4.2 - Summarize the importance of policies, processes, and procedures for incident response.

Question 1

diamond model

Answer 1

The Diamond Model of
Intrusion Analysis

• Designed by the intelligence community
  – https://apps.dtic.mil/docs/citations/ADA586960 – Guide analysts to help understand intrusions
  – Integrates well with other frameworks
• Apply scientific principles to intrusion analysis – Measurement, testability, and repeatability – Appears simple, but is remarkably complex
• An adversary deploys a capability over some infrastructure against a victim
  – Use the model to analyze and fill in the details