Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Cloud Security Professional > Domain 5 - Cloud Security Operations > Flashcards

Domain 5 - Cloud Security Operations Flashcards

1
Q

What are security issues relevant to Storage Controllers?

A

Storage controllers control storage devices - access control, data assembly, interface to storage device.

Relevant Security Issues:

a) Access Control
b) Encryption in transit and rest
c) Adequate isolation/segmentation to address confidentiality and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you secure network configurations?

A

In public cloud, CSPs are responsible for managing the networking hardware (switches, routers and NICs.)

  • Provide adequate physical and environmental security (power, connectivity, security, cooling etc.)
  • Resiliency and redundancy (no SPOF)
  • Flexible and scalable network architecture - SDN, sufficient physical connectivity, support for VLAN (802.1Q).
  • Security capabilities for virtualized networks - e.g. Traffic mirroring
  • Customer managed security controls - e.g. VPC/SG/NACL etc.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In a cloud environment, what are the hardware elements that need to be protected?

A

1) BIOS
2) TPM
3) Storage Controllers
4) Network Configurations
5) Virtualization Management tools.
6) Virtual HW Specific Security Configs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How do you secure the BIOS?

A

Per NIST, there are four security features for BIOS:

a) Authenticated updates
b) secure local updates
c) firmware integrity
d) non-bypassability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do you secure the Virtualization Management tools?

A

Virtualization Management tools are critical.

  • Harden them per instructions from vendor (e.g. VMWare vSphere) and industry standards (e.g. CIS benchmarks)
  • Redundant - so there’s no SPOF
  • Scheduled downtime and maintenance - enables patching and keeping up to date
  • Isolate network and robust access controls - least privilege, encryption/VPN access, dedicated mgmt network
  • Config and change management - formal change management procedures
  • Logging and Monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What security configuration steps secure the Virtual HW?

A
  • Hypervisor configuration (more applicable to VMWare than to public cloud - e.g. limiting inter VM Communications)
  • Patching virtualization tools
  • VPC and SG settings that are controlled by the consumer
  • Provisioning the right amount of virtual HW to control costs
  • Using Infrastructure as Code and Autoscaling
  • Using serverless computing to reduce cost and increase security.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the security features of a secure KVM (keyboard-video-mouse switch)?

A

Ideal for local administration (as opposed to remote admin via SSH/RDP/VNC).

  • Isolated data ports - connected systems are physically isolated from each other (no data leaks)
  • Tamper-evident/tamper-resistant designs
  • Secure storage - e.g. buffers
  • Secured firmware - firmware cannot be changed or only signed updates accepted
  • Physical disconnect - KVM contains buttons to switch between systems
  • USB Port and device restrictions - may allow keyboard and mouse USBs but not storage ones.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the protocols used for secure remote access to manage virtual resources?

A
  1. SSH
  2. RDP
  3. Virtual Network Computing - equivalent of RDP for Linux/Unix systems.
  4. Secure access to the management console (e.g. via HTTPS/TLS or secure APIs/CLIs).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are concepts used to secure network traffic?

A
  1. Use of VLANs to segregate traffic
  2. Use of TLS for data in transit.
  3. Use of DHCP with IPSec
  4. Use of DNS with security extensions
  5. Use of VPNs.
  6. Software defined perimeter
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the most common DNS attacks?

A
  • Cache poisoning - malicious user updates a DNS record to point to an incorrect IP address; normally by initiating a zone transfer; DNS does not authenticate originator of zone transfers
  • DNS Spoofing- Attacker spoofs a DNS service and redirects queries to bogus websites.

DNSSEC - DNS Security Extensions counter these - e.g. use of digital signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the various types of VPN protocols?

A
  1. Open VPN
  2. IKEv2/IPSec
  3. SSL VPN/TLS VPN - e.g. normally from a browser
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Software Defined Perimeter architecture contain?

A

SDP Controller - authenticates and enforces access controls
SDP Hosts - authenticate to the SDP Controller; only accepts communication via SDP Controller
SDP Hosts initiate connect to other hosts via the SDP Controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are TPMs and what do they do?

A
  • Trusted Platform Module or Cryptographic co-processors.
  • Support crypto functions (e.g. random number generation, asym keys, hashing)
  • Store crypto keys and other sensitive data securely
  • Used to form root of trust - TPMs sign hash of firmware
  • Provide tamper resistance/evidence
  • Implemented as a) dedicated HW b) part of another chip c) virtually in SW as part of the hypervisor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do you harden an OS?

A
  • Change default creds
  • Lock/disable default accounts not needed
  • Install security tools like anti-malware
  • Configure security settings in OS
  • Remove/disable un-needed applications, services (eg. Windows Media Player), and functions.
  • Disable non-secure protocols like FTP

Creating a machine image (gold standard) is a good way for virtualization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the ways to create baseline/standard secure OS?

A
  • Customer defined VM images - customer spins up a VM, configures it (per CIS benchmarks) and creates a snapshot from which all other VMs are launched.
  • CSP-defined images
  • Vendor supplied images
  • DISA STIG for hardening
  • NIST Checklist
  • CIS Benchmarks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the concepts of “limit” and “share” in virtualization?

A

In virtualization, a hypervisor mediates tenants’ access to shared/pooled resources (RAM, CPU Cores).

  • Limit is the maximum allocation to a VM
  • Share - a weighting, percentage based access to pooled resources.

Probably more common in VMWare types of deployments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are live migration tools?

A
  • Probably common in VMWare (with vMotion)
  • VMs are migrated from one host to another so that maintenance can be done.
  • AWS doesn’t need to do live migration because of the Nitro architecture which can be updated without affecting customer VMs.
  • Live migration affects availability, integrity and confidentiality (unencrypted transmission of worloads from one machine to another) of workloads.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What’s the difference between uptime and availability?

A

Uptime = amount of time system is up and running

A system may be up, but if it is not reachable because of network outage it is NOT available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the Uptime Institutes, tiering system?

A

Uptime institute publishes specs for physical and environmental redundancy expressed as Tiers.

All tiers must have generators for power backup with 12 hours of fuel.

Tier 1 - “basic site” -No redundancy; protects disruptions from human error, but not unexpected failure or outage.

Tier 2 - “redundant site” partial redundancy (e.g for power and cooling); unplanned interruption may not cause an outage

Tier 3 - “Concurrent maintainability” is key. Redundancy for all critical components and distribution paths. Any part can be shutdown for maintenance without affecting IT operations.

Tier 4 - “Fault tolerant” - multiple independent and physically isolated systems . Systems have a fault tolerant sequence of operations with self-correcting mitigations in place.

AWS data centers are Tier 3+, and probably Tier 4.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Distributed Resource Scheduling?

A
  • DRS is part of VMWare offering
  • SW component that does resource management for a cluster of HW nodes.
  • Handles reservations and limits for VMs
  • Maintenance support - live migration
  • Adding additional hosts in cluster for elasticity/scalability
  • Energy management (power down hosts during low usage).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Microsoft’s Virtual Machine Manager and Dynamic Optimization?

A
  • Similar to VMWare’s DRS.
  • Power management, live migration
  • Balancing workloads across multiple hosts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What’s the difference between tightly and loosely clustered storage?

A

Tightly coupled storage cluster - same manufacturer, better performance, updates and expansion must come from same manufacturer. Files are broken into blocks and written to disk (block writes are faster than file writes and also easier to mirror).

Loosely coupled - off-the-shelf parts, lower performance; file-level storage means lower performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How do you ensure availability of Guest OS?

A
  • Backup and recovery - creating instance snapshots from which new VMs are created.
  • Resilience - architect for resiliency; using clustered architecture with live migration.

In AWS, only EBS volumes can be snapshoted. Live migrations are not supported. However, EC2 instances that become unavailable due to underlying host issues can be automatically recovered on another physical host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How can you reduce risk associated with remote access?

A
  • Session encryption (e.g. use TLS 1.3, session specific crypto keys to prevent replay attacks)
  • Strong AuthN - MFA, Strong Password, Share Secret Keys for SSH.
  • Separate privileged and non-privileged accounts; non-priv accounts for email and web-browsing; special accounts for cloud management
  • Enhanced logging and frequent reviews - especially for admin accounts
  • Use IAM Tools - e.g. IDaaS, CSP’s IAM
  • Single Sign On
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is OS Baseline Compliance Monitoring and Remediation?

A
  • Ensuring that OS conform to an approved baseline and don’t drift over time.
  • No unauthorized changes are made
  • Identify any unauthorized changes and roll back immediately.
  • Changes are properly reviewed and approved via a Change Management process.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How do you enforce OS compliance to a baseline?

A
  • Use a CMDB to document approved configs and enforce this through an audit
  • Organization wide vulnerability scanning (e.g. see if any hosts are using non-secure FTP)
  • Immutable architecture - periodically throw away VMs are rebuild from approved baseline.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the key steps in a Patch Management process?

A
  1. Vulnerability detection (done by researchers or vendors)
  2. Publication of patch (vendors develop patches, users must subscribe to notifications/feeds)
  3. Evaluation of patch applicability - is the patch applicable
  4. Test - testing in limited environments
  5. Apply and track - ensure that all systems are patched; track metrics for SLA
  6. Rollback, if needed
  7. Document - update CMDB and known baselines.

In the cloud a few additional techniques are available:

a) Using infrastructure as code - update code to utilize latest patched version
b) Immutable architecture - use IaaC to build new architectures from updated patched baselines
c) Software Composition Analysis (SCA) - used to identify vulnerabilities in open source code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What elements of the cloud are monitored for capacity and performance?

A

Both CSP and customers do monitoring. Monitoring helps plan capacity and detect security issues (e.g. bitcoin mining).

  1. Network - bytes in/out, link status, dropped packets
  2. Compute - CPU utilization
  3. Storage and Memory - amount used, speed of access (IOPS, S3 vs. Glacier)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What elements are targets for HW Monitoring?

A

Normally done by CSPs.

  • CPUs, RAM, Fans, Disk drives, network gear
  • SSDs
  • SAN Controllers (which report their own health)
  • Environmental (heat, humidity and water)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Who has responsibility for backups?

A
  • CSP: Hypervisor and host OS; SaaS application data; some PaaS VM data.
  • CSC: IaaS VM backups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are risks associated with backups?

A
  • Sensitive data may be stored in unencrypted backups
  • Backups may reside on the same system as the original
  • Backups may become unusable over time (not current).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are issues associated with network analysis tools?

A
  • Traditional network analysis tools relied in packet capture from a SPAN or Mirror port on a switch.
  • However, in the cloud, traffic between VMs on the same host do not pass through a switch and hence these tools are rendered useless.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is a SPAN port?

A
  • Switched Port Analyzer
  • A port on a switch through which traffic is sent to a monitoring device.
  • These are different from network TAPs - which are dedicated HW devices with an A port, B port and Monitor port.
  • TAPs, unlike SPAN ports on switches don’t have capacity limitations since they are dedicated.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the different types of network firewalls?

A
  • Stateless Firewalls (block traffic according to rules - does not work with VoIP where signaling and data happen on different ports)
  • Stateful - maintains state. Allows communication on a high port if it sees prior traffic
  • WAF, API GW, XML Parser - complex attacks like SQL which cannot be detected at the network layer
  • Security Groups - abstraction of a FW for virtualized resources. VMs may be in different AZs but still in the same SG.
  • Next Gen FW - a combination of FWs (Stateful, APIGW), combined with VPN and other security functions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What’s the difference between IDS and IPS?

A

Intrusion Detection and Prevention
IDS is passive
IPS is active - may take action to limit damage (e.g. disable a port that is under attack, update FW settings etc.)
IDS/IPS can be either network-based or host-based.

36
Q

What are honeypots and honeynets?

A
  • Appear as high valuable targets when they have no useful data
  • Can distract an attacker from high value targets
  • Not possible in all jurisdictions - because of entrapment.
37
Q

What are the various types of vulnerability assessments?

A
  1. Vulnerability scanners - e.g. AWS Inspector
  2. Internal Audit
  3. Periodical assessment of IAM controls (e.g. AWS Permissions tool)
  4. Configuration status checks
  5. Physical Walk-through
  6. Pen Testing
38
Q

What is the management plane in Virtualization?

A
  • M-Plane normally used by CSP; different from control and data planes
  • M-Plane allows CSP admins to manage the infrastructure - e.g. schedule patches, migrate VMs to other hosts during Mtce Windows; Configuration controls etc.
39
Q

What is the difference between management plane and management console?

A
  • Management console is used by a CSC. Allows them to manage their virtual resources (e.g. start, stop VMs).
  • Management plane is used by a CSP to add hosts to a virtualization fabric, migrate VMs during mtce windows etc.
40
Q

What is IT Service Management or ITSM?

A
  • ITSM is a framework of operational controls
  • Objective: to help organizations design, implement and improve IT operations in a consistent manner
  • Example: of an IT operation is Change Management
41
Q

What are the key standards that govern IT SM?

A
  • ISO 20000-1 and ITIL (UK Government initiative)
  • They focus on process-driven aspects of IT service delivery to organizations
  • Policy driven
  • IT Services defined in a service catalog
  • Define how to understand user needs and continually improve.
42
Q

What are the key pillars of ITSM?

A

There are 12 pillars:

  1. Change Management
  2. Continuity Management
  3. Information Security Management
  4. Continual Service Improvement Management
  5. Incident Management
  6. Problem Management
  7. Release Management
  8. Deployment Management
  9. Configuration Management
  10. Service Level Management
  11. Availability Management
  12. Capacity Management
43
Q

What are the key elements of Change Management?

A

Request -> Review -> Implement -> Document

  • Request initiated via Change Request
  • Review - by a Change Control Board/Change Advisory Board (CCB/CAB)
  • Implement - Owner procures HW/SW/IT service/testing/deploy/rollback etc.
  • CI/CD pipelines automate changes - e.g. automatic security testing when code is submitted.
44
Q

What are the different categories of changes an organization has to deal with.

A
  • Low risk (standard patches, implementing tools etc.)
  • Normal
  • Emergency (Security incidents or vulnerabilities that require immediate attention) - handled via special processes and approved/reviewed retroactively.
45
Q

What are the key elements of Continuity Management?

A

This is keeping the business going during/after an incident - i.e. BCP/DRP

  • Identify critical business functions and resources - e.g. through a BIA, impact of incidents, identify assets, and critical processes.
  • Prioritize recovery - order of recovery
  • Plan continuity - e.g. architect to failover to a redundant site, use cloud’s multi AZ features
  • Document plans and procedures.
46
Q

What is the goal of Information Security Management?

A
  • Ensure a coherent approach to managing information security risks
  • Overarching approach to preserving CIA of systems and data in use.
  • Identify information security risks and apply adequate risk mitigations in the form of security controls.
47
Q

What are examples of operational controls used in Information Security Management?

A
  1. Encryption
  2. IAM
  3. Logging/Monitoring
48
Q

What are examples of supporting business functions used in Information Security Management?

A
  1. Management buy-in and support
  2. Skills, Training and awareness
  3. Oversight
  4. Performance Evaluation
49
Q

With respect to ISMS, what is the relationship between ISO27001 and ISO27002?

A
  • These are ISMS frameworks that are closely related
  • ISO27001 - sets the high-level requirements an organization must meet to provide leadership for, plan, implement and operate an ISMS.
  • ISO27002 provides a set of controls and implementation guidance.
50
Q

What is Continuous Service Improvement Management and its goals?

A
  • Monitoring IT Services and ISMS for effectiveness and continuous improvement. A two part goal that includes:
  • Part 1: IT services are meeting the organization’s business goals
  • Part 2: Ensure that organization’s security risks are adequately mitigated.
51
Q

How is Continuous Service Improvement Management achieved?

A
  • Through Monitoring (e.g. Internal Audits, External Audits)
  • Reporting (Security Metrics)
  • Management Oversight through use of metrics
  • Actual incidents (e.g. COEs and RCAs) used to improve security.
52
Q

What’s the difference between an event and an incident?

A

Events are observable item (e.g. user logging in). Routine events are logged. No additional action required.

Incidents are events that are unexpected and have an adverse impact. Require investigation and remedial action. E.g. ransomware attack.

53
Q

What is the goal of incident management?

A

Resumption of normal service post incident.

54
Q

What does the Incident Management/Response Plan document?

A
  1. Definition of incident types (e.g. security event, operational events, cloud provider events)
  2. Incident Response Team (IRT) personnel
  3. Roles and responsibilities in IRT (coordinator, liasons to external stakeholders)
  4. Resources required (SIEM, IDS/IPS)
  5. Communications to stakeholders
  6. Breach or privacy law notifications
55
Q

What is the lifecycle of an incident management process? E.g. NIST

A
  1. Prepare (an IRP and assemble IRT)
  2. Detect
    • identify incident,
    • continuous and discreet monitoring (e.g. audits, pentests)
    • digital forensics may be brought in if criminal
    • Notification to stakeholders (LEA, Regulators, Customers)
  3. Respond
    • activate plan
    • Contain (e.g. isolate systems)
  4. Recover (eliminate threat)
    • e.g. rebuild system from good image, change password etc.
  5. Post Incident Activity (postmortem, retain evidence, learn, RCA)
56
Q

What criteria should be used to prioritize incidents?

A

Incidents may be prioritized (P0-P5) based on:

  1. Criticality/impact - effect incident will have on the organization (low/moderate/high/critical)
  2. Urgency - time frame in which incident must be resolved to avoid unwanted impact.
57
Q

What is Problem Management?

A
  • Problems are the root cause of incidents.
  • Root Cause Analysis identify the underlying problem thereby preventing recurrence.
  • It is a form of risk management.
58
Q

What is Release Management?

A
  • New software features through Agile Development methodologies.
  • CI/CD pipelines
  • Faster releases, micro-code means easier to identify issues, automated testing, fewer bugs
59
Q

What is deployment management?

A

In modern SW development, once developer checks code in, it is automatically compiled, tested, and rolled out to users. (CI/CD pipeline)

Containers used to run microservices.

Deployments may be pushed or in some cases pulled (e.g. new iOS updates).

60
Q

What is Configuration Management?

A
  • Config Management comprises of practices, activities, processes designed to maintain a known good configuration of something.
  • Done via CMDB
61
Q

What is a Configuration Item?

A

Things that are placed under configuration control.
Example: OS, SW, Security Groups, NACLs etc.

Changes to config items need to go through a formal change control process so as to not introduce new vulnerabilities.

62
Q

What is the role of Service Level Management?

A
  • Performance Management; measures performance of IT services (e.g. Availability, Durability of data etc.)
  • Similar to continual service improvement
  • Enforced via SLAs
63
Q

What are examples of Service Levels that ITSM measures?

A
  • Availability (e.g. 99.9% for EC2)
  • Durability of data (e.g. 11 9s for S3)
  • Response time to customer support request
  • Recovery time in the event of interruption
  • Patching timeframes for vulnerabilities
64
Q

What is the role of an SLA in Service Level Management?

A
  • SLA measure outcomes
  • Are like contracts
  • May have penalties associated with non-conformance (e.g. refunds for customers)
  • Health checks measure availability.
65
Q

What is Availability Management?

A
  • Goal: Ensuring systems are up and available for users; meet SLAs.
  • Risks: loss of network connectivity, power, and other environmental factors
  • Maintenance windows - some CSPs exclude them from availability metrics.
  • Data replication between data centers increase availability
  • Load balancing, multi-AZ deployment, multi-region deployment increase availability.
66
Q

What is Capacity Management?

A
  • Ensuring adequate service capacity to meet demand
  • Risk of not meeting SLAs
  • Largely the domain of CSPs
  • Usage measured through metrics (bandwidth consumption, compute used, storage)
  • Projections of capacity using trends/forecasts
  • Monitoring current service usage and triggering additional capacity adds when thresholds are met.
  • Oversubscription may bring about cost benefits at the risk of availability.
67
Q

What is digital forensics?

A

Applying scientific techniques for the collection, examination and interpretation of digital data.

Normally to support security incident.

68
Q

What is e-discovery?

A

A process in which electronic data is pursued, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case.

  • Examination of information pertinent to legal action.
  • Steps include: identification, collection, preservation, analysis, and review of electronic information.
69
Q

What are the key pillars of a good digital forensics process?

A
  1. Forensic Data Collection Methodologies
  2. Evidence Management
  3. Collect, Acquire and Preserve Digital Evidence.
70
Q

How can you implement good Forensics Data Collection methodologies?

A
  1. Logs are essential
  2. Document everything - including physical and logical system states
  3. Handle data with care (some data e.g. RAM is volatile)
  4. Work from copies of data so as to not compromise the original evidence
  5. Verify integrity of evidence (e.g. Hashing)
71
Q

In Evidence management, what is the role of the chain of custody?

A
  • Documents the integrity of data (details of time, manner, person responsible for various actions such as collecting, making copies, analysis and presentation of evidence).
  • It provides a documented, reliable history of how data has been handled, so it can be relied upon as evidence.
  • It does not mean data or system has not been changed; just that it is defensibly documented.
72
Q

What are the five attributes of useful evidence?

A
  1. Authentic - genuine and related to the crime
  2. Accurate - truthful and have integrity
  3. Complete - no evidence withholding (illegal)
  4. Convincing - support assertions made
  5. Admissible - meet the standards of the court (e.g. no hearsay).
73
Q

What are challenges associated with evidence collection in the cloud?

A
  1. Evidence may be collected during a security incident before it is known that a crime was committed - improper handling
  2. Control - some aspects of the evidence may be under the control of the CSP which may not disclose them
  3. Multitenancy -evidence collected may accidentally include another tenants data causing a breach in itself
  4. Data Volatility and dispersion- in the cloud data may be dispersed across storage devices (shards) in multiple jurisdictions, VMs could migrate between physical machines.
74
Q

How can organizations prepare for evidence collection?

A
  1. Enable logging and monitoring - generate logs/store in SIEM, review regularly
  2. Backup and storage - establish a baseline to compare current system against
  3. Baselines and file integrity monitoring - maintain known good baseline to compare against
  4. Data and records retention
75
Q

What are evidence collection best practices?

A
  • When collecting use original physical media, but for analysis use integrity verified copies (e.g. through hashing)
  • Verify integrity at multiple steps
  • Use dedicated evidence custodian for collection, preservation, logging
  • Establish communications with LEA, Legal and CSP.
76
Q

What are evidence preservation best practices?

A

Goals: Ensure evidence has chain of custody, is admissible in court and available for analysis

  1. Physical security - protect physical media
  2. Physical and environmental maintenance - proper temp, humidity, power
  3. Block interference - use faraday cage to prevent remote wipe
  4. work from copies with integrity checking
  5. document everything - chain of custody.
77
Q

What are Security Operations?

A

Activities undertaken by an organization in monitoring, maintaining and running their security program.

78
Q

What is the Security Operations Center?

A

SOC is an organizational unit designed to centralize a variety of security tasks and personnel at the tactical (mid-term) and operational level (day-to-day).

79
Q

What are the three categories of operations that SOC do?

A
  1. Threat prevention
  2. Threat detection
  3. Incident Management
80
Q

What does threat prevention involve?

A
  • Preventative control and risk mitigations
  • Network security (DDoS, FWs, IPS/IDS, NAT-GW)
  • Vulnerability and patch management programs
  • Application security
  • Information security hardening (e.g. NIST SC controls)
  • Threat hunting
81
Q

What does threat detection involve?

A
  • Log capture, analysis and correlation

- Tools: SIEM, DLP, IPS/IDS, GuardDuty, Security Hub, and other features that provide visibility

82
Q

How is SOC involved in incident management?

A
  • SOC is the main point of coordination for the IRT.
  • Handling forensics
  • communications with stakeholders (regulators, customers, public, partners, security researchers etc.)
  • Threat eradication and recovery
  • Post incident RCAs.
83
Q

What are some of the common tasks that SOCs do?

A
  • Continuous monitoring and reporting (e.g. metrics)
  • Data Security
  • Alert prioritization including declaring a business interruption and triggering BCPs.
  • Incident response (forensics/RCA etc.)
  • Compliance management
84
Q

What types of controls does a SOC monitor?

A
  • Network security controls (e.g.FWs, WAFs, IDS/IPS)
  • Performance and Capacity - to ensure SLAs can be met
  • Vulnerability assessments (scans, pen-tests) conducted frequently as part of continuous assessment
85
Q

How do you protect logs?

A
  • Use high integrity storage media - e.g. write-once, read many (WORM)
  • Restrict access to SOC personnel
  • Monitor storage capacity as logs can grow quickly; periodically rotate logs
  • Retention and secure deletion when no longer needed
  • Properly configure logging functions - e.g. logging levels and what events and information is captured
  • Test and validate log integrity
86
Q

What is a incident response/management plan?

A

It is a proactive control designed to reduce the impact of an incident. It defines structure for the processes to be used when responding to an incident. This allows team members to respond quickly and in a orderly fashion.

87
Q

How is Configuration Management different from Change Management?

A

Configuration Management aims to prevent unauthorized changes whereas Change Management aims to allow changes through a formal process.

Certified Cloud Security Professional (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions