01. Incident Management Operations (471)

Question 1

Incident Management operations

Key phases of incident response;

1. Planning
2. Detection
3. Initiation
4. Analysis
5. Containment
6. Eradication
7. Recovery
8. Remediation
9. Closure
10. Post-Incident Review
11. Retention of Evidence

471

Question 2

Planning

The develipment of written respinse plans, guidelines, and procedures to be followed when an incident occurs

471

Question 3

Detection

The moment in which an organisation is initially aware that a security incident is taking place or has taken place

472

Question 4

Initiation

Incident response begins. Declaration of an incident and notifications

472

Question 5

Analysis

Response teams collect and analyse available data to understand the incidents cause, scope, and impact

472

Question 6

Containment

Direct actions taken by incident responders to contain the advancement of an incident

472

Question 7

Eradication

Incident responders take steps to remove the source of the incident

472

Question 8

Recovery

After evaluation and eradication, recovery of systems to pre-incident state

473

Question 9

Remediation

Involves neccessary changes that will reduce or eliminate the possibility of a similar incident in the future

473

Question 10

Closure

Once eradication, recovery, and remediation have been completed, the incident can be closed

473

Question 11

Post-incident Review

Review of the cause, impact, and response to incident. Lessons to be learned

473

Question 12

Retention of Evidence

Identifying items that need to be retained as part of an incident i.e. items that might be used in legal proceedings.

473

Question 13

Security Incident Handling

Computer Security Incident Handling Guide by NIST
NIST-800-61

473

Question 14

MSSP

Managed Security Service Provider (MSSP)
Reasons that organisations chose to outsource security monitoring;

1. Domain expertise
2. Dedicated personnel
3. Staffing shortage
4. Cost Control

477

Question 15

Threat Hunting

• Using tools to proactively look for indicators of compromise (IOC)
• Organisations should consider threat hunting only after reaching a mature level with monitoring capabilities

477

Question 16

Incident Response Retainer

A legal agreement between organisation and MSSP that contracts them to assist in the event of a security incident

477