Blueprint Flashcards
CVSS Attack Vector
Attacker proximity.
Local, Adjacent, Network, Physical
CVSS Attack Complexity
Special skill needed or not
CVSS Privileges required
Permissions attacker needs (None, Low, High)
CVSS User Interaction
Whether user must participate for attack to succeed
CVSS Scope
Ability to go beyond authorization of vulnerability to other parts.
CVSS Rating Scale
0.0 None .1-3.9 Low 4-6.0 Medium 7-8.9 High 9-10 Critical
CVSS Temporal Score
Time based - Vulnerability
CVSS Enviro score
Environmental specifics
FAT32 Max Size
2TB
NTFS supports
Disk Quota
Security & Encryption
Permissions
ADS
Alternative Data Streams
Files stored as attributes. $DATA.
Can hide malicious code
MACE
Modify, Access, Create, Entry modified attributes of NTFS
Entry modified in MFT
EFI (Extensible Firmware Interface)
When computer boots, EFI loads files store on the ESP to start OS and utilities.
ESP (part of EFI)
Needs to be formatted with a FAT file system. (Maintained by UEFI)
Timestamps on a filesystem
Time event is recorded on a computer (not the time of the event itself).
EXT4
Journaling file system for Linux
Journaling
Changes to file system recorded in a log
MBR
Partition list and boot loader
MAC (Message authentication code)
Confirms authenticity of a message (Integrity and authenticity)
(Could be talking about Mandatory access control. not clear)
Best evidence
Best available evidence
Corroborative evidence
Evidence that supports an assertion
Indirect evidence (Circumstantial)
Inference required to support conclusion
Altered disk image
Image with compromised integrity
Unaltered disk image
Image not tampered with and will provide same hash
Attribution
Enough evidence to assign a source
Assets priority
Critical, Important, Sensitive
Asset priority allows analyst to…
Prioritize responses
DM Adversary
Threat actor. (Likely not known)
DM Capability
Tools/Techniques used
DM Infrastructure
Physical/Logical comms structures used by adversary
DM Direction
Where event actions are started from (adversary to victim, etc.)
DM Methodology
Class of attack (DOS, Phishing, etc.)
DM Resources
SW, HW, money
IR Policy elements
Scope, Definition of incidents, Org structure, Prioritization/ratings of incidents, Performance measures, Reporting forms
IR Steps (4)
Preperation
Detection and Analysis
Containment, Eradication, and Recovery
Lessons learned
Preparation elements
Awareness training
Documentation (CMDB)
RACI
Detection and Analysis Elements (3)
Identification (Monitoring and Hunting)
Analysis (Validate the incident following process)
Prioritization
Analysis questions (4)
Which systems are affected?
Who/what originated the incident?
Tools or attack methods used?
Vulns exploited?
Containment
Hardest and most important decision.
Scope, Device, network reach, speed of containment, speed required
Eradication and Recovery
Find root cause of incident and clean it up. Possible restores,
Hardening, Monitoring, other changes.
Lessons learned
How and why it happened. Perform FMEA.
IH Identification
Monitoring, Hunting, IR activation, contact CERT
IH Scoping
Analysis, Prioritization
IH Remediation
Eradication and Recovery
Hardening!!!
Hardening is part of which IR phase?
E and R
IH Reporting
Reporting to internal and external teams.
Evidence collection order (3 steps)
Develop plan to acquire data
Acquire the data
Verifying integrity of the data
Forensics: When do you prioritize sources to acquire?
During Plan development.
Tools needed to collect volatile data?
Forensic tools.
Bit stream images
Bit for bit copy that preserves file times
Data preservation factors (4)
Legal
Chain of Custody
Examine copy
Preservation
Data normalization
Manipulating security event data and fitting it into a common schema
Retrospective analysis
Research when outcome is already known
Deterministic assessment
Analyst bases assessment on small set of assigned values.
Known data-Single Outcome
Minimum speculation required.
Probabilistic assessment
Wide range of probably scenarios of all possible outcomes.
Determines likelihood of an exploit will impact a network.
Less accurate than deterministic.
Dynamic analysis (malware)
Study of malware running in controlled environment
exFat Facts (3)
Allocation bitmap used
FAT based file system
exFat older than NTFS
Data carving
Recovering files from unallocated space
Default location for Linux Bootloader
MBR
Who can run PCI compliance vulnerability scans?
Qualified employee or vendor with proper creds to perform scan.
