Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CYSA + > Dion Sections 1-3 > Flashcards

Dion Sections 1-3 Flashcards

1
Q

Security Control

A

mitigates vulnerabilities and risk to ensure the confidentiality, integrity, availability, nonrepudiation, and authentication of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security controls should be selected and deployed in a structured manner using a …

A

Risk Management Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is NIST Special Publication 800-53 for?

A

Federal information systems and organizations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is NIST Special Publication 800-171 for?

A

outlines security requirements for protecting CUI in Non-Federal systems and organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the ISO framework

A

a set of requirements for defining, implementing, operating, and improving an Information Security Management System (ISMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a technical (logical) control?

A

A category of security control that is implemented as a system (hardware, software, or firmware).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Digital signature

A

a hash of the email you’re going to send, encrypted with your digital private key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Operational Controls

A

A category of security control that is implemented primarily by people rather than systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Managerial Controls

A

A category of security control that provides oversight of the information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Control Functional Types (7) P,D,C,P,D,C,R

A

Preventative, Detective, Corrective, Physical, Deterrent, Compensating, Responsive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a preventative control

A

A control that acts to eliminate or reduce the likelihood that an attack can succeed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Detective control

A

A control that may not prevent or deter access, but will identify and record any attempted or successful intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Corrective control

A

A control that acts to eliminate or reduce the impact of an intrusion event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

No single security control is invulnerable, how is the efficiency of a control instead measured?

A

By how long it delays an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Physical Control

A

A type of security control that acts against in-person intrusion attempts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Deterrent Control

A

A type of security control that discourages intrusion attempts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Compensating Control

A

A type of security control that acts as a substitute for a principal control. Not the top line, but gives you some protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Responsive Control

A

System that actively monitors for potential vulnerabilities or attacks, and then takes action to mitigate them before they can cause damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Firewall

A

system that monitors all incoming and outgoing network, traffic and blocks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Intrusion Prevention System (IPS)

A

devices that can monitor network traffic for patterns that indicate an intrusion is occurring such as a repeated failed log on attempt.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How do you decide which security control you’re actually going to apply?

A

It depends on the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How can I mitigate risk?

A

Use the CIA triad. Ask which part or parts do you have controls for and how can you add controls for what you are missing so that you cover all of them or mitigate what can’t be covered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Security Intelligence

A

process where data is generated and is then collected, processed, analyzed, and disseminated to provide insights into the security status of information systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security Intelligence points…

A

Inward. As you go through your FW logs, intrusion detection alerts and other things, you’re understanding what your security posture is internally.
We are looking inward, how are our systems looking?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Cyber Threat Intelligence (CTI)

A

Investigation, collection, analysis, and dissemination of information about emerging threats and threat sources to provide data about the external threat landscape.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

CTI points…

A

Outward, we are thinking about attacker groups, malware outbreaks, 0 day exploits. All of the bad things out there and what could hurt us.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are 2 forms of CTI

A

Narrative reports & Data Feeds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

In CTI what is a narrative report and what do they do?

A

gives us the analysis of a certain adversary group or a certain type of malware. These give you intel about what the bad guys are doing and can help security professionals decide where we want to put money and which security controls we want to have to be able to defend ourselves from the bad guys and those types of attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

In CTI what is a data feed and what are some examples

A

can be a list of known bad indicators (IOCs), domain names, IP addresses, it might be something like hashes of exploit malware code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What kind of information are things like domain names, IP addresses or hashes of exploit malware code.

A

Tactical information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data feeds are very..

A

tactical, informational that we can do something with. EX: known bad Ips, can be blocked in the FW so no connections can go to it.

32
Q

What are the phases of the Intelligence Cycle

A
  1. Requirements (Planning & Direction)
  2. Collections (& Processing)
  3. Analysis
  4. Dissemination
  5. Feedback
33
Q

Security Intelligence is a..

A

process. It’s not just about collecting data, you have to plan to collect that data, go through and process that data and review it.

34
Q

What is Phase 1: Requirements (Planning & Direction), in the Intel Cycle?

A

Sets out the goals for the intelligence gathering effort. What do we want to collect? What do we care about? What do we want to spend the time money and resources to collect?

35
Q

What is Phase 2: Collection (& Processing), in the Intel Cycle?

A

Implements and using software tools to gather data which is then processed for later analysis.

36
Q

In Phase 2 of the Intel Cycle what is the ‘processing part’

A

where we will convert all the data into a standard format.
o When all the data is coming from different systems, it might be coming in a different format; we will need to normalize that data and that is the ‘processing’ part. All the IP addresses will go in a column, all the timestamps will go in another column, all the domains will go in a 3rd column. This way we can search and index all the information and use it as we search for those things later in our analysis cycle.

37
Q

What is Phase 3: Analysis, of the Intel Cycle?

A

This may use automated analysis, AI and ML and is performed against the given use cases from the planning phase. (if it doesn’t impact your and your business, it shouldn’t matter)

38
Q

What three categories is data put into in Phase 3: Analysis of the Intel Cycle?

A
  1. Known good - we are going to allow it
  2. Known bad - we are going to block it
  3. Not sure - this is where further analysis needs to be done. Things like machine learning and AI have to be used to help our humans go through all the data because there is just too much stuff going over our networks.
39
Q

In the Intel Cycle, all analysis should be done in the context of a..

A

use case.

40
Q

In the Intel Cylce, what is a use case?

A

the use cases are something that we developed all the way back in our planning phase. We decided what type of information we were interested in, for what reason and confirmed it was something that would/does impact our organization rather than wasting time, money and resources on data that doesn’t effect us.

41
Q

What is Phase 4: Dissemination, in the Intel Cycle?

A

Published information produced by analysts to consumers who need to act on the insights developed. This can take a lot of different forms and it depends on your organization and what the intended audience is. You may have oral, written, PowerPoint presentations or even emails.

42
Q

What are the 3 most common levels we like to break dissemination into?

A
  1. Strategic
  2. Operational
  3. Tactical
43
Q

define the dissemination level: Strategic, regarding CTI

A

addresses broad themes and objectives. These usually affect projects and business priorities over weeks, months, and years.

44
Q

Give an example of the dissemination level: Strategic, regarding CTI

A

a report to an executive or a PowerPoint presentation in a large group.

45
Q

define the dissemination level: Operational, regarding CTI

A

addresses the day-to-day priorities of manager and specialist.

46
Q

Give an example of the dissemination level: Operational, regarding CTI

A

An example is a checklist of the things you should be worried about today and these are the things we need to focus on today.

47
Q

define the dissemination level: Tactical, regarding CTI

A

informs real-time decisions made by staff as they encounter different alerts and system indications.

48
Q

Give an example of the dissemination level: Tactical, regarding CTI

A

someone working in a SOC and they see an alert pop up on your screen that is considered tactical intel, it needs to be dealt with right now and is real time.

49
Q

What is Phase 5: Feedback, in the Intel Cycle?

A

Lessons learned: Aims to clarify requirements and improve the collection, analysis, and dissemination of information by reviewing current inputs and outputs. Basically, how can we do things better?

50
Q

Name 3 things that should be take aways from Phase 5: Feedback, of the Intel Cycle

A
  1. Lesson learned: Figuring out what incidents occurred during this intel gathering this cycle so we can avoid those problems the next cycle.
  2. Measurable success: o What metrics are going to show us success or failure of the intelligence gathering?
  3. Evolving threat issues: we want to start shifting out intel collections towards the threat vectors as they change.
51
Q

T or F
We have to be able to identify some factors to weigh the value of the intelligence that we’re getting.

A

T
This is important because we have to consider the sources of our intel. There are lots of intel sources but not all are created equal.

52
Q

What two parts can be dug out of Phase 2: Collecting (& Processing), of the Intel Cycle?

A
  1. Evaluation
  2. Sources
53
Q

Factors Used to Evaluate Sources:

A

Timeliness, Relevancy, Accuracy, Confidence Level

54
Q

When evaluating sources in Phase 2: Collecting (& Processing), of the Intel Cycle what is Timeliness

A

Ensures an intelligence source is up-to-date. Over time the information is not nearly as valuable. EX: if I know someone is attaching your network today and I don’t tell you about it for three years, it’s not very useful.

55
Q

When evaluating sources in Phase 2: Collecting (& Processing), of the Intel Cycle what is Relevancy

A

● Ensures an intelligence source matches its intended use case.
o EX: if I see there are a lot of attacks going against MacOS but we use Windows, does that really apply to me?
o Think: what affects me and my organization?

56
Q

When evaluating sources in Phase 2: Collecting (& Processing), of the Intel Cycle what is Accuracy?

A

● Ensures an intelligence source produces effective results. This means the information needs to be valid and true.
o EX: if you tell me that I’ve been attacked and I look and can’t find anything, was I really attacked or was your info bad? We don’t really know.
o We want to try to eliminate as many false positives as possible, especially when using automated software, machine learning and AI. Make sure that we’re getting the right info so that we can do our analysis properly on good information and create good decisions.

57
Q

When evaluating sources in Phase 2: Collecting (& Processing), of the Intel Cycle what is Confidence Level?

A

● Ensures an intelligence source produces qualified statements about reliability.
When an analyst publishes report, they don’t have a hundred percent of the facts. It’s just the way this works. We’re trying to guess our way through this and we’re getting lots of different pieces of information and lots of different indicators and we try to put together the best report we can.

58
Q

What are the 3 general sources of information in CTI?

A
  1. Proprietary
  2. Closed-Source
  3. Open-Source
59
Q

Name some different sources of open-source intell

A
  1. US-CERT
  2. UKs NCSC
  3. AT&T Security (OTX)
  4. MISP - Malware Information Sharing project
  5. VirusTotal
  6. spamhaus - focused on spam and email
  7. SANS ISC Suspicious Domains - focused on domains.
60
Q

What is explicit knowledge?

A

knowledge you can write down, see, feel and touch.

61
Q

What is implicit knowledge?

A

really useful but you can only get it from experience practitioners in the field. This is that sense they have that they just go ‘ah, I know something is wrong here because of my 20 years of experience’. They may not always have the latest trends in cybersec, although most of the time they do, but they have the ability to give you that attitude and instinct because of their career as a cyber security professional. Overtime, you will develop this.

62
Q

Threat feeds are a form of ____ knowledge

A

explicit

63
Q

Open-Source Intelligence (OSINT)

A

method of obtaining information about a person or organization through public records, websites, and social media

64
Q

What are Information Sharing and Analysis Centers (ISACS)

A

A not-for-profit group set up to share sector-specific threat intelligence and security best practices amongst its members.

65
Q

Name some examples of areas ISACs exist in:

A

Critical infrastructure, Government, Healthcare, Financial, Aviation

66
Q

Critical Infrastructure

A

Any physical or virtual infrastructure that is considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination of these.

67
Q

When talking about ISACs Government means:

A

non-federal governments in the US, such as state, local, tribal, and territorial governments.

68
Q

Financial ISACs serve..

A

financial sector to prevent fraud and extortion of both the consumer and financial institutions.
For example, we want to make sure we’re getting information about anybody who’s trying to affect a major trading platform or the stock market or someone who might be able to go after ATMs to have them give out money for free. These could pose a national security or economic risk to our country.

69
Q

Aviation ISACs serve..

A

the aviation industry to prevent fraud, terrorism, service disruptions, and unsafe operations of air traffic control systems.

70
Q

In Phase 4: Dissemination, of the Intel Cycle, what do we dig deeper into?

A
  1. Risk Management & Security Engineering
  2. Incident Response
  3. Vulnerability Management
  4. Detection and Monitoring
71
Q

Define Risk Management in the Intel Cycle

A

Identifies, evaluates, and prioritizes threats and vulnerabilities to reduce their negative impact

72
Q

Why is threat intelligence important to risk management

A

Because it tells us how risky a certain thing is based on outside threats, because we know our own vulnerabilities through our vulnerability management and our scanning, but if we don’t know what attackers are coming after us we cant really think about the threat. So, putting those two together (threat intelligence and risk management) is really important.

73
Q

Define Incident Response in the Intel Cycle

A

An organized approach to addressing and managing the aftermath of a security breach or cyberattack.

74
Q

If someone has been successful in penetrating our network, we need intelligence to help keep them out. The best type of intel here is…

A

tactical-level intel because we need to know where they are in our networks, what IPs they’re coming from, what they’re going to do once they’re inside our network, and all those tactical pieces of threat intel will help us ID where they are and how we can get them out of our network and prevent them from coming back.

75
Q

Define Vulnerability Management in the Intel Cycle

A

The practice of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities.

76
Q

Define Detection and Monitoring in the Intel Cycle

A

The practice of observing activity to identify anomalous patterns for further analysis.
o As we know what threats are out there, we can then tune our sensors better. This allows us to add more rules and definitions based on different observed incidences that have happened either to our organization or partner organizations, or one of those commercial data feeds that we’re subscribed to. By getting that info, we can tune our sensors to have a lot more true positives and a lot less false positive. This is why it’s a good idea to make sure you’re on the dissemination chain for threat intelligence.

CYSA + (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions