Domain 9 - Incident Response

Question 1

What are the four stages of IR plan?

Answer 1

1. Preparation
2. Detection and Analysis
3. Containment, Eradication & Recovery
4. Post Mortem.

Question 2

What is involved in the Preparation stage of IR?

Answer 2

1. Process to handle incidents
2. Who’s who - IR manager, team
3. Documentation (arch diagram, network IP addresses and ports)
4. Training
5. Vulnerability assessment
6. Third party threat intel

Question 3

What is involved in the detection & analysis stage of IR?

Answer 3

1. Alerting (endpoint protection, host monitoring, network security monitoring, anomaly detection)
2. Validating alerts
3. Estimating the scope of the incident
4. Assigning an incident manager
5. Understanding timeline of attack.
6. Notification and coordination

Question 4

What is involved in the containment & eradication stage of IR?

Answer 4

1. Taking systems offline
2. clean up compromised devices, restore from backup

Question 5

How does the cloud impact the preparation stage of IR?

Answer 5

• SLAs have to be agreed upon with CSP.
• Understand what data and logs are available for incident management
• Prepare tools to do remote investigation (understand what VM images, disk storage are available)
• Architect appropriately - e.g. turn on CT logs, store logs, architect for isolation using VPCs, use immutable servers,
• Do Threat Modeling and Gamedays

Question 6

How does the cloud impact the Detection & Analysis stage of IR?

Answer 6

• Monitoring must cover both the assets and the management plane
• Leverage in-cloud monitoring and automation workflows (e.g. usage metrics, lambda functions)
• Use Cloud Logs (CT, CW)
• Understand logging gaps (.e.g serverless and auto scaling)
• Is Cloud Provider activities logged?
• Network logs (e.g. VPC flow logs) may not be packet captures
• Understand chain of custody
• Forensics and investigative support must be cloud-native
• Automate - e.g. snapshot VM images, capture metadata, pause VMs to preserve volatile memory
• Examine configuration data, data access logs, management plane logs

Question 7

How does the cloud impact the Containment & Recovery stage of IR?

Answer 7

• Leverage cloud capabilities to isolate the infected components (e.g. remove infected VM out of an auto-scaling group and isolate it using an SG.