CISSP Domain 7 Flashcards
Incident management steps
Detect
Response - Severity of incident (CIRT)
Mitigate
Reporting
Recovery
Remediation
Lessons learned
Primary goals of effective incident management
Limit effect or scope of an incident
Recovery
Effective incident and configuration management
Remediation
Perform RCA
Botnets
Multiple bots in a network form a botnet and will do what attackers instruct to do
C&C
DoS
So many data packets sent across to a server causing system to slow
DDoS
When Multiple systems attack a single system at same time
DRoS
Manipulates traffic or network device so that attacks are reflected back to the victim from other sources
SYN flood
Doesn’t complete three way handshake
Doesn’t send ack hence gets flooded
Smurf attack
Floods victim with ICMP echo packets instead of TCP SYN packets
Attacker send echo request out as a broadcast to all systems on networks to spoof the source IP address.
All these systems respond with with Echo replies to spoofed IP address
Fraggle attack
Smurf attack instead of ICMP uses UDP
Ping flood
Flood victims with ping requests
Ping of death
Oversized ping packets
Teardrop
Attack Fragmented data packets, making it too difficult to put it back by receiving system
Land attack
Sends spoofed syn packets to a victim using victims IP address as both the source and destination IP address
2 types of MiTM
Sniffing traffic between two parties
Store and forward proxy mechanism by sitting in between
Types of IDS
knowledge based - IDS can have sensors or agents to monitor key devices , signature based
Behaviour based - Create a baseline to detect abnormal behaviour
IDS response
Passive response- Notification can be sent to admins in email or text message
Dashboard type
Active Response: Modify environment using Firewall
IDS types
Host based
Network based
NIPS
Block an attack after it starts
Honeypot and Honeynet
Enticement or decoy
Don’t make it entrapment
Honeynet - Two or more networked honeypots used together
Hosted on VM for easy re creation
Firewall blocks
Router to block broadcast
Private IP address
Sandboxing
Provides security boundary for apps and prevents the apps interacting with other apps
Goal of logging and monitoring
To prevent incidents and provide effective response when they occur
Common log types - Security
Security logs: Record access to resources such as files, folders , printers
System logs
When system, service starts or stops
Application logs
Application devoloper choose what to record in app logs
What type of control are audit trails ?
Deterrent
SIEM - Sampling
Data reduction to use precise mathematical functions to extract meaningful information from large volume of data
Clipping levels
Non stastical sampling - Discretionary of the owner - Discretionary sampling
Predefined threshold for the event
Rollover logging
Admins set maximum log size then over write the logs
SOAR
Automated response to some incidents
SOAR - Incident response methods
Playbook - What needs to be done if an incident occurs
Runbook - playbook data into an automated tool
Example: IDS implementing it
SOAR technologies will automatically deal with false positives based on runbook
Difference between ML and AI ?
Reinforcement learning (Plays itself) Vs zero knowledge of the game
Seperate algorithm outside of AI system enforce rules
Behaviour based users ML to learn from false positives
AI starts without a baseline creates it’s own baseline based on traffic. It looks for anomalies
Threat intelligence
Gathering data on potential threats
Kill chain
Reconciance
Weaponization
Delivery
Exploitation
Installation
C&C
Actions on objectives
