5C Flashcards
As previously explained in Objective 5b, incident analysis is the series of analytical steps taken to find out what happened in an incident. This includes the identification of the root cause of the incident.
Incident analysis is performed while an event is ___ ___ ___.
still in progress
In accordance with ____, the cyber incident process is a five-step process.
AFI 17-203
What are the five steps to a root cause analysis?
- Gather Information
- Validate the Incident
- Determine the Operational Impact
- Coordinate
- Determine Reporting Requirements
The following describes which step of the cyber incident process?
All involved personnel should identify and collect all relevant information about the incident for use in incident analysis. Information gathered may include data previously acquired and preserved, external logs, personal accounts, all-source intelligence, technical information, or the current operational situation.
Gather Information
The following describes which step of the cyber incident process?
Personnel should continuously review, corroborate, and update (if applicable) the reported incident to ensure the accuracy of all information.
Validate the incident
The following describes which step of the cyber incident process?
Operational impact refers to detrimental impacts on an organization’s ability to perform its mission. This may include direct and/or indirect effects that diminish or incapacitate system or network capabilities, the compromise and/or loss of mission critical data, or the temporary or permanent loss of mission critical
applications or systems.
Determine the Operational Impact
The following describes which step of the cyber incident process?
Coordinate with the victim system’s owning CFP, network operations and security center (NOSC) and mission control center MCCC (as appropriate) to determine the Mission Assurance Category level of the system.
Coordinate
The following describes which step of the cyber incident process?
Determine within one hour if the event or incident meets AF Operational Reporting (OPREP-3) and/or USSTRATCOM or USCYBERCOM Commander’s Critical Information Requirements (CCIR) reporting requirements.
Determine Reporting Requirements
What does COA stand for?
Course of Action
Detailed analysis to include affected system, probable
attacker, attack vector used, and technical and operational
impacts (if known).
Cyber Incident Report (CIR)
Focuses on an incident, group of incidents, or network
activity or on a foreign individual, group, or organization
identified as a threat or potential threat to DOD networks.
Network Intelligence Report (NIR)
Data captured in the _____ includes lessons learned, initial root cause, problems with executing courses of action (COAs), missing policies and procedures, and inadequate infrastructure defenses.
postmortem
The results of postmortem will be provided to the affected MAJCOM/unit so that corrective actions can be taken, which could include _____ existing COAs, figuring out why the COAs failed, or creating new COAs.
revising
