Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Microsoft Professional Program - Cybersecurity > Enterprise Security Fundamentals > Flashcards

Enterprise Security Fundamentals Flashcards

Introduction to Cybersecurity

1
Q

Cybersecurity Landscape - App Development Security

A

Adopt secure app development practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Cybersecurity Landscape - Skill gap

A

IT staff must be trained in information security processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Cybersecurity Landscape - Technology lag

A

Always run the most recent versions of OS and apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cybersecurity Landscape - Availability and sophistication of attack tools

A

Automated exploit tools are easy to procure and use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Cybersecurity Landscape - Asymmetry of attack and defense

A

Resources required to secure an organization exceed the resources required for an attacker to perform an intrusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cybersecurity Landscape - Monetization of Malware

A

Coin Mining attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Cybersecurity Landscape - Internet of Things

A

Distributed DoS attacks on IoT devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cybersecurity Landscape - Increasing regulation

A

An increased number of jurisdictions to introduce legislation and regulation mandating the security controls that should be present over certain types of data hosted in organizational information systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Assume Compromise Philosophy

A

An organization should build and maintain its security posture based on the idea that their information
systems have already been compromised.
The information security teams should focus on detecting and responding to suspicious activity rather
than simply preventing intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cost of a Breach - Proportional security

A

Security spend should be proportional to the value of assets being protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Cost of a Breach - Breach Investigation

A

The organization will have a clear picture of how the breach occurred, how long the intruder was present and the steps needed to make sure those attacks will not work in the future

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Cost of a Breach - Systems rehabilitation

A

Remediate the vulnerabilities that allowed the attacker to compromise the system and any modifications he/she may have made to the system. In many cases the only way to ensure that a system is rehabilitated is to deploy it again from the beginning and then address the vulnerabilities that allowed the attacker to gain access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cost of a Breach - Reputational damage

A

When customers lose faith in an organization’s ability to protect their information, they are less likely to interact with that organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cost of a Breach - Destruction of assets

A

Some malware works by reconfiguring hardware to work beyond its safe specification. For example, overclocking a processor until it overheats and fails. Other malware erases data on target systems or renders them inoperable. In some cases, the malware is deployed deliberately, destroying sensitive systems either to inflict financial damage or as a way of forcing the target organization’s information systems to become inoperative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cost of a Breach - Compliance costs

A

Depending on the type of breach that occurs and the type of industry the target organization is in, there may be fines that must be paid to specific authorities as well as investigations and reports that must be generated, all of which cost money and other organizational resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Red Team vs Blue Team exercises

A

Red team simulates the attack while the blue team simulates the response to the attack.
Goal: to determine if vulnerabilities are present in the existing security configuration as well as to train
organizational staff how to detect and respond to attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Attacker’s objective - Persist Presence

A

Reliable remote access via a back door to the organization’s systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Attacker’s objective - Hackstortion

A

When an attacker compromises a target’s network and then requests payment for a specific action to be taken. This action might be for the attackers to destroy sensitive data they exfiltrated rather than exposing that data to the public.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Attacker’s objective - Ransomware

A

Encrypts files and sometimes entire systems so that they are inaccessible unless a special decryption key is provided. The attackers will provide a decryption key that can be used to recover the encrypted systems for a fee, usually in a cryptocurrency like BitCoin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Attacker’s objective - Other

A

Steal data;
Coin miners;
Destroy systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Red Team Kill Chain - Reconnaissance

A

To determine whether a target is worth attacking, the objectives of an attack, and the characteristics of the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Red Team Kill Chain - Weaponization

A

Creating, or selecting existing, remote access malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Red Team Kill Chain - Delivery

A

Having the target of the attack execute the malware on the information systems infrastructure. Some attacks require user intervention for the remote code to execute; other attack types can be performed remotely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Red Team Kill Chain - Exploitation

A

The attacker’s malware code successfully triggers, leveraging the targeted vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Red Team Kill Chain - Installation

A

The original malware code is leveraged to deploy an access point, also known as a back door, through which the attacker can access the compromised beachhead system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Red Team Kill Chain - Command and Control

A

a. Lateral movement - the attacker begins to compromise other systems on the network, increasing the
number of compromised systems as they move laterally towards accomplishing their goal.
b. Privilege escalation - attacker leveraging a compromised unprivileged account, such as that of a
standard user or service, into control over an account that is able to perform actions beyond those
original privileges.
c. Domain dominance/Administrative privilege

27
Q

Red Team Kill Chain - Actions on the objective

A

Perform the necessary actions on the target in order to reach the final objective

28
Q

Blue Team

A

Is comprised of the organization’s existing information security and IT administration staff.
Goals:
- Stopping the red team from successfully achieving its goals
- Early detection and effective response to red team activities
- Post-exercise report
- Revise the incident response strategy

29
Q

Blue team Kill Chain - Gather baseline data

A

To understand what your environment looks like when it is not under attack. It means configuring effective logging, monitoring, and auditing for your organization.

30
Q

Blue team Kill Chain - Detect

A

Noticing abnormal activity on your organization’s information systems

31
Q

Blue team Kill Chain - Alert

A

The process of bringing suspicious anomalies in the telemetry generated by information systems to the attention of the blue team

32
Q

Blue team Kill Chain - Investigate

A

It should determine which systems the intruder has compromised, when those systems were compromised and how those systems were compromised

33
Q

Blue team Kill Chain - Other activites

A

Plan a response;

Execute.

34
Q

Restrict Privilege Escalation

A

The process by which an attacker acquires the ability to perform a greater variety of tasks on the
organization’s systems from those that they were able to perform when they gained an initial beachhead
on the network.
The end goal of privilege escalation is to acquire full administrative privileges.

35
Q

Restrict Privilege Escalation - Privileged access workstations (PAW)

A

Access is limited to staff that perform administrative tasks;
Should be able to connect to sensitive servers but should be unable to browse the internet or perform non-administrative tasks, such as responding to email. Restrictions on software that can run on the PAW.
Protected by secure technologies. PAWs are configured with secure boot, BitLocker and technologies including Credential Guard.

36
Q

Restrict Privilege Escalation - Just enough administration (JEA)

A

Creates special PowerShell endpoints that limit which PowerShell cmdlets, functions, parameters, and values can be used during a connection to the endpoint

37
Q

Restrict Privilege Escalation - Just in time administration

A

Administrative privileges are provided only for a limited amount of time.
Just in time administration can be combined with JEA

38
Q

Restrict Privilege Escalation - Restrictions on administrative accounts

A

Restricting where administrative accounts can be used

39
Q

Restrict Lateral Movement

A

When an attacker who has compromised one system is able to compromise another system on the
network by using an existing compromised system as a jump off point

40
Q

Restrict Lateral Movement - Code Integrity policies

A

Restrict which applications and scripts can run on a computer

41
Q

Restrict Lateral Movement - Network segmentation

A

Segmenting critical workloads onto separate networks and VLANS and then controlling which traffic can cross those boundaries. Network segmentation allows you to limit which hosts can communicate with sensitive servers.

42
Q

Restrict Lateral Movement - Passwords/accounts

A

No common accounts or passwords

43
Q

Restrict Lateral Movement - Logon script sanitation

A

Logon scripts can often include sensitive information, with some logon scripts even including passwords in clear text

44
Q

Restrict Lateral Movement - Apply software update and patches

A

Organizations should ensure that operating systems, applications, device drivers and firmware have all appropriate software updates applied in a timely manner as this will restrict attackers from using known exploits to perform lateral movement.

45
Q

Attack Detection - Logging and monitoring

A

The collection of system event telemetry is important to detecting and understanding how an attacker is infiltrating and compromising a system.

46
Q

Attack Detection - SIEM systems

A

Perform analysis of event log data as it is generated.

47
Q

Attack Detection - IDS

A

Software application, hardware or virtual appliance, that monitors an organization’s information
systems for problematic activity or violations of policy.

48
Q

Attack Detection - Attack detection and machine learning

A

Finding patterns and anomalies that may not have been apparent using older analysis techniques

49
Q

Attack Detection - Microsoft’s Advanced Threat Analytics

A

Solution deployed in on-premises environments to detect threats. It uses behavioral analytics to determine what constitutes abnormal behavior on the network based on its understanding of prior behavior of security entities

50
Q

Attack Detection - Microsoft’s Azure Advanced Threat Protection

A

All of the telemetry is funneled for analysis into the cloud rather than that analysis being performed on-premises

51
Q

Attack Detection - Microsoft’s Azure Security Center

A

Can analyze event telemetry from servers running both on-premises, bare metal or virtualized as well as servers running as IaaS virtual machines, correlating events so that administrators are able to view the timeline of a specific attack as well as steps that can be taken to mitigate that attack.

52
Q

Attack Detection - Microsoft’s Windows Defender Advanced Threat Protection

A

Endpoint behavioral sensors : Monitors a Windows 10 computer’s telemetry, including gathering data from event logs, running processes, registry, file, and network communications data. This data is forwarded to the organization’s Windows Defender ATP cloud instance.

Cloud security analytics takes the telemetry gathered at the endpoint level and analyzes that data, providing threat detections and recommended responses back to the organization.

Threat intelligence : engages with partner organizations to identify attacker tools and techniques and to raise alerts when evidence of these tools and techniques surfaces in customer telemetry.

Office 365 ATP:
Scan email attachments to find malware;
Scan email messages and office documents to locate malicious web addresses;
Locate spoof email messages;
Determine when an attacker attempts to impersonate your users or organization’s custom domains.

53
Q

CIA triad - Confidentiality

A

Ensuring that the dissemination of info is limited to the intended audience and remains unavailable to unauthorized persons

54
Q

CIA triad - Integrity

A

Ensuring data isn’t modified or deleted without authorization. Authorized modifications should also be tracked. Auditing and change tracking should be implemented.

55
Q

CIA triad - Availability

A

Ensuring data is accessible to those that have permission to access it when they need it.
Ensuring that data remains available after information systems become unavailable, either through
equipment failure, data corruption or natural disaster.

56
Q

Organization Preparation - Baseline Security Posture

A

An organization’s desired/expected security configuration

57
Q

Organization Preparation - Information Classification

A

Determining which information needs to be protected and the level of protection. Determines which controls will be implemented when it comes to addressing the pillars of CIA triad

58
Q

Organization Preparation - Change tracking and auditing

A

Determining who modified a document, when it was modified and what modifications were done. Auditing - info about which users, authorized and unauthorized, may have attempted or gained access to data

59
Q

Organization Preparation - Monitoring and Reporting

A

Collecting system event telemetry to determine what actions an external intruder might be taking and also what unauthorized actions an authorized insider might be performing

60
Q

Developing and Maintaining Policies

A

They provide clarity on how sensitive info is to be protected and who is responsible for configuring and maintaining the controls that provide the protection.

61
Q

Pre-Incident processes

A

Maintaining the organization’s ongoing baseline security posture:

  • patch management strategy
  • effective monitoring and alerting - only a calibrated monitoring and allerting system can warn that
    an incident is ocurring
  • ensuring good administrative practices - privileged access wks, just enough administration,
    privileged access management
  • restricting possibility of lateral movement
  • ensure good data classification and protection practices
  • perform red team exercises regularly
62
Q

Intra-Incident processes

A

Policies and procedures for when an intruder is detected:

  • determine the extent of the compromise - a detailed investigation on which systems have been
    compromised, how and when
  • plan a response - the attempt to evict the intruder occurs only after the extent of the compromise
    has been determined
  • enact the response - evict the intruder and also remediate the vulnerabilities that allowed the
    intruder to gain access to the network
63
Q

Post-Incident processes

A

Analysis of what was lacking in the implementation of the baseline security posture that allowed the intruder to gain access

64
Q

Disclosure responsability

A

Not only must information systems be remediated, but appropriate notifications must be made

Microsoft Professional Program - Cybersecurity (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions