CySA+ Study for PASS Certification Exam !!! Flashcards
??? are desktops to laptops to mobile devices, IoT sensors, and all gather data including logs and other info. Security Analysts should see what data exists on ??? device, how access it, if data be sent to central log collection and analysis point, etc …
Endpoints
??? these tools are used as part of malware packages to generate domain names from a known seed. The bot infrastructure can then dynamically generate domain names knowing that bots will use the same seed to know where to send their traffic; feed DNS query info into SIEM that uses IP/domain reputation data and correlation capabilities can help detect these behaviors.
Dynamically Generated Algorithm
??? auto register/deregister DNS entries as part of botnets. Single Flux : continuously registers addresses as part of DNS address A record for a DNS entry; this can help disguise malicious systems. Double Flux : uses similar tech. to register/deregister DNS servers for DNS zone, adding another layer of confusion when attempting to pin down malicious systems.
Fast Flux DNS
A Security Event : any observable occurence in system or network that relates to security function.
Security Incident : infringement or imminent threat of breach of computer security policies, AUP’s, or standard security practices.
info
??? : Preparation Phase 1 = ??? has proper policy foundation, operating procedures that will be effective in org.’s computing environ., training, prepared to respond to an incident. Also build strong cybersecurity defenses reducing likelihood and impact of future incidents. Should also assemble hardware, software, and info required to conduct an incident investigation. Detection and Analysis 2 = (4 Major security event indicators 1 = alerts that originate from IDS/IPS, SIEM, anti-virus software, 3rd party monitoring services, etc… 2 = logs generated by OS’s, services, apps, network devices, network flows… 3 = Publicly available info about new vulnerabilities … 4 = insiders or externals that report suspicious things…) Containment, Eradication, Recovery 3 = Select containment strategy appropriate to incident situations. Implement selected containment strategy to limit damage caused by incident. Gather extra evidence to support response effort and potential legal action. Identify attackers and attacking systems. Eradicate effects of incident and recover normal business operations. Post-Incident Activity 4 = team members conduct a lessons learned review and ensure they meet internal/external evidence retention requirements.
CSIRT
??? you can see the source, its IP address, the destination, its IP address, how many packets were sent, how much data was sent, and the port and protocol used; for a good guess on what app was used.
Flow Info
??? : reach out to remote systems and devices to gather data; typically gather data about availability, routes, packet delay or loss, and bandwidth. ex : Pings, and IPerf : tool that measures max bandwidth and IP network can handle.
??? : capturing info about network as traffic passes a location on a network link.
Active Monitoring / Passive Monitoring
??? : gathering info from multiple network devices and combining that data into useful views for analysis and reporting.
??? : monitoring bandwidth usage tool which combines packet sniffing, flows, SNMP, and WMI (allows script and app access for automation and admin tasks and accessing management data for OS, etc …).
Network Monitoring / PRTG
SolarWinds : network monitoring tools that address multiple types of data gathering for ability identify network issues and network bandwidth and flows.
Nagios : system log monitoring tool.
Cacti : opensource SNMP.
Slack space is space left when a file is written, this space contains fragments of files previously written to the space or files that are intentionally hidden.
Unallocated Space : space not partitioned.
info
File carving tools look at data on block-by-block basis, looking for info like file headers and other indicators of the file structure. When they find them they attempt to recover complete or partial files.
Legal Hold : conducted when info must be retained for a legal case.
Wireshark : packet sniffer/sniffer
Order of Volatility : CPU Cache, registers, running processes, RAM -> Network Traffic -> Disk Drives -> Backups, printouts, optical media.
info
