3.5 Cyber Incident Response Flashcards
what is the best way to determine the attack vector used by a hacker?
reverse engineering
why should a first responder be familiar with the incident response plan?
to ensure that the appropriate procedures are followed
which eradication technique reinstalling the operating system, applying all system updates, reinstalling the anti-malware software, and implementing any organizational security settings?
reconstruction or re-imaging
what are the FOUR validation techniques?
patching, verifying permissions, scanning, verifying logging/communication to security monitoring
what is the name of the security process that involves recognition, verification, classification, containment, and analysis?
incident response
what are the THREE eradication techniques?
sanitization, reconstruction or re-image, secure disposal
what are the FOUR containment techniques?
segmentation, isolation, removal, reverse engineering
which containment techniques involves limiting the scope of the incident by leveraging existing segments of the network as barriers to prevent the spread of the incident to other segments?
segmentation
which containment technique involves retracing the steps in the incident as seen from the logs in the affected devices or in logs of infrastructure devices that may have been involved?
reverse engineering
what is the name of the group of people appointed to respond to security incidents?
incident response team
which type of review should be completed last as part of incident response?
a post-mortem review
which containment technique involves either by blocking all traffic to and from the device or devices or shutting down the device or devices’ interfaces?
isolation
what are the SEVEN steps in a FORENSIC INVESTIGATION?
- identification
- preservation
- collection
- examination
- analysis
- presentation
which eradication technique removes all tracers of the threat by overwriting the drive multiple times to ensure all data is destroyed?
sanitization
in which location should all changes made to your organization’s network and computers be listed?
in the change management system
