(9) Security Incident Definitions Flashcards
What is an event?
An event is an observable happening in a system or network. A security event specifically is observable and has to do with a security function
What is an adverse event?
An adverse event is any event that has less than ideal consequences. Malware infection, server crash, etc.
What is a security incident?
A security incident is a clear violation of company policies as it has to do with proper use of company equipment or systems, software
What are computer security incident response teams (CSIRTs)?
CSIRTs are responsible for reacting to security incidents that happen within an org by following standard (thought of beforehand) processes to secure the system
What is an incident response process?
An example of an incident response process is preparation, detection/analysis, containment eradication and recovery, and post incident activity
Is the incident response process a straight forward process to follow?
Incident response processes can be straight forward but most often involve looping back to prior processes for new detection and containment activities, etc.
What does it take to construct a Computer Security Incident Response Team (CSIRT)?
Constructing a CSIRT takes a lot of work to get up and running. It takes preparation to make sure it has a proper policy foundation, has operating procedures that will be effective in the orgs computing environment, gets proper training and is prepped to response properly
What type of materials and assembly should an ORG have for a security preparation?
Backup equipment, blank removable media, forensic and packet capture software, Office supplies and evidence collection materials and bootable USB media with trusted copies of forensic tools
According to the NIST 800-61 guideline, describe how Alerts should work
Alerts should originate from intrusion detection and prevention systems, SIEM systems, antivirus software, file integrity checking software, and others
According to NIST 800-61, describe how logs should play a role in a security program
Logs should be those that are produced by the OS, services, apps, network flows and devices
According to NIST 800-61, describe public available information
Public available information is information shared with the public about any new developments in terms of exploits and vulnerabilities in a lab environment
According to NIST 800-61, describe People
People describes those who work inside the org or external sources that report the activity that may indicate that an issue is currently happening
