Course 6 - Week 3 Flashcards
Give me an example of one detection tool that organizations use other than the automatic tools that are utilized - SIEM and IDS.
Threat hunting - It is a detection method in which humans manually look for threats (that are not detected by the automatic detection tools) in the organization.
They make use of different technologies and sources to look for threats. For example - They do research on emerging threats and get information from OSINT (Open Source Intelligence platforms).
Threat hunters also use IOC (Indicators of Compromise), IOA and Machine learning to find threats or more information regarding them.
Cyber Deception (Like honeypots) can also be deployed for threat detection.
Define the Detection and Analysis part of the Incident Response lifecycle.
Detection - it is the prompt discovery of security events.
Analysis - It is the investigation and validation of alerts.
What is Pyramid of Pain?
It is a graph that gives the relation between different IOCs and the level of difficulty that an attacker has to face to penetrate a network or device if this IOC is blocked by the security organization.
Look for the photo of the Pyramid of Pane on the internet.
As the IOC number increases, it’s difficulty is also increasing.
- File hashes
- IP addresses
- Domain name
- Network/host artifacts
- Attack tools
- TTP - Techniques, Tactics and Procedures
How does a security analyst investigate events in which they have found some IOC?
To add more context to the investigation or to get more information related to IOC, security analyst make use of threat Intelligence. For example, if we have a malicious file, we can make a hash of it and then get more context regarding this file from virustotal.com site =.
What is crowdsourcing?
Crowdsourcing is the practice of gathering information using public input and collaboration. Threat intelligence platforms use Crowdsourcing.
What is the use of documentation?
Having documentation provides the following benefits -
- Clarity - for example - playbooks provide clarity
- Standardization -
- Transparency - It is used in chain of custody.
What is Broken chain of custody?
It is the scenario when we have missing documentation about who handled the evidence or when they handled it.
Inconsistencies in the collection and logging of evidence in the chain of custody.
What are some best practices for creating documentation?
- Know your audience
- Be concise
- Update regularly
What is triaging and what are the steps involved in it that are performed by the security analyst?
While responding to alerts, the security analyst performs the process of triaging.
Triaging is the prioritizing of incidents according to their level of importance or urgency.
It involves 3 steps -
- Receive and asses -
- Assign a priority
- collect and analyze -
What are the 3 steps involved in triaging process?
- Receive and asses - In this step, the security analyst will validate the alert and will get a complete understanding of the alert.
Some questions to ask in this step -
- Is this a false positive
- Has this alert been triggered before?
- Has this alert been triggered by a known vulnerability?
- Wat is the severity of this alert? - Assign a priority - While assigning priority, we consider following things.
- functional impact
- Information impact
- recoverability - collect and analyze -
What are benefits of triaging?
- Resource management
- Standardized approach
Define containment eradication and recovery.
Containment - It is an act of limiting and preventing additional damage caused by an incident.
Eradication - It is the process of removing all the elements related to an incident. Ex - Task of doing vulnerability assessment tests and applying patches to vulnerabilities.
Recovery - It is the process of returning affected systems back to their normal operation. It involves activities like updating firewall rules, re-imaging the system, resetting password etc.
What is Business continuity plan?
It is a document that outlines the procedures to sustain business operations during and after a significant disruption.
It is not the same as a Disaster recovery plan.
Business continuity strategies include hot sites, warm sites, and cold sites.
What steps are involved in post-incident actions?
It involves the creation of a Final Report document.
It also involves conducting a Lesson Learned meeting.
Post-incident activity is the process of reviewing an incident response to identify areas of improvement during incident handling.
What is the Final Report on Post-Incident Activity and what elements does it include?
Final Report is a documentation that provides a comprehensive review of the incident.
It includes following things -
- Executive summary
- Timeline
- Investigation
- Recommendation -
