Cybrary learning

Question 1

What is EDR

Answer 1

EDR is endpoint detection and response.
This is an evolution of AV technology thats coupled with signature-based detection and behavioural-based detection.

Question 2

IDS & IPS

Answer 2

Tools designed to detect and prevent unauthorized access or malicious activities by inspecting network traffic in real time. They use signatures, heuristics, or anomaly detection to identify threats, and may perform various actions upon detection, ranging from generating an alert to resetting a suspicious TCP connection and blocking the source IP address.

Question 3

What is ‘signature-based alerts’

Answer 3

Signature-based alerts are generated when activity matches a known pattern or “signature” of malicious behavior. These signatures are often based on specific attributes or characteristics of known malware, attacks, or other malicious activities.

Question 4

What are the data types for signatures?

Answer 4

Text: Signatures written in plain text

Binary: Signatures that involve specific sequences of raw data, often represented in hexadecimal notation.

Question 5

What are the 5 steps with NIST

Answer 5

Identify. Protect, Detect, Respond & Recover