Ch 3 SC

Question 1

CVE

Answer 1

Common Vulnerabilities and Exposures.
• An identifier of Common Vulnerabilities.
• A dictionary of publicly known Vulnerabilities and exposures in products and systems maintained by MITRE.
• CVE ID is the industry standard to identify Vulnerabilities.
• The goal of CVE is to make it easier to share data across tools, vulnerability repositories, and security services.

Question 2

Vulnerability

Answer 2

An exploitable weakness in a system or its design.

Question 3

Threat

Answer 3

• Any potential danger to an asset.
• If a vulnerability exists but has not yet been exploited or, more importantly, it is not yet publicly known-the threat is latent and not yet realized.

Question 4

Malicious actor

Answer 4

• The entity that takes advantage of the vulnerability.

Question 5

Threat vector

Answer 5

• The path used by this actor to perform the attack

Question 6

Countermeasure

Answer 6

• A safeguard to mitigate a potential risk

* It does this by either reducing or eliminating the vulnerability

Question 7

Threat Actor

Answer 7

• The individuals (or group) who perform an attack or are responsible for security.
Eg: script kiddies, organized crime, state sponsors and governments, Hactivists, terrorist groups

Question 8

Threat Intelligence

Answer 8

• Knowledge about an existing or emerging threat to assets.
• Threat intelligence includes context, mechanisms, indicators of compromise (IOCs), implications, and actionable advice.

Question 9

IOC

Answer 9

• Indicator of compromise. Threat intelligence information

Question 10

Exploit

Answer 10

• Software or sequence of commands that takes advantage of a vulnerability in order to cause harm to a system or network.
• Most Common exploit categories are remote and local exploits.

Question 11

CVSS

Answer 11

• Common Vulnerability Scoring System.

* Industry standard to convey vulnerability severity and to help determine urgency and priority of response.

Question 12

PII

Answer 12

• Personally identifiable information

* Name, Social Security number, DOB, Drivers license, etc

Question 13

PHI

Answer 13

• Protected Health information

Question 14

Separation of Duties

Answer 14

• An administrative control that dictates that a single individual should not perform all critical or privilege level duties.

Question 15

SOC

Answer 15

• Security Operation Center
• Provides detection, containment, and remediation via People, Processes, technology.
• facilities where an organization asset’s, including applications, databases,servers, networks, desktops, and other endpoints are monitored.

Question 16

Runbook

Answer 16

• A collection of procedures and operations performed by systems administrators, security professionals, or network operators.
Effectiveness measures for Runbooks:
1. Mean time to repair(MTTR)
2. Mean time between failures (MTBF)
3. Mean time to discover a security incident.
4. Mean time to contain or mitigate a security incident
5. Automating the provisioning of IT resources.

Question 17

Chain of Custody

Answer 17

• The way you document and preserve evidence from when you started to the time presented to a court.
• How the evidence was collected
• When it was collected
• How it was transported
• How it was tracked; How stored
• who had access and how

Question 18

Risk

Answer 18

• the possibility of a security incident (something bad) happening.

Risk = Threats x Vulnerabilities x Impact
• Risk pertains to the loss of confidentiality, integrity, availability of information.

Question 19

Attack Surface

Answer 19

• The total sum of all the Vulnerabilities in a given system that is accessible to an attackers.
• The Attack surface describes different points where an attacker could get into a system, and where they could extract data out of the system.

Question 20

Forensics

Answer 20

• Using scientific knowledge for collecting, analyzing, and presenting evidence to the courts.

Question 21

Exploit Kit

Answer 21

• A compilation of exploits that are often designed to be served from web servers.
Examples: Angler, Mpack, Fiesta, Phoenix, Blackhole, Crimepack, RIG

Question 22

5 Step Threat Intelligence Process

Answer 22

• Step 1: Planning and Direction
• Step 2: Collection
• Step 3: Processing
• Step 4: Analysis and Production
• Step 5: Dissemination