Domain 4 - Incident Response and Recovery Flashcards
1
Q
IP Plan Elements
A
- Statement of Purpose
- Strategies and goals for incident response.
- Approach to incident response.
- Communication with other groups.
- Senior leadership approval.
2
Q
NIST SP 800-61
A
Incident Response Plan
3
Q
Communication Plans
A
Ensure that all participants have timely, accurate information.
4
Q
What is crucial for effective incident identification?
A
Monitoring.
5
Q
SIEM
A
SECURITY INCIDENT AND EVENT MANAGEMENT
Security solution that collects information from diverse sources, analyzes it for signs of security incidents, and retains it for later use.
6
Q
First responder responsibilities
A
Isolate affected systems
7
Q
Highest priority of a first responder must do what?
A
Containing damage through isolation.
8
Q
Second Step for First Responder?
A
Escalate and Notify
9
Q
Containment Strategy Evalutation
A
- Damage Potential
- Evidence Preservation
- Service availability
- Resource requirements.
- Expected effectiveness.
- Solution Time frame
10
Q
Evidence types
A
Real - Tangible Objects
Documentary - Written/Digital Information
Testimonial - Witness Statements.
11
Q
Documentary Evidence Rules
A
- Must be authenticated (testify)
- Best Evidence Rule
- Parol Evidence Rule
12
Q
Best Evidence Rule
A
Original documents are superior to copies.
13
Q
Parol Evidence Rule
A
Written contracts are assumed to be the entire agreement.
14
Q
Forms of Testimonial Evidence
A
- Direct - Witness provides evidence
2. Expert Opinion - Expert draws conclusions.
15
Q
Goal of Digital Forensics
A
Investigate techniques that collect, preserve, analyze, and interpret digital evidence.
16
Q
Volatility
A
Relative permanence of a piece of evidence; evidence that may not last long is more volatile than more permanent sources of evidence.
17
Q
Order of Volatility
A
- Network Traffic
- Memory Contents
- System and Process Data
- Files
- Logs
- Archive records
18
Q
Risk to transferring data during evidence?
A
That data will be added to device.
19
Q
Device used to prevent accidental modification of disks during imaging?
A
Write Blockers or Forensic Disk Controllers.
20
Q
What is used to protect digital evidence from being tampered with?
A
Hashes
21
Q
Flaw with Full Packet Capturing?
A
Requires a lot of storage.
22
Q
What does Netflow Capture?
A
High level info - IP addresses and ports; timestamps; amount of data transferred.
23
Q
What devices capture Netflow data?
A
Routers and Firewalls
24
Q
2 Uses of Software Forensics
A
Intellectual Property & Malware Origin
25
Embedded Devices
Special-purpose computers found inside smart devices found in homes, businesses, and industrial settings.
26
What provides a paper trail for evidence?
Chain of Evidence OR Chain of Custody
27
Evidence Log Events
- Initial Collection
- Transfer
- Storage
- Opening & Resealing the container
28
Evidence Log Entry Details
- Investigator Name
- Date and Time
- Purpose
- Nature of Action
29
3 Components to Incident Reporting
1. Notification
2. Real Time Updates
3. Documentation
30
Who must the Federal Government notify of Cybersecurity incidents?
US-CERT
31
What do Formal Incident Reports have?
Historical Documentation.
32
3 Major Steps in the Electronic Discovery Process
1. Preservation - Litigation Hold & Suspending automatic deleting.
2. Collection - Documents on file servers, endpoint servers, email messages, enterprise systems.
3. Production - Documents provided to attorneys.
33
Litigation Hold
Require the preservation of relevant electronic and paper records.
34
Federal Law requires Businesses to report incidents to US-Cert?
No.
35
During what phase of e-discovery does an organization share information with the other side?
Production
36
Business Continuity Planning (BCP)
Set of controls designed to keep a business running in face of an adversity. Natural or man-made.
37
Business Continuity Plan is part of what core security concept?
Availability.
38
BCP Scope
Business activities
Systems
Controls
39
Tool used for BCP to help make the scoping decisions?
BIA - Business Impact Assessment.
40
BIA
Business Impact Assessment
Identifies and prioritizes risks.
41
Business Continuity Controls
Goal is Redundancy
42
Single Point of Failure Analysis
ID's and removes SPOFs
43
What addresses the SPOF at the web server?
Clustering
44
What addresses the SPOF at the Firewall?
HA FW
45
What addresses the SPOF at the Network Level?
Redundancy Controls.
46
SPOF analysis continues until when?
Cost of addressing risk outweighs the benefit.
47
Two Key Technical Concepts that improve the availability of Systems.
1. High Availability (HA)
| 2. Fault Tolerance (FT)
48
HA
High Availability
Uses multiple systems to protect against service failure.
49
FT
Fault Tolerance
Makes a single system resilient against technical failures.
50
Difference between HA and FT
HA uses multiple systems to provide availability, whereas FT makes a single system more resilient.
51
Load Balancing
Spreads demands across systems.
52
Most common points of failure in a computer system
1. Power Supply
| 2. Storage Media
53
RAID
Redundant Array of Inexpensive Disks
Fault Tolerance Technique!
54
2 Technologies used in RAID?
Mirroring - RAID 1 - Stores the Data on two different disks
Stripping - RAID 5 - Uses 3 or more disks to store data and parity information
55
RAID 1
Store the same Data on two different disks.
Disk Mirroring
56
RAID 5
Uses 3 or more disks to store data and parity information.
Disk Striping
57
Disk Mirroring Requires how many disks?
2 - RAID 1
58
Dis Striping with Parity requires how many disks?
3 or more - RAID 5
59
RAID - Backup or Fault Tolerance?
FT
60
QoS
Quality of Service
Provides critical services with protected network capacity.
61
Disaster Recovery?
Restore a business to normal operations as quickly as possible.
It's a subset of Business Continuity.
62
Initial Responses in a DR?
Contain the damage caused
Recover whatever capabilities may be immediately restored.
Include a variety of activities depending upon the nature of the disaster.
63
Components of Disaster Communications
Initial activation of the DR Team
Regular status updates
Tactical Communications
64
After the danger passes, the team does what?
Shifts to assessment mode.
65
Goal of assessment mode?
Triage the damage and develop plan to recover.
66
Two metrics used to plan DR efforts.
RTO & RPO
67
RTO
RECOVERY TIME OBJECTIVE
Maximum amount of time that is should take to recover a service after a disaster.
68
RPO
RECOVERY POINT OBJECTIVE
Maximum time period from which data may be lost in the wake of a disaster.
69
Responders do what after developing a plan?
Restore services in an orderly fashion
70
When are DR efforts completed?
When the business is operation normally in its primary facility.
71
Backups
Provide a data 'safety net'.
72
Backup Media Types
Tape Backups
Disk-to-disk backups
Cloud backups
73
3 Type of Primary Backup Types
Full Backups - Include complete copy
Differential - Include all data since full backup
Incremental - Include all data data since full or Differential backup
74
Difference between Incremental and Differential Backup?
Incremental Backup includes all data since last full or Differential backup.
Differential is all data since last full backup.
75
Joe performs a full backup every Sunday evening and differential backups every weekday evening. This system fails on Wednesday, What backups does he need?
1. Sunday's Full Back (Base)
| 2. Wednesday's Differential Backup
76
Joe performs a full back every Sunday evening and incremental backups every weekday evening. His system fails on Friday morning. What backups does he need?
1. Sunday's Full Back Up (Base)
2. Monday Incremental BU
3. Tuesday IBU
4. Wed IBU
5. THR IBU
77
Pros and Cons of Incremental Backups
Use less space
| Require greater recovery time
78
Media Rotation Strategies definition
Allow reuse of backup media
79
Common Media Rotation Strategy?
GFS (Grandfather-Father-Son) Rotation
```
Son = Think of days
Fathers = Think of Weeks
Grandfather = think of months
```
80
How to validate/test backups?
Built-in Back Up Verification (Validates backup completion)
Regularly Test Backups
81
Ways to regularly test backups?
Request a file restoration from a random, yet specific point of time.
Request the restoration of a server or an entire service.
82
DR Facility Types
Hot Site, Warm Site, Cold Site.
83
Difference between DR Facility Types.
Hot - Full operational with equipment and data
Warm - Stocked with equipment and data, but not maintained in a parallel fashion.
Cold - Empty Data Centers
84
Term for transferring data backup offsite digitally
Electronic Vaulting
85
Goals of DR Testing Goals
1. Validates that the plan functions correctly.
| 2. Identify necessary plan updates.
86
Types of DR Testing
```
Read-through
Walk-through
Simulation
Parallel Test
Full Interruption Tests
```
87
Read-Through
Type of DR Testing
Asks each member to review their role in the DR process and provide feedback.
88
Walk - Through
Gathers the team together for a formal review of the DR plan.
Also known as a Table Top Exercise.
89
Simulation
Uses practice scenario to test the DR Plan
90
Parallel Test
Activates the DR Facility but do not switch operations there.
91
Full Interruption
Activates the DR Facility and switches operations there.
92
What disaster recovery metric provides the targets amount of time to restore a service after a failure?
RTO
93
What type of backup includes only those files that have changed since the most recent full or incremental backup?
Incremental
