4. Communicating Cyber Security Findings Effectively Flashcards
Which of the following is the MOST important reason for including KPIs in an incident management dashboard?
A)Helps management understand the performance of the incident management program.
B)Helps reduce the impact to production after an incident occurs.
C)Provides an executive summary on the most recent incident that occurred.
D)Helps determine the root cause of detected incidents.
KPIs helps management understand how well the incident management program is performing to prevent, detect, and remediate vulnerabilities and respond to incidents. KPIs measure crucial performance factors, including the severity of an incident’s impact and the organization’s speed of recovery.
Some common incident management KPIs are: MTTD
Mean time to detect (MTTD) – provides information on average time taken to discover the incident from the time it occurred.
Some common incident management KPIs are: MTTR (Respond)
Mean time to respond (MTTR) – the average time it takes the system to recover after a system failure was first detected.
Some common incident management KPIs are: MTTR (Remediate)
Mean time to remediate – the average time elapsed between the incident being detected and the incident being completely remediated.
Alert volume – the number of alerts that were detected during the given period of time.
Alert volume – the number of alerts that were detected during the given period of time.
Post-Incident report
Timelines: Describes the events as they occurred from first detection to final resolution.
Recommendations: Provides information on recommendations from the technical teams and subject matter experts on how to prevent similar incidents in the future.
Impact: Assesses the damage (both actual and reputational) caused by the incident and applies a cost figure if possible.
Scope: Describes the systems and networks affected by the incident.
Evidence: Lists any digital or physical evidence that may be used to identify and hold responsible those causing the incident.
Alert Volume: displays the number of alerts that were detected during the given period of time.
You are a cybersecurity advisor for your organization. You have observed recurring security incidents over the month that have significantly impacted production.
Which of the following should you initiate to determine the factors that caused the security incidents?
A)A review the Business Continuity Plan (BCP)
B)A review of technical controls implemented in your environment.
C)Testing your incident management program.
D)Performing root cause analysis.
To determine the factors that caused the recurring security incidents, you should perform root cause analysis. Root cause analysis helps figure out factors that caused the incident. It also provides the opportunity for organizations to improve their existing incident response plan. It helps you identify corrective actions that should be taken to prevent similar incidents in future.
Your organization has recovered from a major security incident. You have planned the lessons learned meeting with relevant stakeholders.
Which of the following is NOT a benefit of a lessons learned meeting?
A)Helps maintain regulatory reporting.
B)Helps create an escalation matrix.
C)Helps determine the root cause of the incident.
D)Helps update incident response policies and procedures.
Lessons learned meetings do not help in creating an escalation matrix. However, they can help improve the escalation matrix. An escalation matrix is part of an incident response plan. Contact information for relevant levels is included in the escalation procedures. Lessons learned meetings help identify strong and weak areas of the plan. For example, if an escalation matrix is identified as a weak area of the incident response plan, this would be the opportunity to make improvements to the process.
Your organization has a critical e-commerce application that processes financial transactions. All the credit card transactions are processed and reconciled by a single individual. Your company cannot segregate the processing and reconciliation duties and assign them to different people due to budget constraints.
You are a cybersecurity analyst for the organization.
Which of the following compensatory controls could you suggest in order to reduce the risk of error and fraud?
A)Conduct an independent third-party audit at least annually to review the credit card transactions and relevant documentation.
B)Implement a password policy for the individual that forces a password reset once a month.
C)Rotate the job every month and assign it to a different individual.
D)Ask the individual to do a self-audit of all the transactions on monthly basis and share the results with supervisor.
E)Conduct security awareness training for the individual.
Since the organization cannot implement segregation of duties due to budget constraints, you should implement one or more compensatory controls. Compensatory controls are alternatives that can be used when other mandatory or primary controls cannot be implemented due to logistical issues.
In the given scenario, compensatory controls could include conducting an independent third-party audit at least annually to review the credit card transactions and relevant documentation. It could also include rotating the job every month and having it performed by a different individual. Conducting an independent audit at regular intervals will validate the credit card transactions and relevant documentation, which would ensure credit card transactions are valid and no error or fraud was detected. Rotating the job every month will ensure that no single person is solely responsible for financial reconciliation. Rotation increases the chances that fraudulent transactions will be detected by another person.
Asking the individual to do the self-audit of all the transactions on monthly basis and share the results with supervisor will not act as compensatory control in the given scenario. If the individual is self-auditing their work, there are chances they may hide fraudulent work and present a false report to his supervisor.
Conducting security awareness sessions may provide the individual with some knowledge regarding security issues, but it will not prevent an employee from conducting fraudulent transactions or increase the chance that these events are detected.
Forcing the individual to change their password does not prevent the user from conducting fraudulent transactions.
SLA,SLO,SLI,KPI
An SLA is a legal agreement or contract between the customer and service provider. If the contract is breached, service provider has to pay penalties. Standard components of an SLA are:
Service-level title
Metric definition
Calculation to measure performance
Tools used to measure performance
Duration when performance will be measured
Metrics to achieve SLA
Penalties in case contract is breached
A service-level indicator (SLI) is a quantifiable measure of the reliability of the product, such as how often the product breaks and needs repair. The SLI is defined collaboratively among the security teams and product owners.
Service-level objectives (SLOs) are performance-based metrics, benchmarks, or goals directly associated with SLAs.
Key performance indicators (KPIs) are metrics that help you measure the success of the program and aid in decision making. Examples of KPIs are number of daily password changes, number of incidents a week, or average incident response time.
After performing a vulnerability scan on your company’s SQL server, you identify several issues that need to be handled. All of the identified issues will require changes to the current configuration of the SQL server. Your company has an established change control process in place. What should you submit to start this process?
A)SLA
B)MOU
C)CCB
D)RFC
You should submit a request for change (RFC) to start the formal change control process for the issues identified by the SQL server vulnerability scan. The RFC is evaluated and submitted to the change control board (CCB) for approval. If the RFC is approved, then the appropriate steps will be taken to complete the change. If it is denied, then no actions are taken.
All changes should be logged in a change log to ensure that records are maintained for both approved and denied RFCs. During the change control process, communication is key because the change status needs to be conveyed to the appropriate individuals. In addition, communication must occur to ensure that the change is completed once it is approved.
You are a cybersecurity consultant for your organization. You have recently implemented a vulnerability management program and are in the process of finalizing the table of contents in the vulnerability management report.
Which of the following is NOT an element of a successful and effective vulnerability management report?
A)Provide clear and concise information in the report.
B)Include detailed findings and metrics in the report.
C)Recommend plans of action to remediate the findings in the report.
D)Include the organization’s business goals and objectives in the report.
The organization’s business goals and objectives are not an element of the vulnerability management report and should not be included in the assessment report. The organization’s business goals and objectives should be included in organizational level security policies. To make security policies effective, they should be mapped appropriately with business goals and objectives.
Key elements of successful and effective vulnerability management reports are:
The report begins with an executive summary.
The language is clear and concise.
The report is easy to understand by its intended audience.
It provides the actions / recommendations for the identified vulnerabilities.
It includes detailed vulnerabilities and metrics for technical personnel.
It provides dashboards and pie charts.
It includes graphic elements like a risk-based vulnerabilities matrix in the report.
Your organization is signing a contract with a service provider, who will provide cloud services to your organization. You are finalizing the SLA, SLO, SLI, and KPIs to be included in the contract with service provider.
You have mentioned in the contract that if the performance of cloud services is impacted, it must be restored within one hour. Which of the following does this statement refers to?
A)SLA
B)SLO
C)SLI
D)KPI
Service-level objectives (SLOs) are performance-based metrics, benchmarks, or goals directly associated with SLAs.
Your organization has recently performed a vulnerability assessment on the data center. The vulnerability assessment report was circulated to the relevant asset owners for discussion.
Which of the following sections of the vulnerability assessment report would identify whether mitigations applied after prior vulnerability assessments were effective?
A)Recurrence
B)Prioritization
C)Affected hosts
D)Risk score
The Recurrence section will identify any issues previously identified that are still present despite controls having been applied. Recurring issues should receive priority when designing solutions.
You are a cybersecurity analyst for your organization. Your organization have a mature patch and vulnerability management process. All systems and devices are appropriately patched as per the planned patch management process, automatically through the use of System Center Configuration Manager (SCCM).
A recent vulnerability assessment reveals that critical systems have vulnerabilities. Which of the following is the MOST LIKELY scenario?
A)The vulnerability assessment tools do not have an up-to-date vulnerabilities engine.
B)Zero-day vulnerabilities were discovered.
C)The prior vulnerability assessment results were showing false positives.
D)Your critical systems are not patched.
The MOST likely scenario is that zero-day vulnerabilities were discovered that affect your critical systems. Zero-day vulnerabilities are security flaws in the application, operating system, or device that are unknown to the parties responsible for patching or fixing the issue, and for which there is yet no patch to install. Zero-day vulnerabilities can only be addressed with compensating controls, up to and including taking a system offline to avoid an exploit.
Which of the following is NOT a role of the legal department in the creation of an incident response plan?
A)Develop wording of documents used to contact possibly affected sites and organizations.
B)Review non-disclosure agreement to ensure their support for incident response efforts.
C)Assess site liability for illegal computer activity.
D)Create policies and procedures that support the removal of employees found to be engaging in improper or illegal activity.
It is not a role of the legal department to create policies and procedures that support the removal of employees found to be engaging in improper or illegal activity. That is a role of the HR department. The HR department has two roles in incident response:
Develop job descriptions for those persons who will be hired for positions involved in incident response.
Create policies and procedures that support the removal of employees found to be engaging in improper or illegal activity.
The legal department has three roles in incident response:
Review the non-disclosure agreement (NDA) to ensure legal support for incident response efforts.
Develop wording of documents used to contact sites and organizations possibly affected by an incident that originated with your company’s software, hardware, or services.
Assess site liability for illegal computer activity.
It is also important to consider public relations in an incident response plan. It is vitally important that the PR department work with the crisis management team to develop the proper messaging for the organization’s customers and the general public.
You are a cybersecurity analyst for your organization. Your organization has observed a high number of vulnerabilities that were not remediated after discovery. Instead, the same vulnerabilities are being detected on multiple vulnerability assessment reports.
You have been asked to identify the barriers to remediation that are presenting these vulnerabilities from being addressed, and to present an action plan for overcoming them. Which of the following is NOT typically a factor that would inhibit the remediation process in an organization?
A)System degradation
B)Contractual obligations
C)Organizational governance policies
D)The use of compensatory controls
E)Business-critical processes
F)The use of proprietary systems
Compensatory controls are not typically an inhibitor to the remediation process. Compensatory controls are alternative solutions that can be used when mandatory or primary controls cannot be implemented. Compensating controls substitute for a primary access control. They mainly act as mitigations to risk and help bring it down to an acceptable level.
All of the other factors may inhibit remediation.
Organizations can be reluctant to stop business-critical processes, especially those that directly generate revenue, in order to patch or remediate a vulnerability. This reluctance may result in repeated delays, raising the organization’s exposure to a critical vulnerability.
System degradation is a concern, especially when patching an older or proprietary system. Implementing a fix or patch may negatively affect other systems or applications in unexpected ways, or even break a key functionality. Patches should always be tested (when feasible) in a sandbox environment and rolled out in stages to assess their impact.
Proprietary systems are those systems developed in-house. Since there is no vendor to issue updates, patches must be created and implemented by local teams. This can be an issue that requires more scheduling than simply searching for and installing patches.
Organizational governance includes any organizational policy or standard that can affect remediation, such as time-consuming change control procedures. Some systems, such as accounting and financial systems, must remain in compliance with industry standards or federal laws; in these situations, vulnerability remediation must be validated after it is implemented to ensure the system did not fall out of compliance.
Contractual obligations like SLAs and MOUs can be an inhibitor to remediation process. A service-level agreement is a contract between two parties to provide services, and includes performance metrics that must be met and can interfere with remediation processes. A memorandum of understanding (MOU) is another kind of agreement between two parties that limits how some services can be interrupted or rendered. For example, your organization may use a specialized embedded component in your network that can only be serviced by a specific vendor with the appropriate training and certification, rather than being patched by your in-house team.
Your organization has outsourced the vulnerability management function to a third-party service provider. You are finalizing the contract with the provider, specifically the manner in which trends will be tracked and reported to your senior management.
Which of the following is an example of a KPI?
A)Overall number of vulnerabilities successfully remediated.
B)50% waiver on the one-month invoice in case critical vulnerabilities are not remediated within 15 days.
C)Number of vulnerabilities for a new application release should be less than 10.
D)Critical vulnerabilities should be resolved within 15 days and 98% of the time.
The number of vulnerabilities remediated is an example of a key performance indicator (KPI). KPIs are the metrics that help you measure the success of your security program and aid in decision-making. They provide the quantifiable metrics that prove whether a program is effective. Some of the important KPIs for vulnerability management program are:
Average time to action
Mean time to respond (MTTR)
Mean time to contain (MTTC)
Compliance with standards
Accepted risk score
Average vulnerability age
Rate of reoccurrence
Number of risks remediated
You have identified several inhibitors to your company’s vulnerability management process. Which of the following is an organizational governance inhibitor?
A)Removing a device that is critical to accounts receivable
B)Violating the SLA with a third party
C)Patching a system that is needed 24/7
D)Following formal change control procedures
Of the options provided, following formal change control procedures is an example of an organizational governance inhibitor.
Removing a device that is critical to accounts receivable is a business process interruption inhibitor.
Patching a system that is needed 24/7 is an inhibitor that will degrade functionality.
Violating the SLA with a third party is an inhibitor based on service agreements.
You have a business-critical legacy application that was developed in-house and is installed on a Windows Server 2016 operating system. The application is used to provide services to customers and has a no tolerance for downtime.
Microsoft has released critical patches for the server that will take the system offline for four to eight consecutive hours when installed. You cannot install the patches due to contractual obligations with customers that require 99.999999% uptime for the legacy application.
Which of the following BEST describes the inhibitor to remediation?
A)Business process interruption
B)Changing business requirements
C)SLA
D)Legacy system
E)Proprietary system
Of the given options, the MOST inhibiting factor is the service-level agreement (SLA) that states the legacy application must provide 99.99999% uptime to business customers. In the given scenario, your organization have contractual obligations with the customer outlined in the SLA. An SLA is a contract between two parties to provide services, and includes performance metrics that must be met by the provider. Installing patches may also break the application, which may impact the business.
Which of the following is used to drive improvement in the security posture of the organization?
A)change control process
B)incident response plan
C)lessons learned document
D)incident summary report
The lessons learned documents will briefly list and discuss what we now know either about the attack or about our environment of which we were formerly unaware.
