CISSP Domain 7 Flashcards
Security Operations
Operations department responsibility Administrative management responsibilities Assurance levels Configuration management Physical security Secure resource provisioning Network and resource provisioning Preventive measures Patch management Incident management Recovery strategies Disaster recovery Business continuity planning and exercises Liability Investigations Personal safety concerns
Security Operations pertains to
everything that takes place to keep networks, computer systems, applications, and environments up and running in a secure and protected manner
Security Operations also involves
detection, containment, eradication, and recovery required to ensure continuity of business operations
Role of Operations Department
Continual effort to make sure the correct policies, procedures, standards, and guidelines are in place
Separation of duties
helps prevent mistakes and minimize conflicts of interests.
Job rotation
over time, more than one person fulfills the task of one position.
Mandatory Vacations
an Administrative control
detect fraud
Initial Program Load
Mainframe term for loading an OS kernel
Configuration Management
process of establishing and maintaining effective system controls
Input and Output controls
Data entered should be the correct format
Transactions should be atomic
Must be timestamped and logged
Bastion Hosts
Locked down at entry of network
2 main types of mechanical locks
Warded is basic padlock. Spring loaded bolt with a notch cut in it. Key fits the notch and slides the bolt from locked to unlocked position These are the cheapest
Tumbler has more pieces and parts than a ward lock. Key fits a cylinder pins are raised
3 types of tumbler locks
pin tumbler most common tumbler lock. key has just the right grooves to put all spring loaded pins in the right position
wafer tumbler also called disk tumbler are small, round locks as on file cabinets Uses wafers, or flat disks instead of pins
lever tumbler
Cipher locks
programmable locks are keyless and use keypads
Fences
3 to 4 feet only deter casual trespassers
6 to 7 feet are too high to climb easily
8 foot deter more determined criminal
PIDAS fencing
Perimeter Intrusion Detection and Assessment System
Type of fencing with sensors on the wire mesh of the fence.
Gate classifications
Class 1 Residential
Class 2 Commercial
Class 3 Industrial
Class 4 Restricted access
Bollards
Concrete pillars outside a building
Mean Time Between Failures
How long is a piece of equipment expected to last.
Calculated by average time between failures.
Mean Time to Fail MTTF
Life expectancy of a product
Mean Time To Repair MTTR
amount of time to fix a failure and return to production
Single Points of Failure
Firewalls, routers, network servers T1 lines, Hubs, switches, authentication servers
RAID
Redundant array of Independent Disks
Redundancy and Speed
Direct Access Storage Device
General Term for magnetic disk storage devices
Massive Array of Inactive Disks
Carries out mostly write operations
Redundant Array of Independent Tapes
Striped over multiple tape drives
Rainbow Tables
All possible passwords in hashed formats
Hierarchical Storage Management
Continuous backup functionality
Dynamically manages storage and backup of files
Faster media holds files used more often.
Seldom used files are stored on slower devices
Trivial File Transfer Protocol
Used to save configuration of network devices.
Is insecure
Preventive Measures
Understand the Risk Use the right controls Use controls correctly Manage your configuration Assess your operation
IPS IDS False Positive
detecting intrusions that are not intrusions
IPS IDS False negatives
system incorrectly classifies as being Benign
Baselining
Process of establishing normal patterns of behavior
Patches are
software updates intended to remove a vulnerability or defect in software or provide new features or functionality.
Sandboxing
isolates executing code from the operating systems
Honeypots
device developed in order to deceive attackers into believing it is a real production system
Honeynet
An entire network that is meant to be compromised
7 phases of Incident Management
Detect Respond mitigate Report Recover Remediate Learn
Event is
any occurrence that can be observed, verified, and documented
Incident is
one or more related events that negatively affect the company and/or impact its security posture
Cyber Kill Chain
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
6 Command and control
7 Actions on the Objective
Detection
Realize you have a problem
Response
Determine appropriate action after detection
Mitigation
after Detection and Response
What happened and what will happen next
Prevent or reduce further damage
Reporting
After Detection, Response, and Mitigation
Summary Indicators Related Incidents Action Taken Chain of Custody Impact Assessment Identity and comments of incident handlers Next steps to be taken
Recovery
After Detection, Response, Mitigation, and Reporting
Return all systems to a known good state
Gather evidence before recovery
Remediation
After Detection, Response, Mitigation, Reporting and Recovery
Ensure the attack is never successful again
Learning
What happened
What dd we learn
How can we do it better next time
Postmortem Analysis
Recovery Time Objective
maximum time period within which a business process must be restored to a designated service level after a disaster
Should be smaller than the MTD value
Work Recovery Time WRT
remainder of MTD value after the RTO has passed
Recovery Point Objective
is the acceptable a
Amount of data loss measured in time
Hot site
facility that is leased or rented and is fully configured to operate withing a few hours
Equipment and software must be completely compatible
Must not cause any negative interoperability issues.
Most expensive of the three types of offsite facilities
Warm Site
Leased or rented facility that is usually partially configured with some equipment, such as HVAC, and foundational infrastructure components, but not he actual computers
Equipment may need to be procured, delivered, and configured.
Cold Site
Leased or rented facility that supplies basic environment, electrical, wiring, air conditioning, plumbing and flooring
Is an empty data center.
Service Bureau
a company that has additional space and capacity to provide applications and services such as a call center.
Tertiary Site
a secondary backup site
Reciprocal agreement
with another company to host infrastructure
Redundant sites
mirrored sites
two sites completely synchronized
ICS2 differentiates between a hot leased site and a redundant company owned site
Rolling Hot Site
Large truck is turned into a data processing or work area
Backups can be
Full, differential, incremental, or a combo
Archive bit
file systems keep track of what files have been modified by setting an archive bit. If a file is modified or created, the file system sets the archive bit to 1
Full backup
During a full backup the archive bit is cleared
Most companies do a full backup with a differential or incremental backup
Differential backup
backs up files that have been modified since the last full backup
When restored, the full backup is done first, then differential is put on top of it.
Differential does not change the archive bit
Incremental backup
all files modified since last full or incremental backup.
Archive bit is cleared.
To restore and incremental backup, restore the full then every incremental backup
Disk shadowing
similar to disk mirroring
Fault tolerant solution by duplicating hardware and maintaining more than one copy of information
Disk duplexing
more than one disk controller If on disk controller fails, the other is ready and available
Electronic vaulting
makes copies of files as they are modified and periodically transmits them to an offsite backup site
Carried out in batches rather than real time
Method of transferring bulk information to offsite facilities
Remote Journaling
method of transmitting data offsite but only includes moving journal or transaction logs to the offsite facility
Actual files are not moved
Remote is real time
Remote vaulting is in batches
High Availability
combination of technologies and processes that work together to ensure some specific thing is always up and running
