11.3 Enterprise Security Management

Question 1

An intrusion detection system (IDS) both ______ and looks for ______.

Answer 1

An intrusion detection system (IDS) both analyzes traffic and looks for malicious signatures.

Question 2

Enterprise security monitoring (ESM) includes ______.

Answer 2

Enterprise security monitoring (ESM) includes endpoint telemetry.

Question 3

True or False:

Firewalls and NSMs can see inside encrypted traffic.

Answer 3

False

Firewalls and NSMs CANNOT see inside encrypted traffic.

In most cases, malware will be transmitted from attacker to victim in an encrypted state to hide its presence and intent. This also serves as a method of obfuscation to bypass IDS detection engines.

Question 4

ESMs use OSSEC to provide visibility at the _____, where malware infection takes place after it’s decrypted.

Answer 4

ESMs use OSSEC to provide visibility at the host-level, where malware infection takes place after it’s decrypted.

Question 5

______ is essentially host-based monitoring of system data.

Answer 5

Endpoint telemetry is essentially host-based monitoring of system data.

Question 6

What tools are in the Elastic (ELK) Stack, the engine that operates within the security onion

Answer 6

Elasticsearch + logstash + kibana

Question 7

________ is important at every level of government and public sector organizations, which use it to determine acceptable risk and develop security controls that in forms budgets

Answer 7

Threat intelligence is important at every level of government and public sector organizations, which use it to determine acceptable risk and develop security controls that in forms budgets

Question 8

__________ , are responsible for establishing threat intelligence cards, which document the TTPs used by adversaries to infiltrate a network.

Answer 8

Computer and Incident and Response Teams (CIRT), are responsible for establishing threat intelligence cards, which document the TTPs used by adversaries to infiltrate a network.

Question 9

__________ are shared among the cyber defense community, allowing organizations to benefit from the lessons learned by others.

Answer 9

Threat intelligence cards are shared among the cyber defense community, allowing organizations to benefit from the lessons learned by others.