Chapter 21: Security Operations Flashcards
Tier 1 security analysts
monitor security tools and platforms for suspicious activity
Tier 2 security analysts
investigate alerts, declare security incidents, coordinate with incident responders and intelligence analysts to investigate, contain, and eradicate threats
Threat Intelligence
evidence-based knowledge of an existing or emerging menace or hazard to assets used to inform decisions regarding responses to it
Three types of threat intel sources
threat data feeds, open-source intelligence (OSINT), and internal systems
cyberthreat hunting
practice of proactively looking for threat actors in your network
firewalls support and enforce org’s network security policy by …
restricting access to one network from another network
packet-filtering firewalls
make access decisions based on network-level protocol header values using access control lists (ACLs)
stateful firewalls
add to the capabilities of packet filtering firewalls by keeping track of the state of a connection between two endpoints
proxy firewalls
intercept and inspect messages before delivering them to the intended recipients
NGFW
next-generation firewall
next-generation firewall
combines the attributes of others firewalls, but adds a signature-based and/or behavioral analysis IPS engine and cloud-based threat data sharing
IDS/IPS
intrusion detection and prevention systems
intrusion detection and prevention systems
categorized as either host-based or network based and rule-based or anomaly-based
HIDS
host-based
NIDS
network-based
