Domain 4: Operational Procedures Flashcards
4 considerations when allowing remote access to a host or network
- Least privilege
- Encryption
- Digital certificate on the server (to mitigate evil twin)
- Server software supporting the connection is safe
What to enter in Remote Desktop Connection to connect to a server
- The server’s IP or FQDN
- Domain\Username or host\Username
True or False: RDP is natively encrypted
True
True or false: RDP client software supports Windows only
False
It is also available in Linux, macOS, iOS, & Android
Screen Sharing
MacOS remote access app based on VNC protocol, which means any VNC client can connect
NLA
Network Level Authentication
Authenticates an RDP client user before configuring a desktop, preventing the ability to create a DoS attack using pending connections
Means of mitigating risk associated with vulnerable user credentials when connecting to a malware-infected server via RDP
RDP Restricted Admin (RDPRA) Mode
&
Remote Credential Guard
RDP port number
TCP 3389
How to run RDP on a Linux host
Use the open-source implementation XRDP
MSRA
Microsoft Remote Assistance
Precursor to Quick Assist that used a dynamically assigned ephemeral port
What is an SSH server’s host key pair used for?
To set up an encrypted channel so that the client can submit authentication credentials securely
2 commonly implemented methods of SSH client authentication
- Password (& username)
- Public key
A key SSH security task
Monitoring for & removing compromised client public keys
RMM
Remote monitoring and management
Tools principally designed for use by MSPs for ensuring every host communicating on it’s client’s network is authorized & is running in a secure configuration.
[It is able to distinguish client accounts & provide support for recording & reporting billable support activity]
EDR
Endpoint detection and response
Software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats
8 common features of desktop management & remote monitoring tools
- Reporting
- Ticket integration
- EDR
- Push deployment of changes
- Network boot
- Firmware updates & OS installs
- Network access control
- Live chat & remote connection to hosts
VNC port number
TCP 5900
Synthetic full backup
Combines all incremental backups with the original full backup to create a new full one
3-2-1 backup rule
3 copies of data (including production copy)
Across 2 media types
With 1 copy held offline & off site
When should you re-test backup recovery procedures?
Whenever there is a change to the backup schedule or requirements
Regulated data
Information that must be collected, processed, & stored in compliance with federal &/or state legislation
True or false: an IP address is considered PII
Both/neither 😈
It is if it’s static, but may not be if it’s dynamic
Regulations on the protections to be provided for stored credit card data
PCI DSS
Payment Card Industry Data Security Standard
Latent evidence
Evidence that cannot be seen with the naked eye
7 step procedure for ensuring data integrity & preservation from a security incident
- Identify the scope
- Video document the procedure
- Gather evidence (cache, etc.)
- Disable encryption & screen lock & power off devices
- Copy disks
- Hash the disks & copies
- Bag, fill out form, & transport
SE
Secure Erase
On HDDs: writes all zeros
On SSDs: marks all blocks as empty & erases over time
ISE/Crypto Erase
Instant Secure Erase/Crypto Erase
Encrypts the drive & deletes the key
What chain-of-custody documentation proves
Who has access to evidence collected from a crime scene and where and how it has been stored
What a script syntax error will prevent
The script from running
What a script logical error will cause
Different operation from what was intended
Extension for the PowerShell script format
.PS1
JavaScript extension
.JS
JavaScript
Scripting language for interactive web-based content & web apps
Python file extension
.PY (associated with python.exe)
.PYW (associated with pythonw.exe)
Python cmdlet to reboot & ignore warnings about doing so
Restart-Computer -Force
3 [broad] dangers of using scripts
- Malware
- Inadvertent system-setting changes
- Browser or system crashes due to mishandling of resources
Visual Basic programming language extension
.VBS
Linux shell script extension
.SH
Policy
Overall statement of intent
SOP
Standard operating procedure
A step-by-step list of actions that must be completed for any given task to conform with policy
Guidelines
Used when no procedure exists or when a procedure should be deviated from
Request ticket type
For provisioning things the IT department has an SOP for
Incident ticket type
Involve errors or unexpected situations faced by end-users
Problem ticket type
Problems are causes of incidents. This type of ticket is likely to be generated internally.
Incident report
Aka after-action report. Lessons learned. Identify causes, recommend remediation, or preventive measures.
5 assets procurement lifecycle stages
Change
Procurement
Deployment
Maintenance
Disposal
4 ways to deal with angry customers
- Low voice, soothing language, & focusing on positive actions
- Don’t take complaints personally
- Let the customer explain the problem while you actively listen
- Hang up. Warn them 1st & if necessary end the call or escalate to a manager
Most common source of safety regulations in the United States
OSHA Occupational Safety and Health Administration
Best type of fire extinguisher to use on electrical equipment
Color of the label
Carbon dioxide
Typically black but sometimes red or white
Ideal humidity level
Around 50%
How to avoid condensation in equipment
Avoid warming it too quickly
Dissipative packaging
Light pink or blue packaging that reduces the buildup of static in the general vicinity of the contents by being slightly more conductive than normal
Difference between a power surge and spike
Spike is more intense
Surge protector clamping voltage
The level at which the protection will activate (400/300V) or lower is better)
Surge protector joules rating
Amount of energy it can absorb (600 or more is better). Each surge event will degrade its capability
Surge protector amperage
Maximum current that can be carried (number of devices you can attach)
How to calculate the minimum VA needed for a UPS
Add the wattage of all attached devices and multiply by 1.67 to account for a conversion factor
Splash screen
Displays a message, logo, or graphic during the startup
process and often contains a legal disclaimer regarding access to the system and information about the data contained in the application.
