Chapter 10 - Incident and Disaster Response Flashcards
What three things are successful attacks commonly called?
Successful attacks are commonly called:
- Security Incidents
- Breaches
- Compromises
What are the four severity levels of incidents?
The four severity levels of incidents are:
- False Alarm - AKA false positives.
- Minor Incidents - Small virus outbreaks, etc.
- Major Incidents - Beyond the ability of on-duty staff, requires a computer security response team to be assembled, and require action beyond the IT department.
- Disaster - Fire, flood, terrorist attacks. Threatens business continuity.
Why is speed of response important?
Speed of response is important because the majority of attackers will continue to do harm until they are stopped. In addition, attacks generally cause systems to fail, and each minute they are down is money lost.
What is the purpose of a CSIRT?
A CISRT, or a computer security incident response team, is a team of IT and IT security professionals dedicated to resolving an incident, as well as members from legal, PR, and senior management.
What is business continuity?
Business continuity is the day-to-day revenue-generating operations of the firm.
Who should head the business continuity team?
A senior manager should head the business continuity team.
Why is accuracy of response important?
Accuracy is important, as haste can lessen accuracy, allowing people to overlook the root cause in the rush to fix.
Define incident response in terms of planning.
In terms of planning, incidence response is only as effective as the plans set, and in most situations, no plan will fit exactly. Improvisation is key.
Why are rehearsals important?
Rehearsals are important because they allow a firm to practice plans and procedures that may only come up in a true crisis.
What is a walkthrough or table-top exercise?
A walkthrough/table-top exercise is the simplest form of rehearsal, where key personnel gather together and discuss, step by step, what each will do during an incident.
Why is a live test better than a tabletop?
A live test is preferential to a tabletop because actually going through the steps can actually reveal small flaws that might not be apparent in a tabletop.
What is the problem with live tests?
The main problem with live tests is that they are expensive.
Distinguish between detection and analysis.
Detection is the act of learning that an incident has occurred. Analysis is the act of understanding the incident, determining the damage potential, and to gather information needed for containment and recovery.
Why is good analysis important for the later stages of handling an attack?
In the later stages, good analysis will help uncover the root cause of the issue, and allow for diagnosis and repair.
What is escalation?
Escalation is the act of increasing the priority of an incident.
What is containment?
Containment is the method by which the damage is stopped from progressing.
Why is disconnection undesirable during containment?
Disconnection is undesirable during containment because, while it stops the attack, it prevents legitimate users from using services. This can have significant business impact.
What is black holing? Why may this only be a temporary containment solution?
Black holing is a method of containment where the packets from a particular IP address are automatically dropped to prevent an attack? This may wind up being only a temporary solution because of the ease in which an attacker could spoof a new IP address.
Why might a company allow an attacker to continue working in the system for a brief period of time? Why is this dangerous?
A company might allow an attacker to continue working in the system for a brief period of time in order to gather more information on the attacker, provided the damage isn’t too severe. This is dangerous, because the longer the attacker is in the system, the more likely they are to erase their presence from logs, or gain access to do more severe damage.
What are the three major recovery options?
The three major recovery options are:
- Repair During Continuing Operation
- Restoration From Backup Tapes
- Total Software Reinstallation
What are the two main reasons that repair during continuing operation good?
The two main reasons that repair during continuing operation is good is that:
A. It reduces downtime
B. No data is lost, as there is no need to use a restore tape
Why may not repair during continuing operation work?
Repair during continuing operation may not work because it is not always possible to find all the Trojans, rootkits, and other tools of the break-in.
Why is the restoration of data files from backup tapes undesirable?
The reason that restoration from tape is undesirable is that any data collected since the last update will be lost, or if the attack began before the restore, the restore could restore Trojans and such.
What are the potential problems with total software reinstallation?
Total software reinstallation comes with data loss, but that is still dependent on the organization still having the original installation media.
How does having a disk image reduce the problems of total software reinstallation?
Disk images remove the problem of having to retain the original installation media.
What are the three rules for apology?
The three rules of apology are as follows:
- Acknowledge responsibility and harm.
- Explain what happened, without technical details.
- Explain what actions will be taken to compensate the person.
Why do companies often not prosecute attackers?
There are three main reasons companies often choose to not prosecute attackers:
- Cost and Effort - Finding and prosecution are pretty tricky.
- Probability of Success - Very rarely is the attacker someone for whom the punishment will really matter (foreign national, teenager, etc)
- Loss of Reputation - Public prosecution is an admission of a failure to protect information.
What is forensics evidence?
Forensics evidence is evidence that is acceptable for court proceedings.
Under what conditions will you need to hire a forensics expert?
For civil lawsuits (torts), only evidence collected by a forensics expert will be permissible in court.
What is the chain of evidence, and why is documenting it important?
The chain of evidence is the hands that evidence has passed through to get to court and the protection it has been under. It must be documented completely, otherwise it could be tossed out on grounds that it could have been tampered with.
Why should a senior manager head the CSIRT?
A senior manager must head the CSIRT because all the security decisions made during a major incident are also business decisions.
Why should members of affected line departments be a on the CSIRT?
Members of the line departments affected by the major incident should be a part of the CSIRT because they will have knowledge of the impact of the incident.
Who is the only person who should speak on behalf of the CSIRT?
The head of public relations is the only person who should speak on behalf of the firm.
Why should both the Police and the FBI be called in the case of an attack?
Both the police and the FBI should be called in the case of an attack because it is not certain which of them will have jurisdiction over a particular crime.
What different actions do criminal and civil law deal with?
Criminal law deals with violations of criminal statutes, which are laws that prohibit specific behaviors. Civil law deals with interpretations of the rights and duties that companies or individuals have relative to one another.
How do punishments differ in civil and criminal law?
Punishment in criminal law generally deals with jail time and fines, whereas civil law generally deals with monetary penalties or orders to take or not take action.
Who brings lawsuits in civil and criminal cases?
Lawsuits are brought by a prosecutor against a defendant in a criminal case, whereas a plaintiff brings the case against the defendant in a civil case.
What is the normal standard for deciding a case in civil and criminal cases?
In a criminal case, the prosecutor must prove beyond a reasonable doubt that the defendant is guilty. In civil, the plaintiff must prove a preponderance of the evidence (> 51%) that the defendant is liable for damages.
What is mens rea? In what type of trial is mens rea relevant?
Mens rea is being in the mental state to intentionally commit the act that is in question. It’s generally only used in criminal cases.
Can a person be tried separately in a criminal trial and later in a civil trial?
A person can be tried in a criminal trial, and then be later sued in civil court for damages by the victim.
What is case law?
Case law is where judicial decisions set precedent for how laws may be interpreted in future trials.
What are jurisdictions?
Jurisdictions are areas of responsibility in which government bodies can make an enforce laws, and outside of which, are powerless.
