2.4 Analyze and interpret output from security technologies

Question 1

HIDS/HIPS

Answer 1

A type of Intrusion Detection System (IDS) that monitors a computer system for unexpected behavior or drastic changes to the system’s state.
HIDS/HIDS produce similar output/logs is similar to anti-malware scanners.

Question 2

Antivirus scanner

Answer 2

Detects and removes virus infections, worms, trojans, rootkits, adware, spyware, DoS tools.
Output is displayed as an alert, and may be tagged with a CME (Common Malware Enumeration)

Question 3

File integrity check

Answer 3

When software is installed from a legitimate source, the OS package manager checks the signature or fingerprint of each executable file and notifies the user if there is a problem.

Question 4

Host-based firewall

Answer 4

Unlike a network firewall, a host-based firewall will usually displays an alert to the user when a program is blocked, allowing the user to override the block rule or add an accept rule.

Question 5

Application whitelisting

Answer 5

Means nothing can run if it is not on the approved whitelist.

Question 6

Removable media control

Answer 6

An alert will be displayed to the user if a device is blocked by the security policy.

Question 7

Advanced malware tools

Answer 7

Ex. Sysinternals.

• Look for unrecognized process names
• Look for processes with no icon, version info, description, or company name
• Examine processes hosted by the service host executable and determine whether they have a valid parent/child relationship with the principal Windows processes.

Question 8

UTM

Answer 8

(Unified Threat Management) a system that centralizes various security controls - firewalls, anti-malware, network intrusion prevention, spam filtering, content inspection.

Question 9

DLP

Answer 9

(Data loss/leak prevention) A software that detects and prevents sensitive information in a system or network from being stolen or otherwise falling into the wrong hands.
Data remediation mechanisms:
- Alert only
- Block
- Quarantine
- Tombstone - file is quarantined and replaced with one describing the policy violation

Question 10

Data execution prevention

Answer 10

Prevent overflow attacks. May prevent applications from running if they don’t support DEP technologies.

Whitelist & Blacklist

Question 11

Web application firewall

Answer 11

Designed to protect software running on web servers and their backend databases from code injection and DoS attacks.
Output is written to a log, which you can inspect and determine what is a threat.