Domain 4: Operations and Incident Response (16%) Flashcards
*4.2 Attack frameworks
Cyber Kill Chain
Has a seven-step method that starts with reconnaissance and then moves into weaponization, delivery, exploitation,
installation, command and control,
and action on objectives.
Note: linear process
4.2 Attack frameworks
MITRE ATT&CK Framework
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques and common knowledge or procedures.
Note: matrices model process
4.2 Attack frameworks
Diamond Model of Intrusion Analysis
A framework for analyzing cybersecurity incidents and intrusion by exploring the relationships between four core features: adversary, capability, infrastructure, and victim.
Note: model is used to represent an intrusion event.
4.2 Exercises
Exercise that uses an incident scenario against a framework of controls or
a red team
Tabletop Exercise
A tabletop exercise is a discussion of simulated emergency situations and
security incidents
4.2 Network reconnaissance and discovery
Commercial vulnerability scanners
Nessus and Qualysguard
4.4 SOAR
Runbooks
An automated version of a playbook that leaves clearly defined
interaction points for human analysis
4.4 SOAR
Playbooks
A checklist of actions to perform to detect and respond to a specific type
of incident
Has a seven-step method that starts with reconnaissance and then moves into weaponization, delivery, exploitation,
installation, command and control,
and action on objectives.
Note: linear process
*4.2 Attack frameworks
Cyber Kill Chain
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques and common knowledge or procedures.
Note: matrices model process
4.2 Attack frameworks
MITRE ATT&CK Framework
A framework for analyzing cybersecurity incidents and intrusion by exploring the relationships between four core features: adversary, capability, infrastructure, and victim.
Note: model is used to represent an intrusion event.
4.2 Attack frameworks
Diamond Model of Intrusion Analysis
Tabletop Exercise
A tabletop exercise is a discussion of simulated emergency situations and
security incidents
4.2 Exercises
Exercise that uses an incident scenario against a framework of controls or
a red team
Nessus and Qualysguard
4.2 Network reconnaissance and discovery
Commercial vulnerability scanners
An automated version of a playbook that leaves clearly defined
interaction points for human analysis
4.4 SOAR
Runbooks
A checklist of actions to perform to detect and respond to a specific type
of incident
4.4 SOAR
Playbooks
Act of removing data in such a way that it cannot be reconstructed using
any known forensic techniques
4.1 Data Sanitization
Purging (Sanitizing)
