Domain 7: Security Operations Flashcards
Alternate Site
A general term for a contingency or continuity of operations (COOP) site used to assume system or organizational operations if the primary site is not usable for period.
Backup
A copy of files and programs made to facilitate recovery, if necessary.
Baseline
The total inventory of all of a system’s components, including hardware, software, data, administrative controls, documentation, or user instructions.
Baselining
Creating a total inventory of a system, component by component, part by part.
Blocked Listing and Allowed Listing (software, identities, addresses)
Use of lists of blocked or allowed identities, whether as users, URLs, URIs, web addresses, IP addresses, geographic regions, hardware addresses, files, or programs, as a means of controlling (prohibiting or permitting) their access, use, or attempt to load and execute.
Change Management
The formal process an organization uses to transition from the current state to a future state. This typically includes mechanisms to request, evaluate, approve, implement, verify, and learn from the change.
Configuration Item
1.- An aggregation of information system components designated for configuration management (CM) and treated as a single entity in the CM process. 2.- Item or aggregation of hardware, software, or both, which is designated for configuration management and treated as a single entity in the CM process.
Configuration Management (CM)
A collection of activities focused on establishing and maintaining the integrity of information technology products and information systems, through control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle.
Cyber Forensics
The practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.
Disaster Recovery (DR)
The ability to provide IT services following an interruption, often at an alternate location.
Disruption
An unplanned event that causes an information system to be inoperable for a length of time (e.g., minor or extended power outage, extended unavailable network or equipment, or facility damage or destruction).
Egress Monitoring
Monitoring the flow of information out of an organization’s control boundaries.
Entity
Any form of user, such as a hardware device, software daemon, task, processing thread, or human, that is attempting to use or access systems resources. Endpoint devices, for example, are entities that human (or nonhuman) users make use of in accessing a system. Should be subject to access control and accounting. See also User and Entity Behavior Analysis.
Eradication
In incident response, the activities that remove the cause of the incident from the environment. This often requires the use of a formal root cause analysis process.
Event
Any observable occurrence in a network or system.
False Positive
Incorrectly classifying a benign activity, system state, or configuration as malicious or vulnerable.
Forensics, Cyber Forensics
The examination of evidence related to suspected criminal activity. Cyber forensics refers to investigations of such activities involving information systems.
Full Backup
Copies the entire system to backup media.
Hackback
Actions taken by a victim of hacking to compromise the systems of the alleged attacker.
Hardening
A reference to the process of applying secure configurations (to reduce the attack surface) and locking down various hardware, communications systems, and software, including operating system, web server, application server, application. Hardening is normally performed based on industryguidelines and benchmarks such as those provided by the Center for Internet Security (CIS).
Honeypots/ Honeynets
Machines that exist on the network, but do not contain sensitive or valuable data; they are meant to distract and occupy malicious attackers or unauthorized intruders, as a means of delaying their attempts to access production data/assets. Several machines of this kind, linked together as a network or subnet, are referred to as a honeynet.
Hot Site
A fully operational offsite data processing facility equipped with hardware and software, to be used in the event of an information system disruption.
Incident
An event that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.
Incident Response
The mitigation of violations of security policies and recommended practices.
Incident
The event that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.
Indicator
A technical artifact or observable occurrence that suggests an attack is imminent or is currently underway, or that a compromise may have already occurred.
Indicators of Compromise (IoC)
A signal that an intrusion, malware, or other predefined hostile or hazardous set of events is occurring or has occurred.
Information Security Continuous Monitoring (ISCM)
Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. [Note: The terms “continuous” and “ongoing” in this context mean that security controls and organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security decisions to adequately protect organization information.] Ongoing monitoring sufficient to ensure and assureeffectiveness of security controls related to systems, networks, and cyberspace, by assessing security control implementation and organizational security status in accordance with organizational risk tolerance, and within a reporting structure designed to make real-time, data-driven risk-management decisions.
Information Sharing and Analysis Center (ISAC)
Any entity or collaboration created or employed by public- or private-sector organizations, for purposes of gathering and analyzing critical cyber and related information to better understand security problems and interdependencies related to cyber systems, to ensure their availability, integrity, and reliability.
Intrusion
A security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system or system resource without having authorization to do so.
Intrusion Detection System (IDS)
A security service that monitors and analyzes network or system events for the purpose of finding and providing real-time or near-real-time warning of attempts to access system resources in an unauthorized manner.
Intrusion Prevention Systems (IPS)
A security service that uses available information to determine if an attack is underway; it then sends alerts but also blocks the attack from reaching its intended target.
Log
A record of actions and events that have taken place on a computer system.
Precursor(s)
Signals from events that suggest a possible change of conditions (internal orexternal to the organization) may alter the current threat landscape. An increase in tensions in local political or social environments, or complaints or grievances by employees or customers going viral in social media, are examples of precursors.
Provisioning
Taking a particular configuration baseline, making additional or modified copies of it, then taking steps as necessary to properly place those copies into the environments they should belong in.
Ransom Attack
Any form of attack that threatens the destruction, denial, or unauthorized public release or remarketing of private information assets. Usually involves encrypting these assets and withholding the decryption key until the ransom is paid by the victim.
Ransomware
Malware used for the purpose of facilitating a ransom attack.
Recovery
The process of jointly addressing business resiliency and restoration of critical infrastructure and functionality after a disruption.
Regression Testing
Testing of a system to ascertain whether recently approved modifications have changed its performance of other approved functions or has introduced other unauthorized behaviors.
Remediation
Changes to a system’s configuration to immediately limit or reduce the chance of recurrence of an incident. This might include updating the sensitivities, thresholds, or alarm settings on any number of security controls, or instituting a rapid reset of access controls information such as passwords and security challenge responses.
Request for Change (RFC)
The documentation of a proposed change in support of change management activities.
Root Cause Analysis
A principle-based, systems approach for the identification of underlying causes associated with a particular set of risks or incidents.
Sandbox
A testing environment that is logically, physically, or virtually isolated fromother environments, and in which applications or systems can be evaluated. Sandboxes can be used as part of development, integration, or acceptance testing (so as to not interact with the production environments), as part of malware screening, or as part of a honeynet.
Threat Intelligence
Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.
User and Entity Behavior Analytics (UEBA)
Analysis of behaviors and activities of human and nonhuman users, and of the software and hardware entities associated with those users and activities, as a way of detecting inappropriate or unauthorized activity, including fraud detection, malware, and insider attacks.
Vulnerability Management
The activities necessary to identify, assess, prioritize, and remediate information system weaknesses.
