4.4 Given an incident, apply mitigation techniques or controls to secure an environment.

Question 1

endpoint

Answer 1

This is an end user device, which could be a smartphone, laptop, tablet, etc.

Question 2

Approved list

Answer 2

IT team creates a list of applications that are approved, and no other applications are allowed to run. Very restrictive. You would need to go to the IT team to approve any new application that is not already on the list.
It team could use a hash of the executable of the app to approve an app.

Question 3

Blocklist

Answer 3

The “bad list.”
This means a user can install any app unless it is specifically on the deny list.
Anti-virus or antimalware typically have a deny list of applications.

Question 4

Quarantine

Answer 4

A place where anything suspicious can be moved. It is a safe area

Question 5

How do IT teams add apps to an approved list?

Answer 5

They could use an application hash, certificate, path to a location, or base a policy on the network zone.

• With an application hash, if the application changes, the hash could change.

Question 6

MDM

Answer 6

Mobile device management can enable or disable phone and tablet functionality regardless of physical location.

Question 7

DLP

Answer 7

Data loss prevention can identify and block the transfer of PII or sensitive data.
This could be credit card numbers, social security numbers, etc.

Question 8

Content Filter

Answer 8

Also known as a URL filter, it can limit access to untrusted websites and block malicious sites.
Large blocklists are used to share suspicious site URLs.

Question 9

Describe SOAR and how it is different from SIEM?

Answer 9

Security Orchestration, Automation, and Response
– Integrate third-party tools and data sources
– Make security teams more effective
* Runbooks
– Linear checklist of steps to perform
– Step-by-step approach to automation
– Reset a password, create a website certificate,
back up application data
* Playbooks
– Conditional steps to follow; a broad process
– Investigate a data breach, recover
from ransomware

SOAR has automation and SIEM does not.

Question 10

Segmentation

Answer 10

Separate the network
– Prevent unauthorized movement
– Limit the scope of a breach

Question 11

Containment

Answer 11

Application containment
– Run each application in its own sandbox
– Limit interaction with the host operating system
and other applications
– Ransomware would have no method of infection
* Contain the spread of a multi-device security
event, i.e., ransomware
– Disable administrative shares
– Disable remote management
– Disable local account access and change local
administrator password

Question 12

Process Isolation

Answer 12

– Limit application execution
– Prevent malicious activity but allow device
management

Question 13

Network isolation

Answer 13

– Isolate to a remediation VLAN
– No communication to other devices

Question 14

Isolation

Answer 14

• Administratively isolate a compromised device from
  everything else
  – Prevent the spread of malicious software
  – Prevent remote access or C2 (Command and Control)

Question 15

Blackhole

Answer 15

Blackholes correspond to locations in the network that quietly discard (or “drop”) incoming or outgoing messages, without notifying the source that it did not reach its intended recipient. Blackholes are an isolation technique because they isolate the attacker from the network.

Question 16

Sinkhole

Answer 16

Sinkhole routing means suspicious traffic that is flooding a specific IP address routes to another network for analysis. This is a form of segmentation because it maintains the connection to other networks.