4.8 Flashcards
Incident response, incident planning, digital forensics, log data
What is the NIST code for the Computer Security Incident Handling Guide?
Includes the whole of the incident response lifecycle:
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity
NIST SP800-61
4 phases of incident response
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity (lessons learned)
5 steps for the Preparation phase of incident response
Communication methods (phones, contact info)
Incident handling hardware/software (laptops, removable media, forensic software, digital cameras, etc.)
Incident analysis resources (documentation, network diagrams, baselines, critical hash values)
Incident mitigation software (clean OS and app images)
Incident handling policies (so everyone knows what to do)
Why can isolating malware be potentially problematic?
The malware can recognize that it’s running inside a VM/sandbox, and delete itself
The method of determining the ultimate cause of an incident
Root cause analysis
True/False
There can be more than one single root cause of a security incident
True
The process of actively searching for vulnerabilities to correct. This includes vulnerability scanning, installing patches, and monitoring threat/vulnerability sharing networks.
Threat hunting
A data acquisition request, normally given by lawyers, to preserve relevant information for litigation.
Legal hold
When legal counsel requests a legal hold for some data, where is that data held?
In a separate repository for ESI (electronically stored information)
A list of everyone who contacts the evidence, handles the evidence, where it was stored, etc
Chain of custody
The fancy word for obtaining data evidence
Acquisition
When acquiring data evidence of virtual systems, you can obtain a ____
Snapshot
Some of the most interesting data evidence comes from ____ (5)
Artifacts,
recycle bins,
log information,
browser bookmarks,
saved logins,
etc.
A documentation of how data evidence was acquired (including the incident) and stored, as well as the findings of the analysis and a conclusion with professional results.
Reporting
The method of isolating and protecting the data evidence
May include making copies for analysis to prevent making changes to the original data
Preservation
The process of collecting, preparing, reviewing, interpreting, and producing electronic documents
This does NOT generally involve analysis; it mainly focuses on acquisition. You might produce documents to a forensics team or other professional, though, for them to analyze.
E-discovery
A SIEM feature (or a service by a third-party service) that automatically generates screens of aggregated data for comparison and correlations.
Automated reports
A summary of SIEM information that produces a customized screen of important information for quick review.
Does not show long-term information; it’s mostly for giving the viewer an understanding of the current status of the network and devices.
Dashboard
