CySA+ Study Notes 11 Flashcards
KPIs = metrics that demonstrate success of the security program; looks back at past on security.
KRIs = predict likelihood of future risks materializing; future looking perspective on security.
KRI Criteria : business impact, effort to implement, measure and support; reliability, and sensitivity.
info …
Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI). STIX enables organizations to share CTI with one another in a consistent and machine readable manner, allowing security communities to better understand what computer-based attacks they are most likely to see and to anticipate and/or respond to those attacks faster and more effectively. STIX is designed to improve many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.
STIX
Trusted Automated Exchange of Intelligence Information (TAXII™) is an application layer protocol for the communication of cyber threat information in a simple and scalable manner. TAXII is a protocol used to exchange cyber threat intelligence (CTI) over HTTPS. TAXII enables organizations to share CTI by defining an API that aligns with common sharing models. TAXII is specifically designed to support the exchange of CTI represented in STIX.
TAXII
Mobile ATT&CK : A set of tactics, techniques and common knowledge that focuses on Adversary behavior inside of the Enterprise, predominantly focusing on the mobile environment. Focuses on Exploit, Control, Execute and Maintain stages of an attack.
Mobile
Enterprise ATT&ACK : A set of tactics, techniques and common knowledge that focuses on Adversary behavior inside of the Enterprise. Focuses on Exploit, Control, Execute and Maintain stages of an attack.
Enterprise
PRE-ATT&CK: A set of tactics, techniques and common knowledge that focuses on Adversary behavior outside of the Enterprise. Focuses on Recon, Weaponize and Deliver stages of an attack.
PRE-ATT&CK
??? is the phase 3 of the Penetration Testing or Ethical Hacking. It is a process of gaining complete access to the system by compromising the vulnerabilities identified in the first two phases.
Vulnerability Identification (Mapping / Enumeration)
provide deep visibility such as network load, scanning w/o credentials, assets using dynamic IPs etc …
Agent-Based Scanning
Server Scanning detects vulnerabilities, missing security patches and out-of-date software across all your external servers
Server-Based Scanning
??? It indicates that the parties have reached an understanding and are moving forward. Although it is not legally binding, it is a serious declaration that a contract is imminent.
??? defines the level of service you expect from a vendor, laying out the metrics by which service is measured, as well as remedies or penalties should agreed-on service levels not be achieved.
MOU / SLA
