4.0 Respond Flashcards
Incident response plans and processes
Communication with internal and external stakeholders
Personnel role and responsibilities
Incident reporting
Allow list/block list
IDS/IPS rules configuration
Network segmentation
Web content filtering
Port blocking
Firewall
IDS/IPS
Web proxy
Anti-malware
Endpoint security solutions
DLP
Windows tools to analyze incidents
Registry
Network
File system
Malware
Processes
Services
Volatile memory
Active Directory tools
Linux- based tools to analyze incidents
Network
File system
Malware
Processes
Volatile memory
Session management
Digital evidence collection
Physical evidence collection
Chain of custody
Static analysis
Dynamic analysis
FTK
EnCase
eDiscovery
Forensic Explorer
Kali Linux Forensic Mode
CAINE
SANS SIFT
Volatility
Binalyze AIR
Forensically sound duplicates
Document and communicate results
Logs
Data analysis
Intrusion prevention or detection systems (IDS/IPS)
Forensic Analysis
Correlation Analysis
Event correlation tools and techniques
Root cause analysis
Alerting systems
Incident reports
Document and communicate results
Chain of command
Policies
Procedures
Incident response plan
Security configuration controls
Baseline configurations
Hardening documentation
Document measures implemented
Threat actors
Patterns of activity
Methods
Tactics
Early stages of campaign
Key facts of the infrastructure
Artifacts and tools used
Techniques
Technological
Non-technological
Procedures
Communication policies and procedures
Internal communication methods
Secure channels
Out-of-band communications
Local law enforcement
Stockholders
Breach victims
Media
Other CERTS/CSIRTS
Vendors
