Book 1

Question 1

6 Steps, Incident Handling

Answer 1

Preparation (in steady-state bounce between this and identification), Identification (in steady-state bounce between this and preparation, Declare Incident (move to containment)), Containment (Start cleanup (move to eradication)), Eradication (Finish cleanup (move to recovery)), Recovery (Back in production (move to lessons learned)), Lessons Learned (Done (jump back to another step if necessary))

Question 2

Unusual Log Entries

Answer 2

System Admins should periodically review their system logs, looking for signs of unusual behavior.

Look for:

• That an interface has entered promiscuous mode.
• That someone has repeatedly tried unsuccessfully to log into the machine via telnet or sshd.
• Remote Procedure Calls (RPC programs) being accessed with strange sequences of characters, which are possibly buffer overflows or format string attacks.
• Large number of Apache error messages.

Question 3

Remote Procedure Call

Answer 3

Remote Procedure Calls (RPC programs) being accessed with strange sequences of characters, which are possibly buffer overflows or format string attacks.

(-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM)

Question 4

7 Deadly Sins

Answer 4

• Failure to report or ask or help
• Incomplete/non-existing notes
• Mishandling/destroying evidence
• Failure to create working images
• Failure to contain or eradicate
• Failure to prevent follow-on compromise months later
• Failure to apply lessons learned

Question 5

Absolute and Relative Referencing

Answer 5

$ cd /etc/sysconfig/network-scripts (is an absolute reference);

$ cd sysconfig/network-scripts (is relative, and only works from the /etc folder)

Question 6

Account Management

Answer 6

look for new unexpected accounts:

GUI “C:> lusermgr.msc”,

Command line “C:> net user” search groups

command line “C:> net localgroup administrators

Question 7

Adding Directories to PATH

Answer 7

To add directories to your path.
Temporarily PATH:
$ PATH=$PATH: [another_dir]

To change your path permanently for this account, you must edit the .bash_profile file:
$ PATH=$PATH:[new_directory];

$ PATH=$PATH:/home/tools

Question 8

Analysis of Perimeter and Host Perimeter Detects

Answer 8

When you determine a listening port, you should look up the port to see its official assignment, as well as potential malicious use of that port.

How can you find out if the service is running?

Try “lsof -i” on unix and also “netstat -a” on unix or windows.

Question 9

Application-Level Detection (Incident Identification)

Answer 9

Application logs can be reviewed by incident handlers at this level (web app, appserver, cloud service, etc..)

Question 10

Network Perimeter Detection

Answer 10

• Identification occurs on network

- Firewall, routers, external-facing network-based IDS, IPS, DMZ systems etc.

Question 11

Host Perimeter Detection

Answer 11

• Identification occurs when data enters or leaves a host

- Personal firewall/IPS, local firewalls, port sentry tools

Question 12

System-level (i.e., host) detection

Answer 12

• Identification occurs based on activity on the host itself

- Anti-virus tools, endpoint security suites, file integrity tools, user noticing “strange” behavior

Question 13

Application-level detection

Answer 13

• Application logs (web app, app server, cloud services, etc. Checking logs important.

Question 14

Applying Cheat Sheets

Answer 14

Need a communications plan, print one out for each sys admin, distribute to ops management, weekly/monthly sys admin meeting, periodic conference calls, serperate calls for windows and linux

Question 15

Applying Network Config Changes

Answer 15

To make your changes happen, you have to restart the interface. 
# service network restart

Question 16

Arrest/False Arrest

Answer 16

Legal process to deprive an individual of his/her freedom

Question 17

Artifact Discovery with Open Indicators of Compromise (IOC)

Answer 17

Mandiant provides a series of IOC files, each one defining the artifacts associated with items a particular attack or threat would leave behind on a computer

Question 18

Assessment Questions (Part 1)

Answer 18

how skilled is the attacker, what skill level is need to explit vuln, how large is the affect across the org, what is the value of the vuln sys, can vuln be exploited remotely, zero day easy to get exploit, is fix available, is there any other factors that reduce on increase potential impact? Lenny Zeltser’s Incident Questionnaire

Question 19

Assessment Questions (Part 2)

Answer 19

When looking at the situation, you need to determine how much damage could be caused: - How widely deployed is the affected platform or application? - Effect of the vulnerability exploitation? - Value of impacted systems, value of data on those systems? - Can the vulnerability be exploited remotely? Is a public exploit available, was one recently released?
Also ask yourself: What level of skill and prerequisites are required by an attacker to exploit vulnerability? - Is vulnerability present in a default configuration? - Is a fix available for the vulnerability? Do other factors exist which reduce or increase the vulnerability’s risk or potential impact such as the possibility it is a worm?