search the Resource ID numbers in blue on Westlaw for more. A Practice Note providing an overview of what Design, implementation, or other vendor oversights that create defects in commercial IT products (see Hardware and Software cyber vulnerability management programs Defects). are, how they work, and the key role they play Poor setup, mismanagement, or other issues in the way an in any organization’s information security organization installs and maintains its IT hardware and software components (see Unsecured Configurations). program. This Note discusses common types of Vulnerability management programs address these issues. Other cyber vulnerabilities and core process steps for common vulnerabilities that organizations must also tackle in their implementing and maintaining a vulnerability information security programs include: management program to decrease cybersecurity Gaps in business processes. Human weaknesses, such as lack of user training and awareness. risks. It also addresses common pitfalls that Poorly designed access controls or other safeguards. can lead to unnecessary cyber incidents and Physical and environmental issues. data breaches. Unlike threats, organizations can often directly control their vulnerabilities and therefore minimize the opportunities for threat actors. Most organizations depend on a combination of commercial and custom-developed hardware and software products to support their Organizations that develop their own in-house software should information technology (IT) needs. These technology components use security by design techniques to avoid creating vulnerabilities. inevitably include vulnerabilities in their design, setup, or the code that For more information on assessing overall data security risks and runs them.
    [Show full text]
  • TV Superscan 2 Enhanced Users Guide
    TV Superscan 2 Enhanced Users Guide To Reset the TV SuperScan Unit: 1. Unplug Power from Unit 2. Press & Hold “Select” and “Zoom” buttons at the same time. 3. While holding buttons, plug in power. When red lights on, release the two buttons. 4. If you get some output on the screen press the “Zoom” button once more to complete the reset procedure. © 1998 ADS Technologies. All Rights Reserved First Edition: Revision 1.0 April, 1998 Microsoft, MS-DOS, Windows, and Windows 95 and Windows 98 are registered trademarks of Microsoft Corporation. IBM is a registered trade- mark of International Business Machines, Inc. ADS is a registered trademark of ADS Technologies Inc. ADS Technologies (ADS) makes no warranty of any kind with regard to this material, including but not limited to, the implied warranties of mer- chantability and fitness for a particular purpose. The information furnished within this written document is for information purposes only and is sub- ject to change without notice. ADS Technologies assumes no responsi- bility or liability for any errors or inaccuracies that may appear herein. ADS makes no commitment to update or to keep current information contained within this document. Table of Contents A Letter from the President of ADS . 6 Introduction . 7 System Requirements . 7 Package Contents . 8 Chapter 1 Installation Guide . 9 Installing the Hardware . 11 Connecting to a Desktop Computer . 11 Connecting to a Laptop Computer . 14 Connection Diagrams. 16 Desktop Connection Diagram . 16 Laptop Connection Diagram . 16 Chapter 2 TV Superscan 2 Enhanced . 17 Overview . 19 Menu/Enter Button . 19 Select .
    [Show full text]
  • Kali Linux Penetration Testing Bible
    Telegram Channel : @IRFaraExam Table of Contents Cover Title Page Introduction What Does This Book Cover? Companion Download Files How to Contact the Publisher How to Contact the Author CHAPTER 1: Mastering the Terminal Window Kali Linux File System Managing Users and Groups in Kali Files and Folders Management in Kali Linux Remote Connections in Kali Kali Linux System Management Networking in Kali Linux Summary CHAPTER 2: Bash Scripting Basic Bash Scripting Printing to the Screen in Bash Variables Script Parameters User Input Functions Conditions and Loops Summary CHAPTER 3: Network Hosts Scanning Basics of Networking Network Scanning DNS Enumeration Telegram Channel : @IRFaraExam Summary CHAPTER 4: Internet Information Gathering Passive Footprinting and Reconnaissance Summary CHAPTER 5: Social Engineering Attacks Spear Phishing Attacks Payloads and Listeners Social Engineering with the USB Rubber Ducky Summary CHAPTER 6: Advanced Enumeration Phase Transfer Protocols E‐mail Protocols Database Protocols CI/CD Protocols Web Protocols 80/443 Graphical Remoting Protocols File Sharing Protocols Summary CHAPTER 7: Exploitation Phase Vulnerabilities Assessment Services Exploitation Summary CHAPTER 8: Web Application Vulnerabilities Web Application Vulnerabilities Summary CHAPTER 9: Web Penetration Testing and Secure Software Development Lifecycle Web Enumeration and Exploitation Secure Software Development Lifecycle Summary CHAPTER 10: Linux Privilege Escalation Telegram Channel : @IRFaraExam Introduction to Kernel Exploits and Missing Configurations
    [Show full text]
  • Secure by Design, Secure by Default: Requirements and Guidance
    Biometrics and Surveillance Camera Commissioner Secure by Design, Secure by Default Video Surveillance Products Introduction This guidance is for any organisation manufacturing Video Surveillance Systems (VSS), or manufacturing or assembling components intended to be utilised as part of a VSS. It is intended to layout the Biometrics and Surveillance Camera Commissioners (BSCC) minimum requirements to ensure such systems are designed and manufactured in a manner that assures they are Secure by Design. It also contains certain component requirements that will ensure a configuration that is Secure by Default when the component is shipped, thereby making it more likely that the system will be installed and left in a secure state. This guidance forms part of a wider suite of documentation being developed as part of the SCC Strategy, in support of the SCC Code of Practice. Background and Context The nature of the Internet means that connected devices can be subjected to a cyber attack from anywhere in the world. Widespread attacks on connected products is a current and real threat, and a number of highly publicised attacks have already occurred. The Mirai malware targeted devices such as internet-enabled cameras (IP cameras). Mirai was successful because it exploited the use of common default credentials (such as a username and password being set by the manufacturer as ‘admin’) and poor security configuration of devices. Ultimately, this facilitated attacks on a range of commercial and social media services and included an outage of streaming services such as Netflix. An evolution of Mirai, called Reaper, has also been discovered. Reaper used publicly and easily available exploits that remained unfixed (patched) and highlighted the problem around non patching of known security vulnerabilities, allowing attackers to utilise them to cause harm.
    [Show full text]
  • Network‐Based Approaches for Pathway Level Analysis
    Network-Based Approaches for Pathway UNIT 8.25 Level Analysis Tin Nguyen,1 Cristina Mitrea,2 and Sorin Draghici2,3 1Department of Computer Science and Engineering, University of Nevada, Reno, Nevada 2Department of Computer Science, Wayne State University, Detroit, Michigan 3Department of Obstetrics and Gynecology, Wayne State University, Detroit, Michigan Identification of impacted pathways is an important problem because it allows us to gain insights into the underlying biology beyond the detection of differ- entially expressed genes. In the past decade, a plethora of methods have been developed for this purpose. The last generation of pathway analysis methods are designed to take into account various aspects of pathway topology in order to increase the accuracy of the findings. Here, we cover 34 such topology-based pathway analysis methods published in the past 13 years. We compare these methods on categories related to implementation, availability, input format, graph models, and statistical approaches used to compute pathway level statis- tics and statistical significance. We also discuss a number of critical challenges that need to be addressed, arising both in methodology and pathway repre- sentation, including inconsistent terminology, data format, lack of meaningful benchmarks, and, more importantly, a systematic bias that is present in most existing methods. C 2018 by John Wiley & Sons, Inc. Keywords: systems biology r pathway r topology r gene network r survey r pathway analysis How to cite this article: Nguyen, T., Mitrea, C., & Draghici, S. (2018). Network-based approaches for pathway level analysis. Current Protocols in Bioinformatics, 61, 8.25.1–8.25.24. doi: 10.1002/cpbi.42 INTRODUCTION this gap is the fact that living organisms are With rapid advances in high-throughput complex systems whose emerging phenotypes technologies, various kinds of genomic are the results of multiple complex interactions data have become prevalent in most of taking place on various metabolic and signal- biomedical research.
    [Show full text]