CySA+ Study for PASS Certification Exam !!! Flashcards
This stage is planning for your intelligence requirements; you may assess what security breaches or compromises you have faced, assess what info could have prevented or limited impact of breach, assess what controls and security measures were not in place that would have mitigated the breach.
The Threat Intelligence Cycle (Phase 1 - Requirements Gathering)
once info requirements are gained, you can collect data from threat intelligence sources to meet those requirements. This phase may repeat as extra requirements are added etc …
The Threat Intelligence Cycle (Phase 2 - Data Collection)
first process data to allow it to be consumed by whatever tools or processes you use then analyze data itself. Output of this stage could be data fed into automated systems or tools, or written reports to distribute to leadership etc …
The Threat Intelligence Cycle (Phase 3 - Data Processing and Analysis)
data is distributed to leadership and operational personnel who will use the data as part of their security operations role.
The Threat Intelligence Cycle (Phase 4 - Intelligence Dissemination)
gathering feedback about reports and data you have gathered. Use continuous improvement.
The Threat Intelligence Cycle (Phase 5 - Feedback)
forensic evidence or data that can help to identify an attack, used after an attack has started and attack may still be happening.
IOCs
Est. a Hypothesis : needed to test and should have actionable results based on threat that the hypothesis considers.
Profiling Threat Actors and Activities : helps ensure who you have considered may be a threat and why, as well as what their typical actions and processes are.
Threat Hunting Tactics : skills, techniques, and procedures are where action meets analysis, this step includes executable process analysis.
Reducing attack surface area
Bundling Critical Assets into Groups and Protection Zones
Attack Vectors must be understood, assessed and addressed based on analysis of threat actors and their techniques as well as surface area threat actors can target.
Integrated intelligence combines multiple intelligence sources to provide better view of threats.
Improving detection capabilities.
Proactive Threat Hunting
used to create a map of an org.’s networks, systems, and other infrastructure; usually done by combining info-gathering tools w/manual research to identify networks and systems the org. uses.
Host Enumeration
Passive fingerprinting : relies on info that is available about org.’s, systems, or network w/o performing your own probes.
Network Devices can log own activities, status, and events including traffic patterns and usage, info includes network device logs, network device config files, and network flows.
Many networks use SNMP to send device info to a central control system and most managed networks send network logs to a central log server using syslog utility.
info
??? often include details of network, routes, systems that devices interact with, etc … and they can provide info about syslog and SNMP servers, admin and user account info, and other info useful for info gathering.
Config Files
