Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > 6. Sound the alarm: detection and response > Flashcards

6. Sound the alarm: detection and response Flashcards

1
Q

Computer security incident response teams (CSIRT)

A

specialized group of security professionals that are trained in incident management and response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Documentation

A

any form of recorded content that is used for a specific purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Endpoint detection and response EDR

A

application that monitors an endpoint for malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Event

A

observable occurrence on a network, system, or device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

False negative

A

state where the presence of a threat is not detected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

False positive

A

alert that incorrectly detects the presence of a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Incident

A

occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of info or an info system; or constitutes a violation or imminent threat of violation of law, security policies, a security procedures, or acceptable uses policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Incident handler’s journal

A

form of documentation used in incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incident response plan

A

document that outlines the procedures to take in each step of incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Incident detection system IDS

A

application that monitors system activity and alerts on possible intrusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Intrusion prevention system IPS

A

application that monitors system activity for intrusive activity and takes action to stop the activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

National Institute of Standards and Technology NIST Incident Response Lifecycle

A

framework for incident response consisting of four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Playbook

A

manual that provides details about any operational action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security information and event management SIEM

A

application that collects and analyzes log data to monitor critical activities in an org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security operations center SOC

A

org unit dedicated to monitoring networks, systems, and devices for security threats or attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security orchestration, automation, and response SOAR

A

collection of applications, tools, and workflows that uses automation to respond to security events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True negative

A

state where there is no detection of malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

True positive

A

alert that correctly detects the presence of an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Command and control C2

A

techniques used by malicious actors to maintain comms with compromised systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Command-line interface CLI

A

text-based user interface that uses commands to interact with the computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data exfiltration

A

unauthorized transmission of data from a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data packet

A

basic unit of info that travels from one device tot another within a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Indicators of compromise IoC

A

Observable evidence that suggests signs of a potential security incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Internet Protocol IP

A

set of standards used for routing and addressing data packets as they travel between devices on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Intrusion detection systems IDS

A

application that monitors system activity and alerts on possible intrusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Media Access Control MAC address

A

unique alphanumeric identifier that is assigned to each physical device on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

National Institute of Standards and Technology NIST Incident Response Lifecycle

A

framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, eradication and Recovery; and Post-incident activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Network data

A

data that’s transmitted between devices on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Network protocol analyzer packet sniffer

A

tool designed to capture and analyze data traffic within a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Network traffic

A

amount of data that moves across a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Network Interface Card NIC

A

Hardware that connects computers to a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Packet capture p-cap

A

file containing data packets intercepted from an interface or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Packet sniffing

A

practice of capturing and inspecting data packets across a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Playbook

A

manual that provides details about any operational action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Root user (or superuser)

A

user with elevated privileges to modify the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Sudo

A

command that temprarily grants elevated permissions to specific userst

37
Q

tcpdump

A

command-line network protocol analyzer

38
Q

wireshark

A

open-source network protocol analyzer

39
Q

Analysis

A

investigation and validation of alerts

40
Q

Broken chain of custody

A

Inconsistencies in the collection and logging of evidence in the chain of custody

41
Q

Business continuity plan BCP

A

document that outlines the procedures to sustain business operations during and after a significant disruption

42
Q

Chain of custody

A

process of documenting evidence possession and control during an incident lifecycle

43
Q

Containment

A

act of limiting and preventing additional damage caused by an incident

44
Q

Crowdsourcing

A

practice of gathering info using public input and collaboration

45
Q

Detection

A

prompt discovery of security events

46
Q

Documentation

A

any form of recorded content that is sued for a specific purpose

47
Q

Eradication

A

complete removal of the incident elements from all affected systems

48
Q

Final report

A

documentation that provides a comprehensive review of an incident

49
Q

Honeypot

A

system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders

50
Q

Incident response plan

A

document that outlines the procedures to take in each step of incident response

51
Q

Indicators of attack IoA

A

series of observed events that indicate a real-time incident

52
Q

Indicators of compromise IoC

A

Observable evidence that suggests signs of a potential security incident

53
Q

intrusion detection system IDS

A

application that monitors system activity and alerts on possible intrusions

54
Q

Lessons learned meeting

A

meeting that includes all involved parties after a major incident

55
Q

Open-source intelligence OSINT

A

collection and analysis of info from publicly available sources to generate usable intelligence

56
Q

Playbook

A

manual that provides details about any operational action

57
Q

Post-incident activity

A

process of reviewing an incident to identify areas for improvement during incident handling

58
Q

Recovery

A

process of returning affected systems back to normal operations

59
Q

Resilience

A

ability to prepare for, respond to, and recover from disruptions

60
Q

Standards

A

references that inform how to set policies

61
Q

Threat hunting

A

proactive search for threats on a network

62
Q

Threat intelligence

A

evidence-based threat info that provides context about existing or emerging threats

63
Q

Triage

A

prioritizing of incidents according to their level of importance or urgency

64
Q

VirusTotal

A

service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content

65
Q

Anomaly-based analysis

A

detection method that identifies abnormal behavior

66
Q

Array

A

data type that stores data in a comma-separated ordered list

67
Q

Common Event Format CEF

A

log format that uses key-value pairs to structure data and identify fields and their corresponding values

68
Q

Configuration file

A

file used to configure the settings of an application

69
Q

Endpoint

A

any device connected on a network

70
Q

Endpoint detection and response EDR

A

application that monitors an endpoint for malicious activity

71
Q

False positive

A

alert that incorrectly detects the presence of a threat

72
Q

Host-based intrusion detection system HIDS

A

application that monitors the activity of the host on which it’s installed

73
Q

Intrusion detection systems IDS

A

application that monitors system activity and alerts on possible intrusions

74
Q

Key-value pair

A

set of data that represents two linked items: key, and its corresponding value

75
Q

Log

A

record of events that occur within an organization’s systems

76
Q

Log analysis

A

process of examining logs to identify events of interest

77
Q

Log management

A

process of collecting, storing, analyzing, and disposing of log data

78
Q

Logging

A

recording of events occurring on computer systems and networks

79
Q

Network-based intrusion detection system NIDS

A

application that collects and monitors network traffic and network data

80
Q

Object

A

data type that stores data in a comma-separated list of key-value pairs

81
Q

Search Processing Language SPL

A

Splunk’s query language

82
Q

Security information and event management SIEM

A

application that collects and analyzes log data to monitor critical activities in an organization

83
Q

Signature

A

pattern that is associated with malicious activity

84
Q

Signature analysis

A

detection method used to find events interest

85
Q

Suricata

A

open-source intrusion detection system, intrusion prevention system, and network analysis tool

86
Q

Telemetry

A

collect and transmission of data for analysis

87
Q

Wildcard

A

special character that can be substituted with any other character

88
Q

YARA-L

A

computer language used to create rules for searching through ingested log data

89
Q

Zero-day

A

exploit that was previously unknown

Cyber Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions