7.1 Sec Ops Tech Flashcards
change management
request review approve/reject schedule and implement document
patch management
evaluate test approve deploy approved verify
transitive/ non-transitive trust
transitive: trust relation between two domains and all of their subdomains
non-transitive: trust between domains, subdomains excluded
incident response
de re mi re re re le
- detection
- response (CIRT, investigation, evidence) -EINDÄMMUNG
- mitigation (contain, limit the effect) EINDÄMMUNG
- reporting (upper management, gov)
- recovery (rebuild)
- remediation (root cause analysis) SANIERUNG
lessons learned
darknet
unused IPs monitored by IDS
few false positives because any traffic is illegitimate
sampling
clipping
statistical
non-stat
service burau
leases computer time in case of a disaster
MAA
mutual assistance agreement, reciprocal agreement
drp testing
- read though: paperwork only
- structured walk-trough: role play
- simulation: role play with live testing
- parallel
- full interruption
types of incident
scanning (indicates that illegal activity may follow)
compromise
malicious code
dos
drp process
response
actoivate team
assess
reconstitution
developing drp
initiation project scope BIA identify preventive controls develop recovery strategies develop contingency plan implement, training, test maintenance
RPO
Recovery point objective
maximum tolerable loss of data/work/availability an organization can withstand
RTO
recovery time objective
system recovery time, until it is running
MTD
RTO+WRT
