4.2 Importance of policies, processes and procedure in Incident response

Question 1

Incident response process: what are the stakeholders involve in this process ?

Answer 1

• Incident response team
• IT security management
• Compliance officer
• Technical staff
• User community

Question 2

Incident response process: what framework can be used for incident response lifecycle?

Answer 2

NIST

Question 3

Incident response process: how a company can be “prepared” for an incident ?

Answer 3

• Use communication methods (phone, email)
• Set up incident handling hardware and software
• Have incident analysis resources (documentation, network diagrams, baseline, critical file hash value)
• Policies & procedures

Question 4

Incident response process: how to know that an incident has occured?

Answer 4

Monitor the system and network (antivirus, IPS/IDS, network flow)

Question 5

Incident response process: what to do when a security incident occurs ?

Answer 5

Isolate it in a sandbox (VM) and analyze it. Clean out the sandbox when done

Question 6

Incident response process: how to recover from the incident ?

Answer 6

Eradicate the bug (remove the malware) and recover the system (restore from backup, rebuild from scratch, replace compromised file etc)

Question 7

Incident response process: why documentation is important?

Answer 7

To understand when and why the incident happened. How the incident was resolved and what can be done next time it happened

Question 8

Incident response planning: why exercise are important in incident management?

Answer 8

To test yourselves before an actual real incident

Question 9

Incident response planning: what is COOP ?

Answer 9

Continuity of Operations Planning

Question 10

Attack frameworks: what is MITRE ATT&CK framework?

Answer 10

Framework that determine the actions of an attacker: identify point of intrusion, understand methods used to move around, identify potential security techniques to block future attacks etc

The framework is available online

Question 11

Attack frameworks: what is Diamond Model of Intrusion Analysis framework?

Answer 11

Apply scientific principles to intrusion analysis: measurement, testatbility and repeatability.

Question 12

Attack frameworks: what are the 4 corners of Diamond Model of Intrusion Analysis framework?

Answer 12

• Adversary: the attacker
• Capability: how the attacker uses (malware, exploit etc)
• Victim: it could be a person, assets, email etc
• Infrastructure: describe hat was used to gain access (IP, domain names, email etc)

The 4 points are all connected. Therefor Adversary would uses the infrastructure and develops a capability. The victim is exploited by the capability and connect to the infra

Question 13

Attack frameworks: what is Cyber Kill Chain framework?

Answer 13

Framework with 7 phases of a cyber attack:
- Reconnaissance: gather info
- Weaponization: build a payload inc. exploit & backdoor
- Delivery: send the weapon
- Exploit: Execute code on victim
- Installation: malware is install
- Command & control: get remote access
- Actions on objectives: attacker can remotely carry out objectives