Chapter 17 Flashcards
Incident Management
- Detection - IDS, anti-malware, audit logs, etc.
- Response
- Mitigation - contain incident
- Reporting
- Recovery
- Remediation
- Lessons learned
DoS attacks
- SYN flood attack
- Smurf attack - reflective DoS; broadcast ICMP echo req with spoofed victim IP
- Fraggle - reflective DoS; broadcast UDP echo req with spoofed victim IP
- Ping flood
Legacy attacks:
- Ping of Death - oversized ping packet
- Teardrop - fragmented IP packet
- LAND - LAN denial attack - SYN with same src and dst IP’s
IDS
- Knowledge-based or signature based
- low false positives
- cannot detect unknown or new attacks - Behavior-based (or statistical or heuristics-based) - first creates baseline of normal activity
- can be considered expert system or pseudo-AI system
- high false positives
Host-based IDS
- can examine events in more detail
- costlier and harder to manage
- consumes system resources
- intruder may discover and disable
Network-based IDS
- can monitor large network using remote sensors and send to SIEM
NIPS (network intrusion prevention system)
Must be placed in-line with traffic
Additional Preventive Measures
- Honeypot - attract attackers; includes pseudo-flaws
- Honeynet - network of honeypots
- Warning banners
- Anti-malware
- Whitelisting or blacklisting apps
- Firewalls - block directed broadcasts (unicast until reach dest network then becomes broadcast); block private IP’s at the border; block pings
- Sandboxing
Protection of logs
Send one copy to SIEM
Set permissions to logs
Monitoring - process of reviewing logs, looking for something specific
Tuning - adjusting security controls to better match needs of org or env
SIEM (Security Info and Event Management) system
Central SIEM server
SIEM agents on hosts, network devices, etc.
Clipping level
Non-statistical sampling normally used to audit events; only notify when number reaches clipping level
- not as accurate as statistical sampling but easier
Other monitoring types
Traffic and trend analysis - looks at network flow
SOAR (Security Orchestration, Automation and Response) system
Playbook - doc or checklist on how to verify incident
Runbook - implements the playbook into automated tool
ML (machine learning) - starts with rules; part of AI
AI (artificial intelligence) - starts with nothing, and learns the rules based on feedback and applying ML
When applied to behavior-based detection system:
- ML: baseline provided; false positive is fed back; ML refines baseline
- AI: monitors traffic and develops baseline; also uses feedback from admin for false positives
Cyber Kill Chain Framework
- Defense by thwarting each of these stages
- use in conjunction with MITRE ATT&CK, which lists attack TTP’s (tactics, techniques, procedures)
7 stages of attack:
1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command and Control
7. Actions on objectives
