1.2: Security Incident Management

Question 1

What is a security incident

Answer 1

Any event that represents a violation of an organizationn’s security policy.

Question 2

Types of Security Incidents

Answer 2

• Computer account abuse - sharing of user account credential
• Computer or network trespass - unauthorized person accesses a computer network
• Interception of information - eavesdropping on communications
• Malware
• Denial of Service (DoS) attack
• Distributed Denial of Service (DDoS) attack
• Equipment theft
• Disclosure of sensitive information

Question 3

Is a vulnerability that is discovered a security incident?

Answer 3

No, it’s not a security incident, but it may prompt a response that is similar to an actual incident.

Question 4

How should an effective response to incident be?

Answer 4

Documented and rehearsed

Question 5

The phase of incident response

Answer 5

• Planning - development of written response procedures that are followed when an incident occurs.
• Detection - when the organization became aware or active or past incident
• Initiation - Response to the incident begins
• Evaluation - response team analyze available data, in order to understand the cause, scope, and impact of the incident.
• Eradication - step to remove the source of incident
• Recovery - brining system back to their pr-incident state
• Remediation - changes that will reduce or eliminate similar incident occurring.
• Closure - After eradication, recovery, and remediation are completed
• Post-incident Review - Lesson learned

Question 6

What Incident response testing

Answer 6

. Incident response testing helps to improve the quality of those plans, which will help the organization to better respond when an incident occurs.

Question 7

Types of activities carried out during incident response testing

Answer 7

• Document review
• Walkthrough
• Simulation

These tests should be performed once a year.

Question 8

How is incident prevention primarily accomplished?

Answer 8

Through knowledge of vulnerabilities and actions to remove them.

Question 9

Important elements in the prevention of security incident

Answer 9

• Vulnerabilities and treat monitoring :
• Situation awareness
• Threat hunting
• Vulnerability management - tools and techniques to detect vulnerabilities in network devices, servers etc.
• Advanced anti-malware : at the network boundaries , servers, endpoints, and mobile devices.
• system hardening - configured only essential services on a system.
• Intrusion detection - gives early warning of network-or computer-based attacks.
• Intrusion prevention - Like IDS, but can actively block activities that resemble attacks.

Question 10

When is a forensic investigation required

Answer 10

when a security incident has occurred and it is necessary to gather evidence to determine the facts.