Chapter 14 Incident Response Flashcards
What at the 6 steps of the incident response process?
PICERL
Preparation Identification Containment Eradication Recovery Lessons Learned
Incident response team members
Management Information Security Technical experts Communications/public relations Legal and HR LEO
IR Exercises
Table top
walk through
simulation
Incident response plans
Communication plans
stakeholder management plans
Business continuity plans
disaster recovery plans
What is COOP
COOP is 4 phase continuity of operation planning.
- readiness and preparedness
- Activation and Relocation
- Continuity of Operations
- Reconstitution
What are retention policies?
a retention policy determines how long you keep data and how it will be disposed of.
What is MITRE ATT&CK
Its a website that explains what attack lifecycles and attack behavior looks like.
curated knowledge base and model for cyber adversary behavior.
What are the core features of the Diamond Model of Intrusion Analysis
Adversary
Capability
Infrastructure
Victim
What is the Cyber Kill Chain
RWDEICA
Reconnaissance Weaponization Delivery Exploitation Installation C2 Actions on Objective
What is SIEM
Security Information and Event Management
Provides real time analysis of security alerts generated by apps and hardware
Correlate data from multiple sources and provide actionable intelligence
At the heart of alarms, alerts and correlation for SIEM is RULES.
rules drive each of these components and can use logic to determine rule activation and can trigger action based on these rules.
Tools
Sensors deployed to gather additional data
sensitivity sets thresholds, filter rules
trends can point to new problems that start to crop up
alerts (fatigue occurs when they happen too often or false positive)
correlation matches data points
What is the purpose of log files in incident response?
to provide IR staff with information about what occurred.
What is SIP
Session Initiation Protocol is a signaling protocol used for initiating maintaining and terminating real time sessions such as voice, video and messaging applications.
What is SFlow, NetFlow and IPFIX
network/bandwidth flow monitors, they can be useful when attempting to determine what traffic was sent to your network
- not always helpful since they provide limited data, some detail is lost.
