Chapter 22: Security Incidents

Question 1

MOM

Answer 1

motive, opportunity, means

Question 2

evidence preservation

Answer 2

maintain chain of custody and cryptographic hashes of all digital evidence and controlling access to the evidence

Question 3

four phases of evidence handling

Answer 3

identification, collection, acquisition, and preservation

Question 4

runbook

Answer 4

collection of procedures which the IR team follows for specific types of incidents

Question 5

incident classification criteria

Answer 5

prioritize IR assets and consider the impact and type of incident, urgency with which the response must be started

Question 6

seven phases of incident management

Answer 6

detection, response, mitigation, reporting, recovery, remediation, and lessons learned

Question 7

containment during the response phase

Answer 7

to prevent or reduce any further damage from the incident

Question 8

remediation phase of incident management

Answer 8

security controls are deployed or changed to prevent the incident from recurring; changes to firewall or IDS/IPS rules, identification of IOAs and IOCs

Question 9

IOA

Answer 9

indicators of attack; to detect an attack in real time

Question 10

IOC

Answer 10

indicator of compromise, which tell when an attack has been successful and security has been compromised

Question 11

characteristic of admissible evidence

Answer 11

relevant to the case, reliable (must be consistent with fact and must not be based on opinion or be circumstantial), and legally obtained