Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SANS FOR578 > 578.1 > Flashcards

578.1 Flashcards

1
Q

What is the meaning of School Of Thought?

A

A perspective of a group with common opinions and disciplines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What was Moonlight Maze?

A

First cyber attack in 1996. It was reanalyzed in 2016.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What was Penquin Turla?

A

Toolkit identified by Kaspersky Labs in 2014, which was based off of LOKI2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Intelligence?

A

Intel is the collection, processing, and analysis of information about a competitive entity and its agents, needed by an organization or group for its security and well-being.

It’s both, a product and a process.

Intelligence deals with all the things which should be known in advance of initiating a course of action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Definition of: HUMINT

A

Human intel collection (interpersonal)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Definition of: GEOINT

A

Geospatial intel collection (satellites)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Definition of: MASINT

A

Measurement and signature intel (radar, nuclear detonation signatures, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Definition of: OSINT

A

Open-source intel (libraries, public records, internet)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Definition of: SIGINT

A

Intel derived from signal intercepts (cell phone communications or tapping of com lines)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Definition of: ALL INT SOURCE

A

Intel derived from every available source on a subject or topic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Counterintelligence?

A

Counterintelligence is the identification, assessment , and neutralization of adversary intelligence activities.

e.g. Operation Bodyguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who was Sherman Kent?

A

Father of intelligence analysis and creator of Kent’s analytic doctrine (9 points).

  1. Focus on Policymaker Concerns
  2. Avoidance of a Personal Policy Agenda
  3. Intellectual Rigor
  4. Conscious Effort to Avoid Analytic Biases
  5. Willingness to Consider Other Judgments
  6. Systematic Use of Outside Experts
  7. Collective Responsibility for Judgment
  8. Effective Communication of Policy-Support Informationen and Judgements
  9. Candid Admission of Mistakes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Who was Richards J. Heuer. Jr.?

A

Developed the Analysis of Competing Hypotheses

  1. Enumerate Hypotheses
  2. Support the Hypotheses
  3. Diagnostics
  4. Refine the Matrix
  5. Prioritize the Hypotheses
  6. Determine Evidentiary Dependence
  7. Report Conclusions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the definition of Analysis?

A

Detailed examination of the elements or structure of something. Breaking something down into its constituent parts to understand its operation.

We analyze observed activity & adversary intent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Definition of: Data-Driven Analysis?

A

Requires good datasets and straightforward problems. Logically-driven and easily replicated by other analysts observing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Definition of: Conceptually-Driven Analysis?

A

Numerous unknowns and undefined variables and relationships.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the three types of pattern recognition?

A

Template Matching
Prototype Matching
Top-Down Matching

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is System 1 Thinking?

A

Intuitive Thinking

Fast, effective, often accurate.
System 1 thinking involves existing mental models.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is System 2 Thinking?

A

Analytic thinking

Slow methodical, and conscious, e.g. Kill Chain & Diamond Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are Mental Models?

A

Mental models are experience-based assumptions and expectations of the way the world operates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is SAT?

A

Structured analytic techniques (SATs) are analyst approaches to better evaluate information while reducing the impact of bias.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the 6 categories of SAT?

A 
Getting organized
Exploration Techniques
Diagnostic Techniques
Reframing Techniques
Foresight Techniques
Decision Support Techniques
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Decomposition

A

Breaking down a problem into its components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Visualization

A

Capturing the parts of a problem in an organized, often visual, manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

5 parts of the intel life cycle?

A 
Planning and Direction
Collection
Processing and Exploitation
Analysis and Production
Dissemination
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define CTI

A

Analyzed information about the hostile intent, opportunity, and capability of an adversary that satisfies a requirement.

The analysis is on the threat
The focus is on the customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Adversary or threat

A

Human behind the keyboard. Individual, team or gov.

Adversaries are your threat when they have the opportunity, intent, and capability for doing you harm.

28
Q

Intel requirement

A

Simply worded and straight forward single question that drives the intel life cycle.

29
Q

Intrusion

A

Any successful or failed attempt by the adversary to compromise a system.

30
Q

Intrusion set

A

Linking of multiple intrusions together across 2+ phases of the kill chain.

31
Q

Activity group

A

Are unique clusters of intrusions mathematically defined by analyst/team’s analytical weighting (confidence scoring)

32
Q

Difference between intrusion set and activity group?

A

An intrusion set would be a clustering and linking of intrusions on key indicators, whereas an Activity Group is a cluster you’re tracking that’s specific to an analytical requirement or intelligence requirement. A slight nuance but Activity Groups are more formal and meet a more structured purpose.

33
Q

Threat actor

A

Is the threat that is responsible for intrusions and is uniquely tracked across different intrusions.

34
Q

Campaign or operation

A

Campaigns are identified as the mission focus of the adversary across multiple intrusions. A single intrusion or even a small amount (three to five) should not be seen as a campaign, as it is too small to derive a pattern and is highly subject to the analyst’s bias on what the adversary might be attempting to do.

Campaigns can be leveraged to help highlight a series of intrusions to a sector or group of victims such as a banking targeted campaign. However, always be aware that our collection gaps and visibility can misguide the campaign’s understanding.

35
Q

TLP

A

Traffic light protocol

36
Q

Victim

A

Individual, network or system compromised.

37
Q

Target

A

Intended victim of an intrusion

38
Q

Persona

A

fake name or identifier that an adversary takes.

39
Q

TTP

A

Tactic, Technique and Procedure.

40
Q

What is Tradecraft?

A

Is the combination of methods, capabilities, and resources (such as infrastructure) that an adversary leverages in the course of their actions.

41
Q

Threats can be evaluated by

A

Intent + Opportunity + Capability

42
Q

What is TTP?

A

Tactics: High-level approach to achieving the goal
Techniques: One step down, how the goal will be achieved.
Procedures: Granular view into the steps taken to achieve the goal.

43
Q

What is an Indicator?

A

Data + Context

Indicator must indicate something. It describes an aspect of an intrusion. An ip address by itself is not an indicator. IP + C2 node = indicator.

44
Q

Key Indicator

A
  • Identify as many as possible
  • Ideally, at least two in different adversary steps
  • Ideally, across three or more intrusions
  • Remain consistent across intrusions
  • Uniquely distinguish an activity cluster
  • Distringuis intrusions from benign activity
  • Align to a phase of adversary activity
45
Q

Sliding Scale of Cyber Security

A
  • Architecture
  • Passive Defense
  • Active Defense
  • Intelligence
  • Offense
46
Q

SSCS: Offense

A
  • Very costly and poor return on investment
  • Where not illegal, definitely not in the spirit of the law
  • Take-down operations could be considered offensive in nature but often are not
    If you suck at running defensive operations, do not assume offense is easier
47
Q

SSCS: Intelligence

A
  • Adversary Emulation
  • Hypothesis Generation
  • Team Restructuring
48
Q

SSCS: Active Defense

A
  • Threat Hunting
  • Incident Response
  • Network Security Monitoring
  • Malware Analysis
49
Q

SSCS: Passive Defense

A
  • Tuning Defense
  • Placement of Technologies
  • Visibility and Collection
50
Q

SSCS: Architecture

A
  • Better Defensible Environments
  • Addressing Important Vulnerabilities
  • Better Development
51
Q

Four types of threat detection

A
  • Modeling (Environmental / Unknowns)
  • Configuration Analysis (Environmental / Knowns)
  • Threat Behaviors (Threat / Unknowns)
  • Indicators (Threat / Knowns)
52
Q

Pyramid of Pain

A
  • TTPs
  • Tools
  • Network / Host Artifacts
  • Domain Names
  • IP Addresses
  • Hash Values
53
Q

Priority Intelligence Requirements

A

PIRs are those IRs that are seen as critical to mission success.

54
Q

Three types of intendent audience / requirements

A
  • Strategic
  • Operational
  • Tactical
55
Q

Carbp

A

Cyber crime toolkit sold on Russian fraud forums with traditional capabilities such as VNC, RDP, sniffers, and keyloggers.

56
Q

Carbanak

A

Malware bases on Carberp, used against over 100 banks.

57
Q

What is a CMS?

A

Collection Management System

View of source of data, what is available in the data, and how that data is processed and exploited.

58
Q

Explain the term System Analysis?

A

A system analysis is an intentionally developed set of mental models, templates, and prototypes that make up a system we are concerned with.

The four main points are:

  • Tasks
  • Structure
  • Information Technology
  • Individuals & Roles
59
Q

What is Threat Modeling?

A

Brings data assests of the company and potential adversaries in relation.

60
Q

Explain Target-Centric Intelligence Analysis?

A
  • Nonlinear approach to the intel cycle
  • Builds a conceptual model of a “target”
  • Used as a foundation for further analysis
61
Q

Explain the VERIS Framework?

A

The Vocabulary for Event Recording and Incident Sharing

  • Four A’s (Action, Asset, Actor, Attribute)
  • Captures metrics on events and incidents
  • Strategic-evel counterpart to indicator sharing
62
Q

What is Synthesis in CTI?

A

Synthesis involves pulling in data from both the targeted organization as well as outside entities, and reaching out to other digital forensics and incident response fields such as malware analysis and forensics.

63
Q

What is Template Matching?

A

Template matching theory states that every object or experience is processed by the brain and stored as a template in long-term memory. Long-term memory is searched for a matching template to explain the situation.

64
Q

What is Prototype Matching?

A

Prototype Matching is similar to template matching; however it does not search for an extact match of a template, but to an “average” of similar templates referred to as a prototype.

65
Q

What is Top-Down Matching?

A

Top-down pattern matching uses previous knowledge to “fill in the gaps” when we do not have complete information.

66
Q

What does an Adversary need to make themselves dangers?

A

Opportunity + Intent + Capability

67
Q

What is the difference between victim and target?

A

There may be multiple victims involved in an adversary’s campaign before they reach their target. A target is the ultimate goal of the adversary.

SANS FOR578 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions